global
Also known as: Global Cybernetic CollectiveFirst seen June 4, 2025Active40 claimed victims
The claims below are reproduced as posted by global on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
GLOBAL GROUP is a ransomware-as-a-service operation that emerged in June 2025, reportedly launched by a known Russian-speaking threat actor, featuring AI-driven ransom negotiation and a mobile control panel for affiliates, targeting healthcare, oil and gas, industrial engineering, and automotive sectors.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| TOWN OF SUTTON | MASSACHUSETTS | September 12, 2026 | ransomware_live | — |
| Sutton Public Schools | September 12, 2026 | ransomware_live | — |
| WHO IS NEXT?? | September 8, 2026 | ransomware_live | — |
| WHO IS NEXT? | September 6, 2026 | ransomware_live | — |
| Atcomm | August 26, 2026 | ransomware_live | — |
| Shanghai Tunnel Engineering Co Ltd | August 19, 2026 | ransomware_live | — |
| Hangzhou Qihan Biotech Co., Ltd. | August 12, 2026 | ransomware_live | — |
| Vigilia | August 6, 2026 | ransomware_live | — |
| hmsaojose.com | August 20, 2025 | ransomware_live | — |
| awmedicalvillage.org | August 20, 2025 | ransomware_live | — |
| RUKU Tore - Türen | July 30, 2025 | ransomware_live | — |
| Albavision.tv | July 28, 2025 | ransomware_live | — |
| RTE | July 26, 2025 | ransomware_live | — |
| Rete Toscana Classica | July 26, 2025 | ransomware_live | — |
| MukundRhotindian | July 26, 2025 | ransomware_live | — |
| Medical Village LIV | July 26, 2025 | ransomware_live | — |
| Geomaticks Grecia | July 26, 2025 | ransomware_live | — |
| Dithelm Travel Group | July 26, 2025 | ransomware_live | — |
| Cyme Servicios Médicos | July 26, 2025 | ransomware_live | — |
| CONTRAQI | July 26, 2025 | ransomware_live | — |
| lafavoritaservice.it | July 25, 2025 | ransomware_live | — |
| moelco.es | July 25, 2025 | ransomware_live | — |
| loraincountyauditor.gov | July 14, 2025 | ransomware_live | — |
| Emphail.com | July 9, 2025 | ransomware_live | — |
| entab.se | June 30, 2025 | ransomware_live | — |
| Capitol Taxes | June 11, 2025 | ransomware_live | — |
| Fenol Kimya | June 11, 2025 | ransomware_live | — |
| Skyline Dubuque | June 11, 2025 | ransomware_live | — |
| Letry | June 11, 2025 | ransomware_live | — |
| Rosewood Farm | June 11, 2025 | ransomware_live | — |
| Ascot Vale Health Group | June 7, 2025 | ransomware_live | — |
| ad-engineering.co.uk | June 7, 2025 | ransomware_live | — |
| Deakin Medical | June 7, 2025 | ransomware_live | — |
| https://www.personalservice.com.br/ | June 7, 2025 | ransomware_live | — |
| Morpeth Pharmacy | June 7, 2025 | ransomware_live | — |
| TC Wilson | June 6, 2025 | ransomware_live | — |
| LS Proline | June 5, 2025 | ransomware_live | — |
| all-nations-health-center | June 4, 2025 | ransomware_live | — |
| www.motorworldarc.co.uk | June 2, 2025 | ransomware_live | — |
| Epworth-Hospital | May 28, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).