Global — Ransomware Profile
GLOBAL GROUP is a ransomware-as-a-service operation that emerged in June 2025, reportedly launched by a known Russian-speaking threat actor, featuring AI-driven ransom negotiation and a mobile control panel for affiliates, targeting healthcare, oil and gas, industrial engineering, and automotive sectors.Also tracked as
GLOBAL GROUP, BlackLock, El Dorado
IntelFusions coverage (1)
- Ransomware crew Gentlemen arms affiliates with custom EDR killers 2026-06-19 · Ransomware
Recent claimed victims
- TOWN OF SUTTON | MASSACHUSETTS 2026-09-12
- Sutton Public Schools 2026-09-12
- WHO IS NEXT? 2026-09-06
- Vigilia 2026-08-28
- Atcomm 2026-08-28
- Hangzhou Qihan Biotech Co., Ltd. 2026-08-28
- Shanghai Tunnel Engineering Co Ltd 2026-08-28