Global, also described as Global Group, is a financially motivated ransomware and data-extortion operation that emerged publicly in June 2025. Cyble’s profile describes an affiliate service promoted through the RAMP forum by a user known as “$$$.”
Intrinsec’s research connects the brand with earlier BlackLock, Eldorado and Mamona activity through promotion and infrastructure evidence. Its reviewed leak-site sample emphasized Western organizations and health care. Such listings are allegations rather than verified victim counts. Intrinsec reported no new Global claims after Aug. 20, 2025; that historical observation does not establish a permanent shutdown.
Intrinsec analyzed a Windows payload with capabilities to spread across a network, stop antivirus services and encrypt local files and network shares. It assessed that purchased access could support intrusions. Cyble also describes data-theft tooling and an affiliate negotiation platform. These group-level findings do not establish the techniques used against a particular claimant’s target.
The evidence supports a cybercriminal ransomware and extortion operation. Rebranding assessments do not establish that every associated brand has identical personnel. The reviewed research does not identify a confirmed state sponsor, the people directing the operation or a verified current organizational structure.
Global lists the auditor’s exact domain and alleges possession of private and bank-account information. Comparitech independently reported the listing, a ransom demand and a threatened release within less than24hours. The county confirmed unauthorized access but has not verified Global’s responsibility, encryption, the scope of theft or any release. Tracker discoveryJuly14,2025 is not intrusion or original publication.
