global secret group
Intelligence Assessment
Global secret group is a financially motivated ransomware operation. It appears to have recently emerged as a threat actor.
The group has targeted 31 victims in the last 90 days across sectors including Technology, Retail, and Manufacturing, primarily in the US, Brazil, and Canada.
The actor is currently active with recent attacks reported between July 26 and July 27, 2026.
Threat Analysis
global secret group is a ransomware operation that deploys encryption-based extortion against organizations globally. This group maintains a data leak site (DLS) to pressure victims into paying ransom demands.
Financially motivated threat actors like global secret group prioritize monetary gain through methods such as ransomware deployment, banking trojans, cryptocurrency theft, BEC scams, or credential harvesting for resale on underground markets.
Ransomware Victims (32)
CTIWATCH tracks 32 organizations claimed as victims by global secret group on its data leak site, with attack dates, sectors and countries.
View full victims list →Known Campaigns
Global Secret Group is conducting an active ransomware campaign targeting organizations across 10 countries. Primary targets: Energy & Utilities, Financial Services, Healthcare. 32 confirmed victims recorded in the last 45 days. Campaign status: ACTIVE (last activity 1 Aug 2026).