Ransomware Group intelligence
Global Secret Group
ActiveTrack Global Secret Group with 52 published victims and 6 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Global Secret Group is tracked by Breach House as a ransomware group with 52 published victims.
United States is currently the most targeted country in this dataset.
6 known leak locations are currently associated with this group.
Leak Status Distribution
52
- Leaked 23 44.2%
- Pending 28 53.8%
- Deleted 1 1.9%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (6)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 6 | Onion service | Up checked 5h ago | hnkclceyxgwa2g5fxvvu37bvpejqhpup5vlybxfx45h6xloyjnvxuuyd.onion |
| Leak location 5 | Onion service | Up checked 5h ago | ee2iit5piqlarwz3kxm6ctkpbpt2olsxadq7lclqwnhlzaafamfbpiid.onion |
| Leak location 3 | Onion service | Up checked 5h ago | b5gozwifyvy5bhys3bsiq5tedhpot345udggjyb54fsjd2m7nteftkad.onion |
| Leak location 2 | Onion service | Up checked 5h ago | 3u2h3ingiz45yyiplgbuflp6jex4xd2wtubvgjdg44nlgllrjv6qxxid.onion |
| Leak location 1 | Onion service | Up checked 5h ago | o5lsqyar7ox25z734k6zaxt2vf7bsyi4q5rturi5iyxzqo3ica7bjsad.onion |
| Leak location 4 | Onion service | Down checked 5h ago | dcjy5n3qqnk4lbpwoxh7xgki6lym23jdjsjlkhcw63gbh4jl7r4bukqd.onion |
Top Activity Sectors (13)
Typical Attacks (12)
▼MITRE ATT&CK does not currently catalogue Global Secret Group, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v20.0. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: Global Secret Group leverages PowerShell scripts to execute malicious payloads and stage ransomware binaries across compromised hosts.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: Global Secret Group disables antivirus tools by terminating security processes and modifying Windows Defender settings to evade detection.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1070.004 File Deletion Stealth
What they do: Global Secret Group deletes Volume Shadow Copies via vssadmin and system restore points to prevent data recovery attempts.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1083 File and Directory Discovery Discovery
What they do: Global Secret Group executes file and directory discovery via PowerShell to locate critical documents and shadow copies before encryption.
What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
-
T1135 Network Share Discovery Discovery
What they do: Global Secret Group uses network share discovery to map SMB endpoints and identify high-value data repositories for exfiltration.
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: Global Secret Group moves laterally through SMB/Windows Admin Shares to compromise additional servers within the network.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1560.001 Archive via Utility Collection
What they do: Global Secret Group archives stolen data using built-in utility commands before exfiltration to support extortion demands.
What that means: Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration.
-
T1041 Exfiltration Over C2 Channel Exfiltration
What they do: Global Secret Group exfiltrates victim data over encrypted C2 channels using custom Python scripts before deployment.
What that means: Adversaries may steal data by exfiltrating it over an existing command and control channel.
-
T1485 Data Destruction Impact
What they do: Global Secret Group performs targeted data destruction on non-essential directories to maximize operational disruption.
What that means: Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.
-
T1486 Data Encrypted for Impact Impact
What they do: Global Secret Group encrypts victim files using AES-256 encryption with custom ransomware binaries targeting business documents and databases.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1489 Service Stop Impact
What they do: Global Secret Group stops critical Windows services like backup and monitoring utilities via net stop commands to disrupt recovery.
What that means: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.
-
T1490 Inhibit System Recovery Impact
What they do: Global Secret Group inhibits system recovery by corrupting backup configurations and disabling restore mechanisms post-encryption.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Victims (52)
Search, filter and paginate the victim timeline for Global Secret Group. Showing 1–52 of 52.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | Graves Fireplaces, Inc. id35354 View details | United States | Retail / E-commerce | pending | ||
|
FUCKED Graves Fireplaces, Inc. 🇺🇸 United States $5.3 Million Country: Cumming, Georgia, US | Website: www.gravesfireplaces.com | Revenue: $5.3 Million | Industry: Hearth Products, Fireplace Sales and Installation | Employees: 20-50 | Properties: 76.1 GB (77,117 Files, 5,170 Folders) 77,117 FILES CHECKED 76.1 GB DATA ANALYZED |
||||||
| Ransomware | Rosenberg & Pittinsky id35260 View details | United States | Finance / Legal / Insurance | pending | ||
|
FUCKED Rosenberg & Pittinsky 🇺🇸 United States $5 Million NameCompany: Rosenberg & Pittinsky, LLP | Country: New York, NY 10016 | Website: rpllplaw.com | Revenue: $5 Million | Industry: Legal Services, Law Firm, Real Estate & Commercial Litigation | Employees: 25-50 | Properties: 430 GB (218,361 Files, 6,630 Folders) 218,361 FILES CHECKED 430 GB DATA ANALYZED |
||||||
| Ransomware | Seminole Schools id35253 View details | United States | Education | pending | ||
|
FUCKED Seminole Schools 🇺🇸 United States $15.5 Million NameCompany: Seminole Schools | Domain: internal.seminole.org | Country: Seminole,Florida,US | Website: sps.k12.ok.us | Revenue: $15.5 Million | Industry: Education General, Education | Employees: 50-100 | Properties: 39.6 GB (54,468 Files, 5,495 Folders) 54,468 FILES CHECKED 39.6 GB DATA ANALYZED |
||||||
| Ransomware | Turn5 id33479 View details | United States | IT | pending | ||
|
Country: Pennsylvania 19301, US | Website: turn5.com | Revenue: $84.4 Million | Industry: Automotive Aftermarket, Auto Parts | Employees: 300-500 | Properties: 328 GB (26,503 Files, 446 Folders) |
||||||
| Ransomware | Allied Supply Co. id33036 View details | — | null | pending | ||
|
Country: Ohio 45402, US Website: alliedsupply.com Revenue: $8 Million Industry: Wholesale, Industrial Machinery & Equipment, Manufacturing | Employees: 50-100 | Properties: 25.3 GB (32,019 Files, 3,994 Folders) |
||||||
| Ransomware | Kjla id33037 View details | United States | IT | leaked | ||
|
Country: US | Website: kjla.com | Revenue: $6.7 Million | Industry: Broadcasting | Employees: 11–50 employees | Properties:: 783 GB (501,662 Files, 42,890 Folders) |
||||||
| Ransomware | CO-OP URBAN BANK LTD id32752 View details | India | Finance / Legal / Insurance | pending | ||
|
Country: India | Website: https://indialei.in/detailed-information/353561/335800GR1DJMM8YD7J14/the-gudivada-co-op-urban-bank-limited/ | Revenue: $50 Million | Industry: Bank, Finance | Employees: 25-50 | Properties: 41.3 GB (125,988 Files, 14,641 Folders) |
||||||
| Ransomware | Mesan USA id32728 View details | United States | Services | pending | ||
|
Country: Miami, Florida 33166, US | Website: mesanusa.com | Revenue: $5.4 Million | Industry: Industrial Machinery & Equipment, Manufacturing | Employees: 10-20 | Properties: 184 GB (188,562 Files, 26,169 Folders) |
||||||
| Ransomware | Quality Resource Pvt id32408 View details | United States | Services | pending | ||
|
Country: United States | Website: qualityresourcepvt.com | Revenue: $19 Million | Industry: Advertising Networks | Employees: 201–500 employees | Properties: 60.1 GB (170,436 Files, 88,440 Folders) |
||||||
| Ransomware | R L Fine Chem Pvt. Ltd. id32357 View details | India | Manufacturing / Engineering | pending | ||
|
Country: BANGALORE, Karnataka, India | Website: rlfinechem.com | Revenue: $54.3 Million | Industry: Pharmaceutical Manufacturing | Employees: 500-1000 | Properties: 18.6 GB (14,155 Files, 2,840 Folders) |
||||||
| Ransomware | Tiseo Paving id32121 View details | United States | Services | pending | ||
|
Country: Texas, US | Website: tiseopaving.com | Revenue: $22.6 Million | Industry: Construction, Commercial & Residential Construction | Employees: 50-100 | Properties: 457 GB (83,932 Files, 10,829 Folders) |
||||||
| Ransomware | Johnson City Honda id32122 View details | United States | Manufacturing / Engineering | pending | ||
|
Country: Tennessee, United States | Website: johnsoncityhonda.com | Revenue: $6,5 Million | Industry: Automobile Dealers | Employees: 11-50 | Properties: 32.9 GB(34,277 Files, 8,896 Folders) |
||||||
| Ransomware | Lockheed Architectural Solutions, Inc. id32123 View details | United States | IT | leaked | ||
|
Country: Pascoag, RI 02859, United States | Website: lockheedsolutions.com | Revenue: $31.2 Million | Industry: Manufacturing, Construction, Building Materials | Employees: 100-200 | Properties: 1.3 TB (558,462 Files, 97,835 Folders) |
||||||
| Ransomware | The Rubber Group id31800 View details | United States | — | leaked | ||
|
Country: New Hampshire,US | Website: www.rubber-group.com | Revenue: $19.4 Million | Industry: Plastics Manufacturing, Tires & Rubber, Manufacturing | Employees: 50-100 | Properties: 162 GB (207,203 Files, 21,624 Folders) |
||||||
| Ransomware | 4M REALTY COMPANY id31797 View details | United States | — | pending | ||
|
Country: Texas, US | Website: 4mrealty.com | Revenue: $5 Million | Industry: Real Estate Brokerage, Real Estate Sales, Property Sales, Commercial Real Estate | Employees: 20-50 | Properties: 237 GB (54,995 Files, 4,600 Folders) |
||||||
| Ransomware | Columbia University Information (Dental) id31720 View details | United States | Education | leaked | ||
|
Country: New York, US | Website: columbia.edu | Revenue: $6.6 Billion | Industry: Colleges & Universities | Employees: 20.000-25.000 | Properties: 296 GB (283,387 Files, 11,268 Folders) |
||||||
| Ransomware | Coggins Insurance Agency id31535 View details | United States | Finance / Legal / Insurance | leaked | ||
|
Country: Florida, United States | Website: cogginsinsurance.com | Revenue: $5 Million | Industry: Insurance | Employees: 1-10 | Properties: 85.9 GB (245,768 Files, 26,563 Folders) |
||||||
| Ransomware | MACOFIN HELLAS S.A. id31526 View details | Greece | Finance / Legal / Insurance | pending | ||
|
Country: Greece | Website: maco-fin.com | Revenue: $10 Million | Industry: Real Estate / Asset Management / Investment Services | Employees: 11–50 Employees | Properties: 55.3 GB (48,089 Files, 7,491 Folders) |
||||||
| Ransomware | Cook Remodeling id31522 View details | United States | Construction / Real Estate | leaked | ||
|
Country: Arizona, United States Website: cookremodeling.com | Revenue: $5 Million | Industry: Construction Management | Employees: 11-50 Properties: 23.2 GB (47,193 Files, 8,323 Folders) |
||||||
| Ransomware | Pavillon id31294 View details | United States | NGOs / Associations | pending | ||
|
Country: Mill Spring, North Carolina, United States | Website: pavillon.org | Revenue: $8.5 Million | Industry: Alcoholism Treatment, Hospitals & Clinics, Healthcare | Employees: 100-200 | Properties: 646 GB (47,950 Files, 7,750 Folders) |
||||||
| Ransomware | Vernon & Waldrep id31146 View details | United States | Finance / Legal / Insurance | leaked | ||
|
Country: Texas, United States | Website: vernonwaldrep.com | Revenue: $5 Million | Industry: Physicians, Mental Health Specialists | Employees: 21–50 | Properties: 274 GB (56,006 Files, 3,421 Folders) |
||||||
| Ransomware | Louisiana Coalition Against | Domestic Violence id30956 View details | United States | NGOs / Associations | leaked | ||
|
Country: US | Website: lcadv.org | Revenue: $13.3 Million | Industry: Non-Profit & Charitable Organizations | Employees: 201-500 | Properties: 241 GB (287,451 Files, 31,100 Folders) |
||||||
| Ransomware | Park Manufacturing Corp. id30945 View details | United States | Manufacturing / Engineering | leaked | ||
|
Country: Cambridge, Minnesota 55008, US | Website: parkmfg.com | Revenue: $17.9 Million | Industry: Appliances, Electrical, and Electronics Manufacturing | Employees: 50-100 | Properties: 195 GB (411,109 Files, 48,413 Folders) |
||||||
| Ransomware | Hinduja Tech | BMW Group & Škoda Auto id30936 View details | India | IT | pending | ||
|
Country: India | Website: hindujatech.com | Revenue: $381 Million | Industry: Engineering Services, Architecture, Engineering & Design, Product Engineering Solutions | Employees: 2000-5000 | Properties: 515 GB (212,785 Files, 83,982 Folders) |
||||||
| Ransomware | Pro-Tuff | Decals id30930 View details | United States | Retail / E-commerce | pending | ||
|
Country: Crystal Lake, US | Website: protuffdecals.com | Revenue: $9.6 million | Industry: Business Services General, Business Services | Employees: 10-20 | Properties: 412 GB (589,623 Files, 40,081 Folders) |
||||||
| Ransomware | Spergel id30933 View details | Canada | — | pending | ||
|
Country: Canada | Website: spergel.ca | Revenue: $28.2 Million | Industry: Business Services,Project Management | Employees: 51-200 | Properties: 5.4 TB (7,830,792 Files, 902,844 Folders) |
||||||
| Ransomware | Prism Telecom id30918 View details | Finland | — | — | deleted | |
|
Backbone network traffic analysis and SS7 protocol vulnerability assessment across 3 continents. |
||||||
| Ransomware | Cipher Dynamics id30919 View details | India | IT | — | leaked | |
|
Zero-trust architecture review and cryptographic key management assessment. |
||||||
| Ransomware | Stratos Network id30920 View details | United Arab Emirates | IT | — | leaked | |
|
Satellite communication relay analysis with deep-packet inspection across 14 ground stations. |
||||||
| Ransomware | OmniLink AG id30921 View details | Germany | IT | — | leaked | |
|
Full-scope penetration testing of financial transaction processing pipeline and API gateway. |
||||||
| Ransomware | Vertex Systems id30922 View details | United States | IT | — | leaked | |
|
Ongoing analysis of cloud-native architecture and microservice communication protocols. |
||||||
| Ransomware | Nexon Corp. id30923 View details | Korea, Republic of | IT | — | leaked | |
|
Internal infrastructure audit revealed multiple critical entry points across distributed network segments. |
||||||
| Ransomware | Farmers Mutual Fire Insurance id30924 View details | United States | Agriculture / Food | pending | ||
|
Country: Pennsylvania, United States | Website: farmersofmarble.com | Revenue: $5.2 Million | Industry: Insurance | Employees: 11-50 | Properties: 5.72 GB (18,699 Files, 2,631 Folders) |
||||||
| Ransomware | West Sixth Law id30925 View details | United States | — | leaked | ||
|
Country: Columbus, Indiana, United States | Website: agslawyers.com | Revenue: $5 Million | Industry: Law Firms & Legal Services | Employees: 11-50 Employees | Properties: 328 GB (708,816 Files, 47,925 Folders) |
||||||
| Ransomware | Baker Business & Tax Solutions id30926 View details | United States | — | pending | ||
|
Country: Kentucky, United States | Website: bakerbusinessandtax.com | Revenue: $1 Million | Industry: Accounting for Legal Practices | Employees: 1-10 Employees | Properties: 213Gb (817,209 Files, 48,866 Folders) |
||||||
| Ransomware | Carpets Direct id30927 View details | United States | — | leaked | ||
|
Country: Ohio, United States | Website: carpetsdirectfindlay.com | Revenue: $5 Million | Industry: Retail,Furniture | Employees: 11-50 | Properties: 31.1 GB (1,442 Files, 788 Folders) |
||||||
| Ransomware | AnyWeather id30928 View details | United States | — | leaked | ||
|
Country: Kentucky, United States | Website: ohrestorationservices.com | Revenue: $6 Million | Industry: Construction | Employees: 30 Employees | Properties: 301 GB (33,041 Files, 4,133 Folders) |
||||||
| Ransomware | Middendorf Animal Hospital & Laser Centre id30929 View details | United States | — | pending | ||
|
Country: Kentucky, United States | Website: middendorfanimalhospital.com | Revenue: <$5 Million | Industry: Healthcare Services,Veterinary Services | Employees: 11-50 | Properties: 28.1 GB (34,237 Files, 8,806 Folders) |
||||||
| Ransomware | Chappell Supply & Equipment id30884 View details | United States | Construction / Real Estate | pending | ||
|
Country: Oklahoma, United States | Website: chappellsupply.com | Revenue: $9.2 Million | Industry: Consumer Services,Retail,Manufacturing,Repair Services | Employees: 11-50 | Properties: 160 GB (268,758 Files, 30,522 Folders) |
||||||
| Ransomware | La Sevillanita id30885 View details | Argentina | Hospitality / Food & Beverage / Tourism | leaked | ||
|
Country: Argentina | Website: lasevillanita.com | Revenue: $15 million | Industry: Freight & Logistics Services,Transportation | Employees: 11-50 | Properties: 200 GB (385,318 Files, 13,074 Folders) |
||||||
| Ransomware | One Plus Capital id30886 View details | Cyprus | Finance / Legal / Insurance | pending | ||
|
Country: Cyprus | Website: onepluscapital.net | Revenue: $7 Million | Industry: Finance | Employees: 11-50 | Properties: 117 GB (285,919 Files, 32,404 Folders) |
||||||
| Ransomware | Acens | Cloud & Backup id30887 View details | Spain | IT | pending | ||
|
Country: Spain | Website: acens.com | Revenue: $46.3 Million | Industry: Hosting | Employees: 201-500 |
||||||
| Ransomware | West Nova Fuels & Superline Fuels id30888 View details | Canada | Transportation / Travel / Logistics | leaked | ||
|
Country: Canada | Website: westnovasuperline.ca | Revenue: $18.9 Million | Industry: Convenience Stores, Gas Stations & Liquor Stores | Employees: 51-200 | Properties: 45.8 GB (114,200 Files, 2,672 Folders) |
||||||
| Ransomware | Sinop Energia id30889 View details | Brazil | Energy | pending | ||
|
Country: Brazil | Website: sinopenergia.com.br | Revenue: $12.2 Million | Industry: Electricity, Oil & Gas | Employees: 51-200 | Properties:300 GB (43,113 Files, 5,372 Folders) |
||||||
| Ransomware | Al Hayat | Pepsi id30890 View details | Iraq | Retail / E-commerce | leaked | ||
|
Country: Iraq | Website: alhayatco.com | Revenue: $100 Million | Industry: Food & Beverage | Employees: 501-1,000 | Properties: 138 GB (205,992 Files, 17,178 Folders) |
||||||
| Ransomware | SPDM id30891 View details | Brazil | NGOs / Associations | leaked | ||
|
Country: Brazil |Website: spdm.org.br |Revenue: $197 Million |Industry: Hospitals & Clinics |Employees: 10.000 - 20.000 |Properties: 847 GB (871,912 Files, 76,047 Folders) |
||||||
| Ransomware | Nourison | Home id30892 View details | United States | Manufacturing / Engineering | pending | ||
|
Country: New Jersey 07663, US | Website: nourison.com | Revenue: $59.4 Million | Industry: Wholesale, Furniture, Home Decor, Retail, Real Estate | Employees: 100-300 | Properties: 799 GB (93,941 Files, 13,733 Folders) |
||||||
| Ransomware | Cold Front Distribution id30893 View details | United States | Retail / E-commerce | pending | ||
|
Country: Colorado, United States | Website: coldfrontdist.com | Revenue: $120.1 Million | Industry: Transportation | Employees: 201-500 Employees | Properties: 473 GB (890,775 Files, 51,621 Folders) |
||||||
| Ransomware | Portman Finance Group id30894 View details | United Kingdom | Finance / Legal / Insurance | leaked | ||
|
Country: United Kingdom | Website: portmanfinancegroup.co.uk | Revenue: £300 Million | Industry: Finance | Employees: 1000-5000 Employees | Properties: 209 GB (255,244 Files, 34,852 Folders) |
||||||
| Ransomware | OFS id30895 View details | United States | Manufacturing / Engineering | pending | ||
|
Country: Indiana, United States | Website: ofs.com | Revenue: $517.1 Million | Industry: Furniture,Manufacturing,Transportation | Employees: 1K - 5K | Properties: 321 GB (322,742 Files, 18,081 Folders) |
||||||
| Ransomware | Uniview Technologies id30896 View details | China | Manufacturing / Engineering | leaked | ||
|
Country: China | Website: uniview.com | Revenue: $610 Million | Industry: Manufacturing, Electronics | Employees: 1000-5000 Employees | Properties: 1.5 TB (2,172,194 Files, 114,352 Folders) |
||||||
| Ransomware | Novum Energy id30897 View details | United States | Energy | pending | ||
|
Country: Texas, United States | Website: novumenergy.com | Revenue: $966 Million | Industry: Convenience Stores, Gas Stations & Liquor Stores | Employees: 51-200 | Properties: 842 GB (971,325 Files, 117,085 Folders) |
||||||