// THREAT ACTOR
GLOBAL_
DormantGLOBAL is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of GLOBAL — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.
Victims by year
- 2025 33
Leak site mirrors
4 mirrors tracked, 0 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.
-
vg6xwkmfyirv3l6qtqus7jykcuvgx6imegb73hqny2avxccnmqt5m2id.onionGLOBAL | Blog snapshot · 2025-12-06 06:10 -
panelqbinglxczi2gqkwderfvgq6bcv5cbjwxrksjtvr5xv7ozh5wqad.onionsnapshot · 2025-12-07 03:08 -
gdbkvfe6g3whrzkdlbytksygk45zwgmnzh5i2xmqyo3mrpipysjagqyd.onionGLOBAL | Client Portal snapshot · 2025-11-06 05:13 -
7bmz2tc4p2jk23dcyehg37cd7veflk3fyhxrnbxz75vvno2azfy6qayd.onionGLOBAL | FileShare snapshot · 2025-09-17 13:08
Recent victims
The 50 most recent victims claimed by GLOBAL. Total in the index: 33.
| Date listed | Victim | Description |
|---|---|---|
| 2025-08-20 | awmedicalvillage.org | |
| 2025-08-20 | hmsaojose.com | |
| 2025-07-30 | RUKU Tore - Türen | |
| 2025-07-28 | Albavision.tv | |
| 2025-07-28 | Albavision | |
| 2025-07-26 | CONTRAQI | |
| 2025-07-26 | Cyme Servicios Médicos | |
| 2025-07-26 | Dithelm Travel Group | |
| 2025-07-26 | Geomaticks Grecia | |
| 2025-07-26 | Medical Village LIV | |
| 2025-07-26 | MukundRhotindian | |
| 2025-07-26 | Rete Toscana Classica | |
| 2025-07-26 | RTE | |
| 2025-07-25 | lafavoritaservice.it | |
| 2025-07-25 | moelco.es | |
| 2025-07-14 | loraincountyauditor.gov | |
| 2025-07-09 | Emphail.com | |
| 2025-06-30 | entab.se | |
| 2025-06-11 | Rosewood Farm | |
| 2025-06-11 | Morpeth Pharmacy | |
| 2025-06-11 | Letry | |
| 2025-06-11 | Skyline Dubuque | |
| 2025-06-11 | Fenol Kimya | |
| 2025-06-11 | Capitol Taxes | |
| 2025-06-07 | https://www.personalservice.com.br/ | |
| 2025-06-07 | Deakin Medical | |
| 2025-06-07 | ad-engineering.co.uk | |
| 2025-06-07 | Ascot Vale Health Group | |
| 2025-06-06 | TC Wilson | |
| 2025-06-05 | LS Proline | |
| 2025-06-04 | all-nations-health-center | |
| 2025-06-04 | Epworth-Hospital | |
| 2025-06-04 | www.motorworldarc.co.uk |
// CONFIRMED ATTACKS
Global confirmed attacks: 2 verified incidents
Ransomnews has verified 2 Global incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from May 2025 to June 2025. Australia accounts for 1 of them (50%), with victims recorded in 2 countries in total. The most affected sector is healthcare, at 1 confirmed victim. Where a figure was disclosed (1 case), these incidents account for 18,491 exposed records.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Global incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| June 2025 | Ascot Vale Health Group | Healthcare | Melbourne, Australia | — | Unknown | Source |
| May 2025 | Lorain County Auditor's Office | Government | Ohio, United States | 18,491 | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Global's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design — most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.