Loading threat actor…
Global Secret Group (GSG) is a ransomware and data-theft threat actor publicly active by July 2026. Its claimed victims are predominantly in the United States, with additional reported targets in India, Spain, and Israel. Its victim listings span manufacturing, construction, telecommunications, broadcasting, cloud hosting, automotive retail, financial services, pharmaceuticals, legal services, and education. The group was associated with 31 ransomware victim listings in July 2026. GSG operates a data-leak site containing victim profiles, sample documents, and downloadable datasets. Its listings frequently advertise data volumes and file counts. In October 2026, it claimed responsibility for an incident affecting Seminole Schools and marked a purported 39.6 GB dataset as released. Published sample documents linked the material to Georgia's Seminole County School System, although the listing conflated identifiers from school districts in three states. The district confirmed a technology disruption but did not publicly confirm the attacker's identity, data theft, or encryption. The group's initial-access methods, malware, encryption implementation, and organizational structure are not established. Victim listings and associated data-volume claims should not be treated as independent confirmation of encryption or successful compromise. Its geographic origin and any state affiliation are unknown.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
3 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.