Intruvent Technologies
Contact us
Moderate Data-Theft Extortion Active (declining) TLP:CLEAR

Global Secret Group

Launched July 2026 claiming over 202,000 victims. Independent monitoring shows 46 listings, most posted on launch day, with volume falling every month since.

26 JUL 2026
FIRST LEAK-SITE POST
46
LISTINGS (INTRUVENT COLLECTION)
202K
SELF-CLAIMED, UNVERIFIED
~17.5 TB
CLAIMED DATA (39 POSTS)
01· EXECUTIVE ASSESSMENT

An inflated launch claim, a real leak site, and a fading posting rate

THREAT: MODERATE  ·  ATTRIBUTION CONFIDENCE: LOW  ·  UNCLUSTERED / NOT IN INTRUVENT CODEX / NO GOVERNMENT ATTRIBUTION
WHAT

Global Secret Group (GSG) is a financially motivated extortion group that opened a Tor leak site on 26 July 2026. [1][4] At launch, the site reportedly claimed approximately 202,000 victims; that figure is unverified and no tracker has observed anything close to it. [5][6] Intruvent collection recorded 46 GSG listings between 26 July and 10 September 2026, and RansomLook recorded two further posts on 21 September. [1][4] Ransomware.live lists 48 GSG victims from 26 July through 21 September 2026. [11] WatchGuard classifies GSG as a "Data Broker" using direct extortion, double extortion, and free data leaks, and lists Tor, email, and Tox as its communication channels. [2] No public source has documented a GSG encryptor, ransom note, or malware sample as of 24 September 2026.

SO WHAT

The claimed victim count is about 4,000 times the observed count. Assessment (high confidence): the 202,000 figure is a publicity claim, and defenders should size the group by its observed listings. Posting volume has fallen each month: 31 listings in July (29 of them on launch day), 12 in August, and 5 in September through 21 September. [1][4] The listings that do exist carry large claimed data volumes, a median of 213 GB and about 17.5 TB in total across 39 postings that state a size. [1] Victims are mostly small and mid-size US organizations across manufacturing, retail, finance, energy, and healthcare-adjacent services. [1] Six launch-day entries carry no post page and no data claim, and trade press reported that the group published no samples to support at least one of its large launch-week claims. [1][7]

NOW WHAT

Treat GSG as a data-theft extortion threat. Detection priority belongs on large outbound transfers and archive staging, which precede data-theft claims, and on the negotiation contacts in Section 06 for incident correlation. Organizations named on the leak site should assume the claimed data may be published and verify the claim through their own logs before engaging. None of GSG's published infrastructure is suitable for network blocking (see Section 06).

The MODERATE rating reflects confirmed leak-site operations and large per-victim data claims, balanced against falling volume, no documented tooling, and an inflated launch claim. An upgrade is warranted if posting volume recovers, if a GSG encryptor is documented, or if a claimed breach is confirmed by a victim at the scale the group asserts. Bracketed markers, e.g. [1], point to the numbered sources in Section 08. All victim names in this report are leak-site claims, not confirmed breaches.

02· ATTRIBUTION & IDENTITY

Unattributed; sources disagree on when the group first appeared

ATTRIBUTION
None. No nation-state attribution and no vendor clustering. GSG is absent from the Intruvent Codex (no actor record; alias resolution for "GSG" and "Global Secret Group" returns no match). [10] Mallory.ai reports that aliases, country of origin, and affiliations are not established. [3] · LOW CONFIDENCE
FIRST OBSERVED
Sources disagree. WatchGuard lists "First Seen: January 2026" and dates its 31 tracked victims from 17 January to 26 July 2026. [2] Intruvent collection and other public trackers show the first leak-site post on 26 July 2026, and Mallory.ai describes the group as active in 2026 with substantial listing activity in July 2026. [1][3][4] Assessment (moderate confidence): WatchGuard's January date reflects extortion or attack dates attached to listings that were first published together on 26 July, which would place some intrusions months before the leak site opened. No public leak-site activity before 26 July 2026 has been documented.
MOTIVATION
Financial. Extortion through threatened publication of stolen data; DeXpose summaries of GSG posts describe threats to release data unless the victim opens negotiations. [8][9]
OPERATING MODEL
WatchGuard: "Data Broker," with direct extortion, double extortion, and free data leaks. [2] The Cyber Edition describes a double-extortion model and notes the group may skip encryption entirely. [5] Mallory.ai lists T1486 (Data Encrypted for Impact) among aggregated technique tags but states that available reporting does not establish encryption activity. [3] Assessment (low confidence): GSG operates primarily as a data-theft extortion group; encryption is not publicly documented as of 24 September 2026.
SOPHISTICATION
Not publicly documented as of 24 September 2026. No malware family, initial-access method, or affiliate structure has been reported. [3][5] The group markets itself with the slogan "We find what others can't find or see." [5]
ALIASES
GSG [2]
CONTACT
gsgsupport@onionmail.org (email) [2]
Tox: 550D0D7CC7E61DF9BFD9041BF06F74225D07BE5F8BD083F2A2D35F3F26A64A6C5ABC6464F965 [2]
RANSOM NOTE
Not publicly documented as of 24 September 2026.
INFRASTRUCTURE
Tor leak site plus five mirrors; RansomLook reported all six addresses up on 24 September, with 23% to 43% 30-day uptime [4]:
PRIMARY [1][2][4]: o5lsqyar7ox25z734k6zaxt2vf7bsyi4q5rturi5iyxzqo3ica7bjsad.onion
MIRRORS [4]: ee2iit5piqlarwz3kxm6ctkpbpt2olsxadq7lclqwnhlzaafamfbpiid.onion
dcjy5n3qqnk4lbpwoxh7xgki6lym23jdjsjlkhcw63gbh4jl7r4bukqd.onion
b5gozwifyvy5bhys3bsiq5tedhpot345udggjyb54fsjd2m7nteftkad.onion
hnkclceyxgwa2g5fxvvu37bvpejqhpup5vlybxfx45h6xloyjnvxuuyd.onion
3u2h3ingiz45yyiplgbuflp6jex4xd2wtubvgjdg44nlgllrjv6qxxid.onion
03· TARGETING PROFILE

Opportunistic, mid-market, and concentrated on the United States

Sectors (listing tag, 46)
  • Technology (9, of which 6 are placeholder-style entries) [1]
  • Retail & e-commerce (7) [1]
  • Manufacturing (6) [1]
  • Financial services / insurance (6) [1]
  • Other (5) [1]
  • Professional services (4) [1]
  • Energy & utilities (3) [1]
  • Healthcare (3) [1]
  • Hospitality, Transportation, Government & Defense (1 each) [1]
Countries (15)
  • United States (27 of 46) [1]
  • India (4) [1]
  • Brazil (2) [1]
  • Canada (2) [1]
  • One each: Argentina, China, Cyprus, Finland, Germany, Greece, Iraq, South Korea, Spain, UAE, United Kingdom [1]
  • Both 21 September posts are US [4]
Victim Profile
  • Mostly small and mid-size firms: 31 of 40 listings that state revenue cite under $60 million [1]
  • Fuel distribution and energy: three listings (one each US, Brazil, Canada) [1]
  • Healthcare and care services (hospital, treatment, mental health, veterinary, and dental care): five listings (four US, one Brazil) [1]
  • Legal and accounting: two US firms [1]
  • One US nonprofit [1]

The mix of sectors, countries, and firm sizes is consistent with opportunistic access rather than deliberate vertical targeting (assessment, moderate confidence). The US share (27 of 46, 59%) tracks the wider ransomware ecosystem. Sector tags on the collected listings carry errors: one building-materials manufacturer is tagged Government & Defense, one freight and logistics firm is tagged Hospitality, and one university listing is tagged Healthcare. [1] Counts above use the tags as recorded.

04· TRADECRAFT & TTPs

Exfiltration and public-shaming extortion; tooling undocumented

No incident response report, malware analysis, or forensic writeup of a GSG intrusion has been published as of 24 September 2026. The mappings below are the minimum set: two exfiltration techniques come from an aggregator's technique tags, one extortion technique is inferred from the leak-site model, and the encryption technique is listed but unconfirmed.

MITRE IDTECHNIQUEOBSERVED USE
COLLECTION & EXFILTRATION
T1041Exfiltration Over C2 ChannelListed in Mallory.ai's aggregated technique tags for GSG. [3] Source reporting behind the tag is not identified. Every standard GSG listing advertises file, folder, and volume counts for the stolen data. [1]
T1567Exfiltration Over Web ServiceListed in Mallory.ai's aggregated technique tags (three reports). [3] No named service or tool has been published.
IMPACT
T1657Financial Theft (INFERRED)Inferred from the extortion model: listings threaten publication unless the victim negotiates. [8][9] WatchGuard lists free data leaks among GSG's extortion types. [2]
T1486Data Encrypted for Impact (UNCONFIRMED)Tagged by Mallory.ai in 24 aggregated reports, while the same profile states that encryption activity is not established. [3] DeXpose post summaries describe data theft only. [8][9] Treat as unconfirmed.
TRADECRAFT NOTE

Initial access, credential access, lateral movement, and defense evasion are not publicly documented for GSG as of 24 September 2026. [3][5] Leak-site structure offers the only operational signals. Post pages used sequential numeric IDs (/project/1/ to /project/42/) through 17 August, then switched to random 16-character slugs from 25 August. [1] Nine numeric IDs between 1 and 42 never appeared in collection, and at least one listing released in an August wave carries a low ID from the launch-day range, so IDs were assigned before publication. [1] Assessment (moderate confidence): the group prepared its victim pages in advance and released them in batches, consistent with the WatchGuard extortion dates that begin in January 2026. [2]

05· NOTABLE ACTIVITY

From 202,000 claimed to 48 observed: the leak-site record in aggregate

DATEEVENT
26 JUL 2026

Leak site launches with a mass posting

Intruvent collection records 29 listings on launch day, including six placeholder-style entries. [1] The Cyber Edition reported the portal "allegedly lists approximately 202,020 victims," showed roughly 20 disclosed victims, and marked several entries "coming soon." [5][6]

27 JUL 2026

Large claims, no proof

Trade press reported that GSG claimed breaches of about 30 organizations, including a multi-terabyte theft from one large company. The group published no sample files, and the named company said it was investigating. [7]

AUG 2026

Posting slows to 12 listings

Postings in small batches on seven dates, with the leak site switching to random post slugs from 25 August. [1]

SEP 2026

Five listings through 21 September

Three listings from 1 to 10 September in Intruvent collection, then two US listings on 21 September reported by RansomLook. [1][4]

MICRO-SECTOR (ANALYST GROUPING)COUNTCOUNTRY BREAKDOWN
STANDARD LEAK-SITE POSTS · 42 (40 IN INTRUVENT COLLECTION TO 10 SEP, 2 ON 21 SEP PER RANSOMLOOK)
Manufacturing, industrial supply, and engineering services10United States 7, India 2, China 1
Financial services, banking, and insurance5United States 2, United Kingdom 1, Cyprus 1, India 1
Healthcare and care services5United States 4, Brazil 1
Retail, wholesale, and consumer goods5United States 4, Iraq 1
Professional and business services (incl. legal, accounting, advertising)4United States 3, Canada 1
Energy and fuel distribution3United States 1, Brazil 1, Canada 1
Construction and remodeling3United States 3
Real estate and asset management2United States 1, Greece 1
Transportation and logistics2United States 1, Argentina 1
Technology, hosting, and media2United States 1, Spain 1
Nonprofit1United States 1
PLACEHOLDER-STYLE ENTRIES (26 JUL) · 6 RECORDS, NO POST PAGE, NO DATA CLAIM
Technology (listing tag)6Six entries across six countries
POSTING WAVES
Launch batch, 26 to 27 July3129 on 26 July (incl. 6 placeholder-style), 2 on 27 July
August waves (seven posting dates)12Largest waves: three postings each on 10 and 25 August
September, through 21 September5Three from 1 to 10 September; two on 21 September [4]

The roll-up above aggregates leak-site claims in Intruvent collection through 21 September, 00:35 UTC [1], plus two later 21 September posts reported by RansomLook [4]. Data volumes are the group's own claims and are unverified. Intruvent collection and RansomLook post dates differ by up to 11 days for a few entries; Intruvent collection dates are used for wave counts. Individual victim names are withheld under Intruvent public-reporting policy. The 39 listings in Intruvent collection that state a size total about 17,495 GB (17.5 TB), with a median of 213 GB; the largest single claim (5.4 TB) accounts for 31% of that total, and the remaining 38 total about 12.1 TB. Adding the two 21 September posts brings the claimed total to about 18.3 TB. July listings account for 13.6 TB of that total, August 3.6 TB, and September through 10 September 0.3 TB. No duplicate victim domains were found. The six placeholder-style entries carry one-line descriptions resembling security assessment summaries, no post page, and no data claim; WatchGuard lists six "Unknown" victims on the same date, and RansomLook omits them. [1][2][4] Assessment (moderate confidence): these entries are unsubstantiated claims or teasers and should not be counted as confirmed victims.

06· DETECTION & HUNT PRIORITIES

No blockable indicators; hunt for the exfiltration that precedes the post

IOC POSTURE

No malware hashes, IP addresses, clearnet domains, or ransom-note artifacts have been published for GSG as of 24 September 2026. The indicators below are contact and leak-site identifiers. They support monitoring, attribution of a ransom demand, and incident correlation. None is a network blocking indicator. Codex false-positive checks returned no match for the primary onion, the email address, or onionmail.org. [10]

INDICATORTYPETIERSOURCE / CONFIDENCE
o5lsqyar7ox25z734k6zaxt2vf7bsyi4q5rturi5iyxzqo3ica7bjsad.onionOnion (leak site)INVESTIGATE[1][2][4] · High
5 mirror .onion addresses (Section 02)Onion (mirrors)INVESTIGATE[4] · Medium (single source)
550D0D7CC7E61DF9BFD9041BF06F74225D07BE5F8BD083F2A2D35F3F26A64A6C5ABC6464F965Tox IDINVESTIGATE[2] · Medium (single source)
gsgsupport@onionmail.orgEmail (negotiation)ALERT / MONITOR[2] · Medium (single source)
BLOCKING GUIDANCE

Block (High Confidence): none. No GSG indicator meets the criteria.
Alert/Monitor (Shared Infrastructure): gsgsupport@onionmail.org. Alert on the exact address in mail and messaging logs. onionmail.org is a shared anonymous email provider with legitimate users; do not block the domain.
Investigate (Unconfirmed): all six .onion addresses and the Tox ID. Onion services are not reachable on the clearnet, so perimeter blocks add little; use these to confirm that a ransom demand or leak-site listing is GSG's and to monitor for new postings. Five mirrors rest on a single source. [4]

DETECTION ONLY · UNTESTED

Every detection item below is behavioral guidance for alerting and analyst triage. None has been tested against GSG activity, because no GSG intrusion telemetry is public. The logic reflects the data-theft extortion model documented in Sections 02 and 04, not GSG-specific signatures.

BEHAVIORDETECTION LOGIC (DETECTION ONLY)PRIORITY
Bulk outbound data transferAlert on outbound volume from file servers or single hosts that exceeds baseline, especially to cloud storage, file-sharing services, or Tor. GSG listings claim a median of 213 GB per victim, a volume that should stand out in egress telemetry. [1]CRITICAL
Archive staging on file serversAlert on creation of large zip, 7z, or rar archives in shared or temporary paths, or archiving utilities run against broad directory trees. Listings enumerate stolen files and folders by the hundred thousand. [1]HIGH
Negotiation contact in mail or chat logsSearch mail gateway and messaging logs for the exact address gsgsupport@onionmail.org and for the Tox ID string in received content. A hit indicates an extortion approach or ransom demand and should open an incident. [2]HIGH
Tor use from serversAlert on Tor client processes or connections to known Tor relays from servers and non-user endpoints. Expect legitimate hits from research or privacy tooling; triage before action.MEDIUM
Leak-site listing of your organization or suppliersSubscribe to leak-site monitoring for your domains and key suppliers. A listing is a claim; validate it against egress logs and access records before responding. [4]MEDIUM
07· DEFENSIVE ACTIONS

Seven actions for data-theft extortion defense

ACTIONOWNEREFFORT
DO NOW
▢Add the GSG email address and Tox ID to mail and messaging alert lists (alert only); record the onion addresses in threat-intel tooling for correlationSOC / TILOW
▢Confirm egress alerting exists for bulk outbound transfers from file servers and backup hostsSOC / NETWORKMED
▢Check leak-site monitoring for whether your organization or a key supplier is listed by GSG; if so, open a validation investigation before any contact with the groupTI / VENDOR RISKLOW
THIS QUARTER
▢Enforce MFA on all remote access and administrative consoles; the group's access method is undocumented, so cover common entry pointsIAM / ITLOW
▢Restrict and log bulk read access to file shares and document stores; alert on archive creation across broad directory treesIT / SOCMED
ONGOING
▢Monitor GSG's leak site and mirrors (through a leak-site monitoring service, not direct browsing) for new postings in your sector or supply chainTILOW
▢Pre-agree an extortion response playbook: claim validation, legal and regulatory notification triggers, and communications, since data-theft claims arrive without encryption to signal an intrusionIR / LEGALMED
08· SOURCES

Bracketed markers in the body point to the numbered sources below. Web sources accessed 24 SEP 2026 unless noted. Unavailable at access: SOCRadar group profile (HTTP 403) and GalaxyWarden group tracker page (HTTP 410); neither was used for any figure in this report.

  1. Intruvent Technologies (Styx). Global Secret Group group record and 46 victim records. Intruvent collection, pulled 24 September 2026; newest record 21 September 2026, 00:35 UTC.
  2. WatchGuard Technologies. Ransomware Tracker: Global Secret Group. Accessed 24 September 2026. watchguard.com/wgrd-security-hub/ransomware-tracker/global-secret-group. Email address decoded from the page's obfuscated source.
  3. Mallory.ai. Global Secret Group actor profile. Accessed 24 September 2026. mallory.ai/actors/019f9faf-4972-7417-8cf8-eda4260aa1bd.
  4. RansomLook. Global Secret Group group page. Accessed 24 September 2026. ransomlook.io/group/global%20secret%20group.
  5. The Cyber Edition. Global Secret Group ransomware claims over 202,000 victims on new leak site. 27 July 2026. thecyberedition.com (Global Secret Group).
  6. Cyber Edition (@CyberEdition). Post on Global Secret Group's 202,000-victim claim. X (formerly Twitter), 27 July 2026. x.com/CyberEdition/status/2081726305649996172. Post text reviewed through search index; direct fetch unavailable.
  7. The Elec (Kim Seonghun). Report on a Global Secret Group launch-week data-theft claim and its authenticity. 28 July 2026. URL withheld (names victim); held in Intruvent research files.
  8. DeXpose. Leak-site claim summary for an August 2026 Global Secret Group victim. 10 August 2026. URL withheld (names victim); held in Intruvent research files.
  9. DeXpose. Leak-site claim summary for a second August 2026 Global Secret Group victim. 26 August 2026. URL withheld (names victim); held in Intruvent research files.
  10. Intruvent Technologies. Golden CTI Database (Codex) queries: actor search, alias resolution, and false-positive checks for Global Secret Group. Internal, 24 September 2026.
  11. Ransomware.live. Global Secret Group group page. Accessed 24 September 2026. ransomware.live/group/Global%20Secret%20Group.
VERSION HISTORY

v1.0.1 (24 SEP 2026): Victim names removed; victim listings replaced with sector aggregates per Intruvent public-reporting policy. [CORRECTED] Cover summary now states 46 listings through 10 September in Intruvent collection, plus two further postings on 21 September reported by RansomLook. Emoji safety markers replaced with plain-text labels. v1.0 (24 SEP 2026): Initial release.

Download the Global Secret Group Threat Profile

INT-TAP-2026-GLOBALSECRETGROUP v1.0, TLP:CLEAR

Download PDF (free)