Operator dossier

GLOBAL CYBERNETIC COLLECTIVE is a ransomware operator currently active on public leak sites. Darkfield has indexed 5 public victims claimed by this operator.

Recent disclosures by GLOBAL CYBERNETIC COLLECTIVE

All 5 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for GLOBAL CYBERNETIC COLLECTIVE →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status changes from active to dormant when no new disclosure appears for 60 days. Without a disclosure date, activity is unknown. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

GLOBAL CYBERNETIC COLLECTIVE

5 victims indexed · last activity 1 hour ago

Victims indexed

#285 of 406 tracked operators

—

Active period

—

Countries hit

At a glance

Status: active
First seen: —
Last activity: 1 hour ago
Onion sites: 1 known endpoint

Recent victims

Loading recent victims

Onion infrastructure

1 known

http://globalrbweyhxxa5b65bjjsm5bfuqfs5ydizefupqcminoedzn6o2sqd.onion

Source

Updated 1 hour ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time GLOBAL CYBERNETIC COLLECTIVE posts a victim.

Add GLOBAL CYBERNETIC COLLECTIVE to your watchlist — Pro pings you within 5 minutes of any new GLOBAL CYBERNETIC COLLECTIVE leak-site post, Telegram callout, or affiliate-rebrand inference.