global3 is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 1 public victims claimed by this operator between September 9, 2017. Global3 is an obscure ransomware group that first emerged in September 2017, appearing to be financially motivated based on their operational profile. Limited public documentation suggests the group operates independently with no confirmed affiliations to major ransomware families or state-sponsored actors, and there is insufficient evidence to determine their country of origin or whether they function as a Ransomware-as-a-Service operation. Technical details regarding their attack methodology, including initial access vectors, encryption techniques, and data exfiltration capabilities, remain undocumented in public threat intelligence reports from major security firms. The group's operational scope appears extremely limited, with only one documented victim identified in publicly available sources, specifically targeting a government facility within the United States, suggesting either a highly selective targeting approach or minimal operational capability. Current intelligence indicates Global3 has maintained an exceptionally low profile since their initial observation, with no significant law enforcement actions or high-profile campaigns documented, making their current operational status unclear.

Recent disclosures by global3

All 1 indexed disclosures. Click any row for the full per-victim dossier.

• Town of St JohnsburyGovernment Facilities · United States · September 9, 2017

See every disclosure indexed for global3 →