Disclosure context

About Redalert

Redalert is a relatively obscure ransomware group that emerged in July 2022 with primarily financial motivations, operating on a smaller scale compared to major ransomware families. The group's origin and potential affiliations remain largely undocumented in public threat intelligence reporting, with limited information available from major security organizations regarding their operational structure or whether they operate as a Ransomware-as-a-Service model. Based on available data, Redalert has demonstrated a geographic focus on Western European targets, particularly concentrating their operations against entities in the United Kingdom and France, though their specific attack methodologies, initial access vectors, and technical capabilities have not been extensively documented in public security research. With only six known victims since their emergence, the group represents a minor player in the ransomware ecosystem, and their limited operational footprint suggests they may lack the sophistication and resources of more prominent ransomware operations. Current intelligence indicates minimal ongoing activity from this group, though definitive information about their operational status, potential disruption, or dissolution is not available in public reporting from major cybersecurity organizations. The group has been linked to 6 public disclosures across our corpus. First observed on a leak site on July 14, 2022; most recent post September 22, 2022. The operation is currently inactive.

Also tracked as: Red Alert.

Timeline of this disclosure

September 13, 2022groupg4.com listed by Redalerton the group's public leak site

Sector and geography

This disclosure adds to ransomware activity in the Business Services sector, which has 2,640 disclosures indexed across all operators we track.

How we know this. Darkfield monitors public ransomware leak sites continuously, archiving every new disclosure and the data later released against the victim. Each entry on this page is sourced from the operator's own publication and cross-checked against complementary OSINT feeds (RansomLook, ransomware.live, RansomWatch). We do not collect or host stolen data — only the metadata, timestamps and screenshots needed to make the public disclosure searchable and accountable. Records here are corrected when the original post is edited, retracted, or merged with another disclosure.

Ransomware victim disclosure

← All victims

G4 Group Arquitectura, Ingeniería y Diseño

listed as groupg4.com · Claimed by Redalert · listed 4 years ago

44m

Age

since listed · data leaked

Status timeline

Listed
Sep 13, 2022
Data leaked

At a glance

Group: Redalert
Status: Data leaked
Sector: Business Services
Listed on leak site: Sep 13, 2022

About the victim

AI dossier — public-source company profile

G4 Group is a multidisciplinary architecture, engineering and design studio headquartered in Barcelona, Spain, with additional offices in Madrid, Turin, Paris, and Dubai. Founded in 2001, the firm offers services spanning architecture, technical architecture, project management, BIM services, lighting design, and 3D visualisation. The studio has over 25 years of international project experience, with notable clients including Louis Vuitton and projects in locations such as Dubai and Vienna.

Industry: Architecture, Engineering & Design
Address: Barcelona, Spain (also offices in Madrid, Turin, Paris, and Dubai)
Founded: 2001

Attack summary

Severity: medium — Data is marked as published, suggesting confirmed exfiltration; however, no details on data type, volume, or sensitivity were captured, and the victim is a mid-sized professional services firm rather than critical infrastructure or a handler of regulated personal data at scale.

Redalert claims to have attacked groupg4.com and the disclosure status is marked as data_published, indicating data has been released; however, no leak post details, ransom demand, or specific data volume were captured to confirm the nature or scope of the exfiltration.

medium

Sources

Victim sitegroupg4.com

Source

Indexed 4 years ago

This page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.