GLOBAL SECRET GROUP Ransomware: 3 US Victims in 4 Days — Manufacturing, Retail & Healthcare Targeting Analysis with Detection Rules

Classification: TLP:CLEAR | Briefing Date: 2026-08-18 | Source: ransomware.live dark web leak site monitoring | Analyst: Security Arsenal — From The Dark Side

Executive Summary

Monitoring of the GLOBAL SECRET GROUP (GSG) dark web leak site confirms 3 new victim postings between 2026-08-14 and 2026-08-17, all US-based organizations spanning manufacturing, retail/e-commerce, and healthcare. While the volume is modest, the 4-day posting cadence and cross-sector opportunism are consistent with an intrusion-set model that monetizes whatever perimeter access its affiliates or initial access brokers (IABs) can acquire — rather than a vertically focused campaign. Organizations running Check Point Security Gateways, ConnectWise ScreenConnect, or externally exposed RDP should treat this briefing as an immediate patch-and-hunt trigger.

1. Threat Actor Profile — GLOBAL SECRET GROUP

2. Current Campaign Analysis

Victimology (last 100 postings — 3 victims observed)

Key Observations

• Geographic concentration: 100% United States in this window. This is consistent with most mid-tier RaaS programs whose affiliates prioritize US victims for payment capacity and cyber-insurance coverage.
• Sector spread with no single vertical: Manufacturing, retail, and healthcare in a single week indicates opportunistic access monetization, not sector-specific targeting. This pattern strongly implies purchased or commodity initial access (IAB-sourced) rather than bespoke intrusion campaigns.
• Victim profile: Small-to-mid-market organizations (estimated revenue range ~$5M–$150M). GSG appears to deliberately avoid large-enterprise targets that attract law-enforcement attention, a common survivability strategy for smaller leak operations.
• Posting cadence: 2 victims posted on the same day (2026-08-17) suggests either batched negotiation failures or a deliberate pressure tactic to flood the leak site and signal momentum. Watch for a second wave within 7–10 days.

Initial Access Vector Correlation — CISA KEV

The following actively exploited CVEs align with GSG's observed access profile and should be treated as candidate intrusion paths for these victims:

• CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1). Perimeter VPN appliance compromise is the single most probable entry point for opportunistic US-SMB victimology. Patch immediately; assume compromise if unpatched since 2026-06-08.
• CVE-2024-1708 — ConnectWise ScreenConnect path traversal → RCE. RMM abuse is a hallmark of mid-tier affiliates: it provides both initial access and a living-off-the-land persistence/lateral-movement channel.
• CVE-2026-48027 — Nx Console embedded malicious code. Supply-chain/developer-workstation entry; relevant to victims with in-house dev teams.
• CVE-2025-60710 — Windows link-following privilege escalation and CVE-2023-21529 — Exchange deserialization (authenticated RCE) map to post-access privilege escalation and mailbox/data staging rather than initial entry, but both appear in confirmed ransomware chains.

3. Detection Engineering

3.1 Sigma Rules

Three rules targeting GSG's probable kill chain: (1) RMM/RDP-style suspicious external remote access, (2) data staging via archive utilities, (3) pre-encryption shadow copy deletion — the classic pre-detonation signal.

---
title: Suspicious RMM Tool Execution - ScreenConnect and Cloned RMM Binaries
id: 8f2a1c4e-gsg-0001-4b7a-9d1e-rmm2026a01
status: experimental
description: Detects execution of ConnectWise ScreenConnect or commonly abused RMM tooling (frequently leveraged by mid-tier ransomware affiliates such as Global Secret Group for initial access and lateral movement) from non-standard paths or unsigned binaries.
author: Security Arsenal Threat Intelligence
date: 2026/08/18
references:
  - https://securityarsenal.com/darkside
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  category: process_creation
  product: windows
 detection_placeholder: none
detection:
  selection_img:
    Image|endswith:
      - '\ScreenConnect.ClientService.exe'
      - '\ScreenConnect.WindowsClient.exe'
      - '\anydesk.exe'
      - '\teamviewer.exe'
      - '\splashtop.exe'
      - '\atera_agent.exe'
      - '\level.exe'
  selection_path:
    Image|contains:
      - '\AppData\Local\Temp\'
      - '\ProgramData\'
      - '\Users\Public\'
      - '\Windows\Temp\'
  condition: selection_img and selection_path
falsepositives:
  - Legitimate RMM deployments running from vendor-standard directories (tune path exclusions to your sanctioned RMM install path)
level: high
tags:
  - attack.initial_access
  - attack.t1133
  - attack.command_and_control
  - attack.t1219
---
title: Data Staging - Archive Utility Execution with High-Value Extensions Before Exfiltration
id: 8f2a1c4e-gsg-0002-4b7a-9d1e-stg2026a02
status: experimental
description: Detects command-line archive creation (7z, rar, winrar) targeting document/database extensions - a hallmark of ransomware double-extortion data staging observed in Global Secret Group-style operations 48-72h before encryption.
author: Security Arsenal Threat Intelligence
date: 2026/08/18
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_bin:
    Image|endswith:
      - '\7z.exe'
      - '\7za.exe'
      - '\rar.exe'
      - '\winrar.exe'
  selection_args:
    CommandLine|contains:
      - ' a '
      - ' -p'
      - '.doc'
      - '.xls'
      - '.pdf'
      - '.sql'
      - '.bak'
      - '.pst'
      - '.zip'
      - '\\*'
  condition: all of selection_*
falsepositives:
  - IT backup scripts and software packaging (baseline scheduled admin archiving activity)
level: medium
tags:
  - attack.collection
  - attack.t1560.001
  - attack.exfiltration
---
title: Pre-Ransomware Shadow Copy and Backup Deletion
id: 8f2a1c4e-gsg-0003-4b7a-9d1e-vss2026a03
status: experimental
description: Detects Volume Shadow Copy deletion, backup catalog tampering, and boot recovery disabling - near-universal pre-encryption behavior in ransomware detonation chains including Global Secret Group affiliates.
author: Security Arsenal Threat Intelligence
date: 2026/08/18
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    CommandLine|contains:
      - 'vssadmin delete shadows'
      - 'vssadmin Delete Shadows'
      - 'wmic shadowcopy delete'
      - 'bcdedit'
  selection_vss_flags:
    CommandLine|contains:
      - '/all'
      - '/quiet'
      - 'recoveryenabled no'
      - 'ignoreallfailures'
  selection_wbem:
    Image|endswith: '\wbadmin.exe'
    CommandLine|contains: 'delete catalog'
  condition: (selection_vss and selection_vss_flags) or selection_wbem
falsepositives:
  - Rare; legitimate shadow administration is typically interactive and infrequent
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.defense_evasion

3.2 KQL — Microsoft Sentinel Hunt: Pre-Ransomware Staging & Lateral Movement

Hunts for the composite pattern typical of RaaS affiliate hands-on-keyboard activity in the 72h before detonation: remote service execution (PsExec/WMI), archive staging, and shadow copy tampering correlated per device.

// Global Secret Group-style pre-detonation hunt
// Correlates lateral movement + staging + anti-recovery per device in 72h window
let window = 72h;
let LateralMove =
    DeviceProcessEvents
    | where TimeGenerated > ago(window)
    | where ProcessCommandLine has_any ("psexec", "\\ADMIN$", "wmic /node:", "winrm", "wmiexec")
       or (FileName =~ "wmiprvse.exe" and InitiatingProcessFileName in~ ("powershell.exe","cmd.exe","rundll32.exe"))
    | project DeviceName, LateralTime=TimeGenerated, LateralCmd=ProcessCommandLine;
let Staging =
    DeviceProcessEvents
    | where TimeGenerated > ago(window)
    | where FileName in~ ("7z.exe","7za.exe","rar.exe","winrar.exe")
    | where ProcessCommandLine has_any (" a ", "-p", ".doc", ".xls", ".sql", ".bak", ".pst")
    | project DeviceName, StageTime=TimeGenerated, StageCmd=ProcessCommandLine;
let AntiRecovery =
    DeviceProcessEvents
    | where TimeGenerated > ago(window)
    | where ProcessCommandLine has_any ("vssadmin delete shadows","shadowcopy delete","delete catalog","recoveryenabled no")
    | project DeviceName, AntiRecTime=TimeGenerated, AntiRecCmd=ProcessCommandLine;
LateralMove
| join kind=inner Staging on DeviceName
| join kind=inner AntiRecovery on DeviceName
| extend KillChainScore = 3
| project DeviceName, LateralTime, LateralCmd, StageTime, StageCmd, AntiRecTime, AntiRecCmd, KillChainScore
| order by AntiRecTime desc;
// Any hit = treat as active intrusion, not ransomware "precursor" — isolate immediately

3.3 PowerShell — Rapid Triage: Scheduled Tasks, RDP Exposure & Shadow Copy State

Run on any host suspected of staging activity, or fleet-wide via your RMM/Intune during the 24h response window.

# Security Arsenal - GSG Rapid Triage Script (2026-08-18)
# Checks: new scheduled tasks (7d), RDP exposure, shadow copy integrity, suspicious RMM presence
$report = @{}

# 1) Scheduled tasks created in last 7 days (persistence check)
$cutoff = (Get-Date).AddDays(-7)
$report.NewTasks = Get-ScheduledTask | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    [PSCustomObject]@{ Name=$_.TaskName; Path=$_.TaskPath; Author=$_.Author;
        Action=($_.Actions | ForEach-Object { "$($_.Execute) $($_.Arguments)" }) -join ';' }
} | Where-Object { $_.Action -match 'powershell|cmd|rundll32|regsvr32|mshta|AppData|Temp' }

# 2) RDP exposure check
$rdpEnabled = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$rdpPort = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp').PortNumber
$report.RDP = [PSCustomObject]@{ Enabled=$rdpEnabled; Port=$rdpPort;
    NLA=(Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp').UserAuthentication }

# 3) Shadow copy state (deletion = active or imminent detonation indicator)
$report.ShadowCopies = @(Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue).Count

# 4) Unauthorized RMM binaries in suspicious paths
$susPaths = @("$env:ProgramData","$env:PUBLIC","$env:TEMP")
$rmmNames = 'screenconnect|anydesk|teamviewer|splashtop|atera|level|dwagent'
$report.SuspiciousRMM = foreach ($p in $susPaths) {
    Get-ChildItem $p -Recurse -Include *.exe -ErrorAction SilentlyContinue |
        Where-Object { $_.Name -match $rmmNames } | Select-Object FullName, CreationTime }

# 5) Recent failed logons (RDP brute-force signature)
$report.FailedLogons24h = (Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625; StartTime=(Get-Date).AddHours(-24)} -ErrorAction SilentlyContinue).Count

$report | ConvertTo-Json -Depth 5
# ACTION: If ShadowCopies -eq 0 AND FailedLogons24h -gt 500 -> isolate host, escalate to IR immediately

4. Incident Response Priorities

T-Minus Detection Checklist (before encryption fires)

• New local/domain admin accounts created outside change control
• Archive utilities (7z/rar) executing against file shares, mailboxes (.pst), or database backups
• Outbound transfers >2GB to unfamiliar cloud storage, MEGA/file.io-class services, or raw IPs
• vssadmin delete shadows, bcdedit ... recoveryenabled no, or wbadmin delete catalog execution
• PsExec/WMI/WinRM service execution fan-out from a single workstation (patient-zero lateral movement)
• ScreenConnect or other RMM agents present that are not in your sanctioned software inventory
• Mass file renames or entropy spikes on NAS/file-server volumes (early encryption beaconing)

Critical Assets GSG-Style Actors Prioritize for Exfiltration

Given double extortion with leak-site countdowns, expect theft of: finance/AR-AP records, HR/PII files, customer databases, email archives (.pst), and (for healthcare victims) patient records. Manufacturing victims should assume CAD/process IP is in scope. The leak-site countdown means the data was out before you saw the ransom note.

Containment Actions — Ordered by Urgency

1. Isolate affected hosts and subnets at the switch/EDR level — do not power off (preserve memory).
2. Disable the suspected ingress path: force-reset all VPN/local admin credentials; take the compromised RMM instance offline; block ScreenConnect relay domains if unauthorized.
3. Revoke sessions enterprise-wide (tokens, Kerberos via double krbtgt reset if domain compromise is confirmed).
4. Preserve evidence: memory capture on patient zero, VPN/firewall logs, RMM connection logs — these determine the access vector for KEV correlation.
5. Engage IR and legal/comms before any attacker contact; healthcare entities must assess breach-notification obligations (HIPAA) immediately given exfiltration.
6. Snapshot-verify backups offline before restoration; assume backup infrastructure was a target.

5. Hardening Recommendations

Immediate (24 hours)

• Patch Check Point Security Gateway (CVE-2026-50751) or disable IKEv1 where feasible. If the gateway was unpatched since June 2026, initiate a compromise assessment on it — do not assume absence of evidence equals absence of intrusion.
• Patch/audit ConnectWise ScreenConnect (CVE-2024-1708) and inventory every RMM binary in the environment; block all non-sanctioned RMM at the egress proxy and via AppLocker/WDAC.
• Disable internet-exposed RDP. Enforce VPN + MFA + NLA; alert on >50 failed 4625 events per source IP per hour.
• Enable tamper protection and block shadow copy deletion for non-SYSTEM contexts via EDR custom rules.
• Deploy the three Sigma rules above to your SIEM this shift.

Short-Term (2 weeks)

• Patch Exchange (CVE-2023-21529) and Windows (CVE-2025-60710); if on-prem Exchange is internet-facing and past due, treat as a priority-1 exposure.
• Segment backup infrastructure onto a separate admin tier with immutable/offline copies; ransomware actors target backup catalogs first.
• Deploy egress DLP/transfer anomaly detection — double extortion means the exfil window (48–72h pre-detonation) is your last reliable intervention point.
• Macro and script hardening: block Office macros from internet-sourced files (Mark-of-the-Web), constrain PowerShell via Constrained Language Mode for non-admin users, and audit developer tooling integrity in light of the Nx supply-chain CVE.
• Tabletop a double-extortion scenario with legal, comms, and cyber-insurance counsel — leak-site negotiation timelines compress decision-making.

This briefing is based on live dark web leak-site monitoring via ransomware.live and CISA KEV correlation as of 2026-08-18. Victim postings do not independently confirm compromise details; assessments reflect observed actor patterns and carry the confidence levels noted above.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub