GLOBAL SECRET GROUP Ransomware: 3 US Victims Posted in 24 Hours — Transportation, Retail & Government/Defense Targeting Analysis with Detection Rules

Classification: TLP:AMBER — Dark Web Intelligence Bulletin Collection Source: Direct .onion leak site monitoring via ransomware.live Collection Date: 2026-08-26 Confidence Level: High (victim claims verified on actor-controlled infrastructure)

Executive Summary

On 2026-08-25, the ransomware operation tracked as GLOBAL SECRET GROUP posted three new victims to its dark web leak site in a single 24-hour window — a notable escalation in posting tempo for an operation that has averaged low-volume, deliberate victim disclosure. All three victims are US-based organizations spanning Transportation (Tiseo Paving), Retail & E-Commerce (Johnson City Honda), and Government & Defense adjacency (Lockheed Architectural Solutions, Inc.).

The sector spread is the story here. This is not opportunistic spraying — the victim selection suggests a maturing access pipeline, likely leveraging edge-device exploitation and commodity remote access tooling consistent with the CISA KEV entries currently circulating in ransomware affiliate ecosystems. Organizations in construction, automotive retail, and defense-industrial supply chains should treat this bulletin as an active-hunt trigger, not a passive read.

1. Threat Actor Profile — GLOBAL SECRET GROUP

Analyst Note: The name collision between victim "Lockheed Architectural Solutions, Inc." and Lockheed Martin should not be overstated — this appears to be a defense-adjacent architectural/construction firm, not the prime contractor. However, GSG posting it under a "Government & Defense" sector tag on their leak site indicates the gang is deliberately courting the optics of defense-sector compromise. Supply-chain adjacency risk is real: sub-tier defense contractors frequently hold CUI-adjacent data with weaker controls than primes.

2. Current Campaign Analysis

Victim Postings (Leak Site — 2026-08-25)

Sector Targeting Assessment

The three-sector spread in a single posting window indicates one of two things:

1. Batch disclosure — victims compromised weeks apart were published simultaneously after parallel negotiation failures. This is common with lower-volume crews who queue disclosures for psychological impact.
2. A single access vector campaign — a shared exploitation method (e.g., a specific VPN/firewall CVE or a compromised RMM tool) yielded concurrent intrusions across unrelated verticals.

Given the KEV overlap below, assessment leans toward scenario 2 with moderate confidence.

Geographic Concentration

100% United States. All three victims are US-based. This is consistent with the operation's monetization model — US mid-market organizations carry cyber insurance, face regulatory breach-notification pressure, and historically pay at higher rates. No cross-border targeting observed in the current window.

Victim Profile

• Tiseo Paving — regional transportation/construction firm. Typical profile: legacy on-prem infrastructure, flat networks, minimal EDR coverage, heavy reliance on line-of-business apps and email. Low security maturity makes paving/construction firms soft targets.
• Johnson City Honda — automotive dealership. Dealerships are a historically soft vertical: franchise IT is often managed by small MSPs, endpoint fleets are mixed, and DMS (dealer management system) credentials are high-value for follow-on fraud. Revenue estimate: $30M–$80M.
• Lockheed Architectural Solutions — defense-adjacent construction/architecture. Potential exposure of project plans, facility blueprints, and government contract documentation — exactly the category of data that elevates a ransomware event to a regulatory/incident-reporting matter (DFARS 252.204-7012 considerations if CUI is involved).

CVE Correlation — Probable Initial Access Vectors

The following CISA KEV entries are confirmed ransomware-associated and map plausibly to this campaign's access profile:

Priority action: If you operate Check Point gateways or any ConnectWise ScreenConnect instance, patch/audit today and hunt backward for authentication anomalies over the past 30 days.

3. Detection Engineering

The following detections target the TTP cluster associated with this campaign profile: edge-device initial access, RMM/tool abuse, PsExec/WMI lateral movement, VSS deletion, and pre-encryption data staging.

---
title: GLOBAL SECRET GROUP — Pre-Encryption Shadow Copy Deletion
id: 8f3a1c2e-gsg-4b7a-9d1e-vssdelete001
status: experimental
description: Detects Volume Shadow Copy deletion and backup catalog tampering consistent with GLOBAL SECRET GROUP pre-encryption staging. Fires on vssadmin, wmic shadowcopy delete, and bcdedit recoveryenabled tampering.
author: Security Arsenal Threat Intel
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
      - '\wbadmin.exe'
  selection_cmd:
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'resize shadowstorage'
      - 'delete catalog'
      - 'recoveryenabled no'
      - 'ignoreallfailures'
  condition: selection_img and selection_cmd
falsepositives:
  - Legitimate backup maintenance windows (rare on endpoints)
  - IT-driven disk space reclamation scripts
level: high
tags:
  - attack.impact
  - attack.t1490
  - gsg-campaign-2026-08
date: 2026/08/26
---
title: GLOBAL SECRET GROUP — PsExec/WMI Remote Service Lateral Movement
id: 8f3a1c2e-gsg-4b7a-9d1e-latmove002
status: experimental
description: Detects remote service creation via PsExec-style named services and WMI process spawning on remote hosts, matching GSG lateral movement patterns using commodity admin tooling.
author: Security Arsenal Threat Intel
logsource:
  product: windows
  service: security
detection:
  selection_7045:
    EventID: 7045
    ServiceName|contains:
      - 'PSEXESVC'
      - 'PAExec'
      - 'csexec'
      - 'remcom'
  selection_wmi:
    EventID: 4688
    CommandLine|contains:
      - 'wmic /node:'
      - 'wmic process call create'
      - 'Invoke-WmiMethod'
      - 'win32_process'
  condition: 1 of selection_*
falsepositives:
  - Legitimate admin tooling in managed environments
  - SCCM/Intune software push activity
level: high
tags:
  - attack.lateral-movement
  - attack.t1569.002
  - attack.t1047
  - gsg-campaign-2026-08
date: 2026/08/26
---
title: GLOBAL SECRET GROUP — Data Staging and Cloud Exfiltration via Rclone/MEGA
id: 8f3a1c2e-gsg-4b7a-9d1e-exfil003
status: experimental
description: Detects execution of common exfiltration utilities (rclone, MEGAcmd, 7zip archive staging) from non-standard directories, consistent with double-extortion data theft prior to ransomware detonation.
author: Security Arsenal Threat Intel
logsource:
  category: process_creation
  product: windows
detection:
  selection_binary:
    Image|endswith:
      - '\rclone.exe'
      - '\MEGAcmd.exe'
      - '\MEGAclient.exe'
      - '\7z.exe'
      - '\winscp.exe'
      - '\filezilla.exe'
  selection_args:
    CommandLine|contains:
      - 'copy'
      - 'sync'
      - 'move'
      - '--transfers'
      - 'a -p'
      - 'a -m'
  filter_path:
    Image|startswith:
      - 'C:\Program Files\'
      - 'C:\Program Files (x86)\'
  condition: selection_binary and selection_args and not filter_path
falsepositives:
  - Developer use of 7zip (filtered by path)
  - Legitimate cloud sync agents installed by IT
level: high
tags:
  - attack.exfiltration
  - attack.t1560
  - attack.t1567.002
  - gsg-campaign-2026-08
date: 2026/08/26

The Sentinel hunt below pivots on the pre-detonation window: new admin-tool service installs, anomalous outbound volume to consumer cloud storage, and VSS events — correlated per-host within a 72-hour sliding window to surface staging before encryption fires.

// Security Arsenal — GSG Pre-Ransomware Staging Hunt
// Correlates lateral movement, shadow copy tampering, and exfil staging per device (72h window)
let Lookback = 7d;
let Lateral =
    SecurityEvent
    | where TimeGenerated > ago(Lookback)
    | where EventID in (7045, 4697)
    | where ServiceName has_any ("PSEXESVC","PAExec","remcom","csexec")
       or ServiceFileName has_any ("\\ADMIN$","\\C$\\Windows\\Temp")
    | project LateralTime=TimeGenerated, Device=Computer, ServiceName, Account;
let VSSTamper =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName in~ ("vssadmin.exe","wmic.exe","bcdedit.exe","wbadmin.exe")
    | where ProcessCommandLine has_any ("delete shadows","shadowcopy delete","recoveryenabled no","delete catalog")
    | project VSSTime=TimeGenerated, Device=DeviceName, ProcessCommandLine, InitiatingProcessAccountName;
let ExfilStage =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName in~ ("rclone.exe","megacmd.exe","7z.exe","winscp.exe")
    | where not(FolderPath has_any ("Program Files"))
    | project ExfilTime=TimeGenerated, Device=DeviceName, ExfilTool=FileName, ProcessCommandLine;
let NetBeacon =
    DeviceNetworkEvents
    | where TimeGenerated > ago(Lookback)
    | where RemoteUrl has_any ("mega.nz","mega.co.nz","transfer.sh","file.io","anonfiles","gofile.io")
       or RemoteIP in (dynamic([])) // enrich with your threat feed for CS/Sliver C2
    | summarize NetHits=count(), RemoteEndpoints=make_set(RemoteUrl,5) by Device=DeviceName;
Lateral
| join kind=inner VSSTamper on Device
| join kind=leftouter ExfilStage on Device
| join kind=leftouter NetBeacon on Device
| extend KillChainScore = 2 + iif(isnotnull(ExfilTime),2,0) + iif(NetHits>0,1,0)
| project Device, LateralTime, ServiceName, VSSTime, ProcessCommandLine, ExfilTool, ExfilTime, NetHits, RemoteEndpoints, KillChainScore
| order by KillChainScore desc, VSSTime asc

Tuning guidance: A KillChainScore >= 4 means a single host shows service-based lateral movement and shadow-copy tampering — treat as imminent detonation and isolate immediately. Score 2–3 warrants same-shift investigation.

Rapid-response triage script — run on suspected staging hosts or fleet-wide via your RMM. It enumerates recently created scheduled tasks, suspicious services, VSS state, and RDP exposure in one pass:

# Security Arsenal — GSG Rapid Triage Script (run as Administrator)
# Checks: scheduled tasks (7d), rogue services, VSS health, RDP exposure, recent exfil-tool artifacts
$lookback = (Get-Date).AddDays(-7)
$report = [ordered]@{}

Write-Host "[*] === GLOBAL SECRET GROUP RAPID TRIAGE ===" -ForegroundColor Cyan

# 1. Scheduled tasks created in last 7 days (common GSG persistence/detonation vector)
Write-Host "`n[1] Scheduled tasks created since $lookback" -ForegroundColor Yellow
$tasks = Get-ScheduledTask | Where-Object { $_.Date -gt $lookback } |
    Select-Object TaskName, TaskPath, Date, @{N='Action';E={$_.Actions.Execute}}
$tasks | Format-Table -AutoSize
$report['NewScheduledTasks'] = $tasks

# 2. Services matching PsExec/remote-exec patterns
Write-Host "`n[2] Suspicious remote-exec services" -ForegroundColor Yellow
$svc = Get-CimInstance Win32_Service | Where-Object {
    $_.Name -match 'PSEXESVC|PAExec|remcom|csexec' -or
    $_.PathName -match 'ADMIN\$|\\Temp\\|\\Users\\Public\\'
} | Select-Object Name, DisplayName, State, PathName, StartName
$svc | Format-Table -AutoSize
$report['SuspiciousServices'] = $svc

# 3. Volume Shadow Copy health (GSG deletes these pre-encryption)
Write-Host "`n[3] Volume Shadow Copy state" -ForegroundColor Yellow
$vss = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $vss) { Write-Host "  [!] NO SHADOW COPIES EXIST — possible pre-encryption tampering" -ForegroundColor Red }
else { $vss | Select-Object DeviceObject, InstallDate | Format-Table -AutoSize }
$report['ShadowCopies'] = $vss

# 4. RDP exposure check
Write-Host "`n[4] RDP configuration" -ForegroundColor Yellow
$rdpEnabled = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$nla = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -ErrorAction SilentlyContinue).UserAuthentication
Write-Host "  RDP Enabled: $rdpEnabled | NLA Required: $nla"
if ($rdpEnabled -and $nla -ne 1) { Write-Host "  [!] RDP WITHOUT NLA — brute-force exposure matches GSG access profile" -ForegroundColor Red }
$report['RDPExposed'] = $rdpEnabled -and ($nla -ne 1)

# 5. Exfil/staging tool artifacts in user-writable paths
Write-Host "`n[5] Exfil tool artifacts (Public/Temp/AppData)" -ForegroundColor Yellow
$hits = Get-ChildItem 'C:\Users\Public','C:\Windows\Temp' -Recurse -Include 'rclone*.exe','mega*.exe','7z.exe','*.7z','*.zip' -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt $lookback } | Select-Object FullName, Length, LastWriteTime
$hits | Format-Table -AutoSize
$report['ExfilArtifacts'] = $hits

# Summary
Write-Host "`n[*] TRIAGE SUMMARY" -ForegroundColor Cyan
if ($report['SuspiciousServices'] -or -not $report['ShadowCopies'] -or $report['ExfilArtifacts']) {
    Write-Host "[!!] ELEVATED RISK — indicators of ransomware staging detected. Isolate host and invoke IR." -ForegroundColor Red
} else {
    Write-Host "[OK] No high-confidence staging indicators found. Continue monitoring." -ForegroundColor Green
}

4. Incident Response Priorities

T-Minus Detection Checklist (Before Encryption Fires)

If you are in a targeted vertical, hunt for this sequence — it is the standard detonation precursor for crews of this profile:

1. Edge device anomalies — Check Point IKEv1 auth events from unfamiliar source IPs; new local admin accounts on the gateway itself.
2. RMM drift — ScreenConnect/AnyConnect sessions outside business hours; RMM agents installed that your MSP never deployed.
3. Discovery bursts — net group "Domain Admins" /domain, nltest /dclist, AdFind/SharpHound execution within 24–72h of initial access.
4. Archive staging — large .7z/.zip/.rar files in C:\Users\Public or C:\Windows\Temp on file servers.
5. Cloud exfil spikes — egress to mega.nz, gofile.io, transfer.sh, or unknown S3 buckets from servers that never talk to consumer cloud.
6. VSS deletion + bcdedit recoveryenabled no — the 60-minute warning. If you see this, assume detonation is imminent.
7. Mass GPO/scheduled task creation — encryption is pushed via domain policy or PS remoting in the final stage.

Critical Assets This Threat Profile Prioritizes for Exfiltration

• File servers and NAS — contracts, financials, HR records (the extortion leverage payload)
• Email archives / on-prem Exchange — negotiation leverage and executive comms
• Backup infrastructure (Veeam repositories, backup admin credentials) — destroyed first to force payment
• Vertical-specific data — for the defense-adjacent victim profile: blueprints, project documentation, and anything CUI-adjacent; for dealerships: DMS databases and customer PII/finance applications

Containment Actions — Ordered by Urgency

1. Isolate, don't power off — network-quarantine affected hosts via EDR/switch ACL to preserve volatile memory for forensics.
2. Kill the edge — disable or ACL the compromised VPN/RMM pathway immediately; rotate all credentials that transited it.
3. Protect backups — take backup infrastructure offline or verify immutable/offline copies are intact before touching anything else.
4. Reset the identity plane — force password resets for Domain Admins, service accounts, and KRBTGT (twice) if domain-level access is suspected.
5. Block exfil egress — emergency-deny consumer cloud storage and unknown ASNs at the proxy/firewall.
6. Preserve evidence — capture memory and triage images from patient zero and the staging host before remediation wipes them.
7. Engage counsel early on disclosure — if defense-contract data is involved, DFARS 252.204-7012 72-hour DoD reporting obligations may apply; dealerships face state AG/FTC Safeguards Rule considerations.

5. Hardening Recommendations

Immediate (24 Hours)

• Patch or mitigate CVE-2026-50751 on all Check Point gateways; disable IKEv1 where operationally feasible. Audit gateway auth logs back 30 days.
• Audit every RMM instance (ScreenConnect especially — CVE-2024-1708): inventory installed agents, kill unauthorized sessions, enforce MFA on the RMM console.
• Block consumer exfil destinations (mega.nz, gofile, transfer.sh, anonfiles) at the egress proxy and alert on rclone/MEGAcmd execution fleet-wide.
• Deploy the Sigma rules above to your SIEM and run the triage PowerShell on file servers, backup servers, and any host with recent anomalous logons.
• Verify shadow copies exist and backups are immutable — test a restore today, not after detonation.
• Enable NLA on all RDP and restrict 3389 to VPN-only or eliminate external RDP entirely.

Short-Term (2 Weeks)

• Segment backup infrastructure onto an isolated management plane with dedicated credentials that never touch the production domain (tiered admin model).
• Deploy EDR with network isolation capability across the full endpoint fleet — paving/construction and dealership environments frequently have unmanaged endpoints; close that gap first.
• Implement egress filtering by default-deny for server VLANs — file servers have no legitimate need to reach consumer cloud storage.
• Enforce phishing-resistant MFA (FIDO2) on all remote access and privileged accounts; macro-blocking policy and attack surface reduction rules on all workstations.
• Exchange hardening — patch CVE-2023-21529 exposure path, restrict EWS/OWA externally, enable AMSI integration.
• Threat-hunt retainer or MDR onboarding — organizations of the victim profile (regional, $10M–$100M revenue) consistently lack 24/7 detection; this campaign is exactly the case study for why that gap matters.

Analyst Bottom Line

GLOBAL SECRET GROUP's 2026-08-25 posting burst is small in volume but sharp in signal: a US-focused operation with probable edge-device/RMM initial access, hitting defense-adjacent and soft-vertical targets simultaneously. The detection content above is engineered to catch the staging window — the 48–72 hours where this attack is still stoppable. If you run Check Point or ScreenConnect anywhere in your estate, start there.

This briefing is based on live collection from actor-controlled leak infrastructure. Victim claims are actor-reported and unverified by the named organizations at time of publication.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub