global

Para detección/bloqueo en tu EDR/SIEM. Fuente: ransomware.live.

Firma de detección defensiva para este grupo (úsala en tu EDR/SIEM). Fuente: ransomware.live.

/*
global ransomware
*/

rule global_Ransomnote
{
    meta:
        author = "ransomware.live"
        family = "ransomware.global"
        description = "Detects global ransomware ransom note or artifact"
        date = "2026-05-04"
        severity = 7
        score = 70

    strings:
        $name1 = "global" ascii nocase
        $name2 = "GLOBAL" ascii
        $onion  = "global.onion" ascii nocase

    condition:
        any of them
}

GLOBAL
Your network has been encrypted.
All of your important files — documents, databases, backups, and configurations are now inaccessible.
They have been locked using military-grade encryption. Only GLOBAL holds the decryption keys.
What happened?
-------------------------
We have gained full access to your internal network. During this time, sensitive data was exfiltrated
and your systems were encrypted.
Your business operations, internal communications, and customer data are at risk.
What comes next?
-------------------------
To restore access:
1. Download the Tor Browser ([redactado]
2. Visit our secure portal: [redactado]
3. Enter your unique ID: [snip]
4. Follow the instructions to begin negotiations.
You may submit one small file (<1MB, non-sensitive) for free decryption as proof we hold the keys.
We will also send you a file-listing to prove to you that we have stolen your data.
Failure to engage within 3 days will result in:
- Public release of your internal documents
- Irreversible loss of your encrypted data
- Escalation of your case to a wider leak network
There is no other way. Do not waste time with third-party tools or law enforcement.
You will only make things worse.
This is not personal. Just business.
Data Leak Site - [redactado]
**GLOBAL operates globally.**                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             

• https://www.ransomware.live/group/global