Executive Summary

God's Gladiators published new details about the second phase of its “Long Hands” operation and claimed to have conducted activity affecting between 1,500 and 2,000 entities across 10 to 11 countries, including approximately 100 to 150 major international organizations and companies.

Among the names highlighted by the actor are Argentine public and private institutions such as BCRA, YPF, UIF, CNV, Banco Provincia, Banco Galicia, Banco Macro, Balanz, Tecpetrol, and TGN, alongside international organizations operating in the financial, technology, energy, industrial, food, and telecommunications sectors.

The publication continues a sequence documented by iQBlack since August. In its immediately preceding stage, God's Gladiators had announced an expansion toward major companies but had not provided technical evidence sufficient to assess the scale it was claiming.

This time, the actor accompanied its statement with a file that iQBlack was able to examine. The material supports the possession of a database containing information associated with thousands of contacts and numerous organizations, but it does not demonstrate that God's Gladiators directly compromised the systems of every entity it names.

That distinction materially changes the interpretation of “Long Hands”.

A Database Containing Thousands of Records and Hundreds of Organizations

The analyzed file contains 5,104 records distributed across 26 fields.

Its structure includes IP addresses, email addresses, company names, job titles, phone numbers, account status, registration dates, identifiers, and a password field, among other attributes. The organization field contains information in 4,859 records and includes approximately 2,479 different names after basic normalization.

That figure does not represent 2,479 verified unique organizations. Spelling variations, different legal names, subsidiaries, and multiple ways of recording the same company prevent it from being used as a direct victim count.

It does, however, establish something relevant: the file is clearly multi-company in nature.

Several of the figures published by God's Gladiators also correspond directly with entries in the dataset. For example, there are 31 records under the exact designation BCRA, 23 under YPF, 19 under TGN, 17 under BBVA, 12 under Arcor, seven under CNV, six under Balanz, and five under AFIP, among other matches.

This strengthens the assessment that the list published by the actor was constructed, at least in part, from the shared file.

It does not, however, demonstrate that each match represents a compromised corporate system.

Companies Appearing in the Dataset Does Not Mean Those Companies Were Compromised

God's Gladiators presents the operation as a series of attacks against organizations and employees. Yet its own explanation introduces a different model: the actor claims that the initial access began with an intermediary organization and subsequently reached a server containing information associated with approximately 500 companies, before expanding that reach through the same method.

If that description is accurate, the presence of information belonging to employees of BCRA, YPF, banks, energy companies, or technology firms would not necessarily imply independent compromises of those organizations’ networks.

The scenario could instead involve data concentration within one or more third parties: client platforms, service providers, shared repositories, professional services, or other intermediaries capable of aggregating information from numerous organizations.

For now, a more defensible formulation is that God's Gladiators possesses aggregated information associated with individuals linked to a large number of organizations. The exact technical origin of that information remains unresolved.

Password Data Provides Evidence, but Also Reveals Limits

The sample allows other elements of the actor’s publication to be assessed.

More than 3,800 records contain values formatted consistently with bcrypt hashes, aligning with God's Gladiators’ description of the credential type stored in the dataset. The database also contains email addresses, IP addresses, phone numbers, job titles, and company information in significant quantities.

However, some fields used by the actor to describe the scope of the exposure present a different reality within the examined sample.

Although columns for DNI and CUIT are present, nearly all of those values are empty in the available file.

The presence of a field within the schema therefore does not demonstrate that this category of information is populated at scale within the available data.

Another indicator also warrants caution: the registration-date field is heavily concentrated in 2021, with the vast majority of shared records carrying the same date from that year.

From High-Profile Names to an Aggregated Exposure Surface

In its previous publication, God's Gladiators used the names of high-profile companies to project a second phase whose scale still had to be demonstrated.

There is now material that does, in fact, contain references to numerous organizations.

But the sample also requires that narrative to be refined.

A database containing YPF employees does not demonstrate a compromise of YPF. An account associated with BCRA does not demonstrate access to the Central Bank’s infrastructure. A record belonging to an international company does not automatically make that organization a direct technical victim of “Long Hands”.

What does emerge is a potentially important phenomenon for a different reason: the concentration of information from multiple organizations within a single source can allow one compromise to create an exposure surface far broader than the original technical victim.

From an intelligence perspective, that distinction is more valuable than the raw number of companies presented by the actor.

The Political Dimension Remains

God's Gladiators continues to frame “Long Hands” within a political narrative tied to the international positioning of governments it considers aligned with Israel.

In this publication, the actor broadens that rhetoric toward the United States and France and uses the message to call for action against the governments of Donald Trump, Javier Milei, and Emmanuel Macron.

That rhetoric provides evidence regarding the actor’s declared motivation and communication strategy, but it must remain separate from the technical assessment of the data.

The propaganda dimension and the actual exposure can coexist without necessarily operating at the same scale.

Analytical Closing

The second phase of “Long Hands” is no longer where it was when God's Gladiators first announced it.

At that point, there were major names and a promise of scale. There is now a file demonstrating that the actor possesses structured information associated with thousands of individuals and a broad universe of organizations. Several of the published counts also correspond with the available records, strengthening the relationship between the material and the actor’s statement.

But the evidence also introduces a decisive limitation: a multi-company dataset is not equivalent to thousands of corporate compromises.

God's Gladiators’ own explanation suggests that part of the scale may have been obtained through intermediary systems capable of concentrating information belonging to numerous third parties.

The new evidence therefore strengthens “Long Hands” as a data-exposure operation, but it still does not validate the narrative of between 1,500 and 2,000 directly attacked organizations.

That distinction will be essential for understanding what the second phase actually represents: a distributed intrusion campaign affecting thousands of victims, or one or several compromises capable of producing an aggregated exposure of enormous scale.