RaqibCTI — MENA Cyber Threat Intelligence

Threat actors

51 shown

Curated, citation-backed subset of the MENA Threat Actor Tracker — high and medium confidence only. Ransomware entries reflect a group's claimed victim, not a confirmed breach.

ALL APT RANSOMWARE FINANCIAL

Agrius (Agonizing Serpens / BlackShadow)

APT / State-sponsoredConfidence: highIsrael, UAE

ransomwarealphv-blackcat

ALPHV / BlackCat

RansomwareConfidence: mediumEgypt, Saudi Arabia

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

APT33

APT / State-sponsoredConfidence: highSaudi Arabia (primary), broader Gulf

Arid Viper (APT-C-23 / Desert Falcon)

APT / State-sponsoredConfidence: highPalestine, Egypt, Israel

Bahamut

APT / State-sponsoredConfidence: mediumEgypt, Iran, Palestine, Turkey, Tunisia, Saudi Arabia, Qatar, UAE

aptballistic-bobcat

Ballistic Bobcat

APT / State-sponsoredConfidence: highIsrael (primary), broader Middle East

aptbellaciao-operators

BellaCiao operators (Charming Kitten-linked)

APT / State-sponsoredConfidence: mediumIsrael, Turkey (MENA subset of a wider campaign; source also lists Austria, India, Italy, and US/Europe victims)

ransomwarebianlian

BianLian

RansomwareConfidence: mediumBahrain

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

ransomwareblacknevas

BlackNevas

RansomwareConfidence: mediumSaudi Arabia, UAE

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

ransomwarebqtlock

BQTLock

RansomwareConfidence: mediumUAE, Israel, Saudi Arabia

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

ransomwarecactus

Cactus

RansomwareConfidence: mediumUAE

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

aptcavern-manticore

Cavern Manticore

APT / State-sponsoredConfidence: highIsrael

aptcharming-kitten-apt42

Charming Kitten / APT42

APT / State-sponsoredConfidence: highIsrael, Gulf states, broader Middle East

ransomwarecicada3301

Cicada3301

RansomwareConfidence: mediumJordan, Tunisia, UAE

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

aptdark-caracal

Dark Caracal

APT / State-sponsoredConfidence: mediumLebanon (origin); global victims in 20+ countries incl. MENA

ransomwaredarkvault

DarkVault

RansomwareConfidence: mediumIsrael, Saudi Arabia, UAE, Qatar, Oman

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

aptdesert-falcons

Desert Falcons (original 2015 cluster)

APT / State-sponsoredConfidence: highPalestine, Egypt, Israel, Jordan; secondary: Saudi Arabia, UAE, Morocco, Qatar

ransomwaredragonforce

DragonForce

RansomwareConfidence: mediumSaudi Arabia

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

ransomwareeldorado

Eldorado

RansomwareConfidence: mediumJordan, Lebanon, UAE

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

ransomwareeverest

Everest

RansomwareConfidence: mediumUAE (and broader Gulf)

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

ransomwarefunksec

FunkSec

RansomwareConfidence: mediumEgypt

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

aptgaza-cybergang-molerats

Gaza Cybergang / Molerats

APT / State-sponsoredConfidence: highPalestinian Territories, Jordan, Israel, Lebanon, Egypt

ransomwareghostsec-ghostlocker

GhostSec / GhostLocker

RansomwareConfidence: mediumLebanon, Israel, Egypt, Qatar, Turkey, Morocco

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

ransomwarehandala

Handala

RansomwareConfidence: mediumIsrael, UAE (secondary)

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

HEXANE (Lyceum)

APT / State-sponsoredConfidence: mediumIsrael, Saudi Arabia, Kuwait, Morocco, Tunisia

ransomwarehunters-international

Hunters International

RansomwareConfidence: mediumUAE, Tunisia

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

aptimperial-kitten

Imperial Kitten (CURIUM)

APT / State-sponsoredConfidence: highIsrael (primary), broader Middle East tech sector

ransomwareincransom

IncRansom

RansomwareConfidence: mediumSaudi Arabia, UAE

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

ransomwarelockbit-lockbit-3-0

LockBit / LockBit 3.0

RansomwareConfidence: mediumUAE, Saudi Arabia, Kuwait, Qatar, Oman, Bahrain, Egypt

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

ransomwaremedusa

Medusa

RansomwareConfidence: mediumSaudi Arabia, UAE, Morocco

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

Meow

RansomwareConfidence: mediumOman, UAE

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

ransomwaremoney-message

Money Message

RansomwareConfidence: mediumEgypt

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

MuddyWater

APT / State-sponsoredConfidence: highUAE, Saudi Arabia, Israel, Turkey, Iraq, Jordan, Egypt

OilAlpha

APT / State-sponsoredConfidence: mediumYemen, broader Arabian Peninsula

OilRig (APT34)

APT / State-sponsoredConfidence: highSaudi Arabia, UAE, Iraq, Jordan, Israel, Kuwait, Qatar

ransomwarepay2key

Pay2Key (Fox Kitten / Pioneer Kitten, Iran-linked)

RansomwareConfidence: mediumIsrael, UAE, Azerbaijan

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

aptpredatory-sparrow

Predatory Sparrow

APT / State-sponsoredConfidence: mediumIran

ransomwareqilin

Qilin (fka Agenda)

RansomwareConfidence: mediumUAE, Egypt, Saudi Arabia

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

ransomwarerhysida

Rhysida

RansomwareConfidence: mediumKuwait, UAE

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

ransomwaresarcoma

Sarcoma

RansomwareConfidence: mediumSaudi Arabia, Oman, Kuwait, Qatar, UAE

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

aptscarred-manticore

Scarred Manticore (Storm-0861)

APT / State-sponsoredConfidence: highSaudi Arabia, UAE, Jordan, Kuwait, Oman, Iraq, Israel

Sea Turtle

APT / State-sponsoredConfidence: highTurkey, Iran, Egypt, Cyprus, Greece, broader MENA

SideWinder

APT / State-sponsoredConfidence: mediumEgypt (primary MENA focus, H2 2024), Djibouti, UAE

ransomwarestormous

Stormous

RansomwareConfidence: mediumEgypt, Saudi Arabia, Lebanon, Israel, Qatar, Turkey, UAE

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

StrongPity (PROMETHIUM)

APT / State-sponsoredConfidence: mediumSyria, Turkey (Kurdish-population-focused)

aptta402-molerats

TA402 / Molerats (2021–2023 activity)

APT / State-sponsoredConfidence: highMiddle East governments (Palestine-focused interests)

ransomwarethe-gentlemen

The Gentlemen

RansomwareConfidence: mediumSaudi Arabia, UAE

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

ransomwaretrigona

Trigona

RansomwareConfidence: mediumOman

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

apttropic-trooper

Tropic Trooper

APT / State-sponsoredConfidence: highMiddle East (unnamed governmental entity focused on human rights studies)

aptvoid-manticore

Void Manticore (Storm-0842)

APT / State-sponsoredConfidence: highIsrael

WIRTE

APT / State-sponsoredConfidence: mediumPalestinian Authority, Jordan, Iraq, Egypt, Saudi Arabia (per Check Point's specific victim list); Lebanon, Syria, Turkey, Armenia, Cyprus (per Securelist's broader campaign list)