RaqibCTI Ransomware
DragonForceDragonForce Cartel
Attribution
RaaS / 'cartel' affiliate model (financially motivated, unattributed)
Motivation
Financially motivated (ransomware)
Attribution confidence
medium
MENA targeting
Saudi Arabia
Sectors
Real estate, construction, chemical/logistics
Corpus activity · 6mo1 mention
Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.
Why it mattersRansomware actor, medium confidence, documented targeting Saudi Arabia (Real estate, construction, chemical/logistics sectors).
What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.
No open hunts or recent alerts tracked against this actor right now.
Reporting history
4 reports · 0 publishersThird-party sources archived via ORKL — not RaqibCTI assessments. Reported since 2025-06-24.
A2026-04-16
2025_IC3Report.pdf
C2026-03-17
rapid7-threat-landscape-report-2026.pdf
Technique overlap
→TenguactorTechnique overlap →NovaactorTechnique overlap →LynxactorTechnique overlap ←Cl0pactorTechnique overlap ←Qilin (fka Agenda) · QilincampaignCorrelated cluster2026-09-17Targets
- →WozairtargetLeak-site claim · ransomware.live2026-08-24
- →NewNettargetLeak-site claim · ransomware.live2026-07-18
- →Sinai Grand CasinotargetLeak-site claim · ransomware.live2026-07-16
- →Midal CablestargetLeak-site claim · ransomware.live2026-07-14
- →degeremcia.comtargetLeak-site claim · ransomware.live2026-07-13
- →Al - Saidi FactorytargetLeak-site claim · ransomware.live2026-07-12
- →Al Shafar GRCtargetLeak-site claim · ransomware.live2026-06-12
- →The DRMtargetLeak-site claim · ransomware.live2026-06-12
A2025-08-01
Scattered Spider
C2025-06-24
2025 Cyber Threat Intelligence Report
Suggested · co-occurring (unverified)
These entities are frequently mentioned together in source material; co-occurrence is not a verified relationship.
- MalwareRhysidaco-mentioned in 1 item
- CVECVE-2026-50752co-mentioned in 1 item
- CVECVE-2026-50751co-mentioned in 1 item
- CountryChinaco-mentioned in 1 item
- MalwareBlackByteco-mentioned in 1 item
- TechniqueT1059.007co-mentioned in 1 item
- TechniqueT1564.006co-mentioned in 1 item
- CVECVE-2026-33825co-mentioned in 1 item
- MalwareCorunaco-mentioned in 1 item
- MalwareLummaco-mentioned in 1 item
- MalwarePasivRobberco-mentioned in 1 item
- MalwareQilinco-mentioned in 1 item
- Technique
T1496
co-mentioned in 1 item
MalwareINCco-mentioned in 1 itemMalwareAkiraco-mentioned in 1 itemTechniqueT1068co-mentioned in 1 itemMalwareFlutterShellco-mentioned in 1 itemTechniqueT1486co-mentioned in 1 itemTechniqueT1572co-mentioned in 1 itemCountryNetherlandsco-mentioned in 1 itemMalwareGlassWormco-mentioned in 1 itemMalwareVidarco-mentioned in 1 itemMalwareOysterco-mentioned in 1 itemTechniqueT1553.002co-mentioned in 1 itemCountryGermanyco-mentioned in 1 itemTechniqueT1190co-mentioned in 1 itemTechniqueT1195.002co-mentioned in 1 itemCountryPakistanco-mentioned in 1 itemCountryUnited Statesco-mentioned in 1 item