Lamashtu · Ransomware · RaqibCTI

+ Request intel workspace

ransomware

Lamashtu

dormant · last signal 3mo agoAttribution: ModeratePlausible and partly corroborated — some gaps or single-source elements.

Ransomware

Attribution

Unattributed. No public reporting links Lamashtu to a known ransomware operation, RaaS affiliate program, or named lineage. Named after the Mesopotamian demon Lamashtu; the branding is the only distinctive marker and no vendor has published code or infrastructure analysis tying it to a predecessor. Any lineage claim would be speculative.

First seen

2026-04

Last active

2026-06-17

Motivation

Financial (data-theft extortion)

Attribution confidence

medium

MENA targeting

UAE, Egypt

Sectors

Hospitality, manufacturing, agriculture/food

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

Why it mattersRansomware actor, medium confidence, documented targeting UAE, Egypt (Hospitality, manufacturing, agriculture/food sectors).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

Associated with

Targets

Great FoodstargetLeak-site claim · ransomware.live2026-06-17
Luna GrouptargetLeak-site claim · ransomware.live2026-05-04
ROYAL M HOTEL BY GEWAN FUJAIRAH LLCtargetLeak-site claim · ransomware.live2026-05-04

Uses

Exfiltration Over Web ServicetechniqueATT&CK mapping
Data from Local SystemtechniqueATT&CK mapping
Financial ThefttechniqueATT&CK mapping
Data from Network Shared DrivetechniqueATT&CK mapping

Overview

Lamashtu is a data-extortion brand that surfaced publicly in mid-April 2026 and was catalogued by ransomware trackers (ransomware.live, DarkFeed, WatchGuard) after listing victims on a dark-web (.onion) leak site. It operates a double-extortion model (data theft plus threat of leak), though public sources note it has not been confirmed to deploy actual file-encrypting ransomware as opposed to pure exfiltration extortion. Targeting is opportunistic and cross-sector/cross-region rather than focused on any single vertical or geography.

History

Lamashtu first appeared publicly around 11-13 April 2026, when trackers observed an initial wave of victim postings on its leak site. Over roughly two months it accumulated on the order of 30+ claimed victims across ~17 countries before going quiet after mid-June 2026 (last observed leak-site activity ~17 June 2026; dormant since). Top-hit countries in aggregator data include Malaysia, France, Thailand, Germany and Mexico, spanning manufacturing, professional services, agriculture/food production, retail and hospitality. Public reporting on Lamashtu is THIN and largely aggregator-level: ransomware.live victim entries, DarkFeed/WatchGuard tracker rows, and derived blog posts. There is no in-depth vendor malware analysis, no confirmed encryptor sample, no attributed operators, and no MITRE ATT&CK group ID. Reported TTP detail is minimal; aggregator notes that a notable share of listed victims also show infostealer-log presence, consistent with initial access via stolen credentials, but this is inferential, not confirmed. MENA relevance: REAL but low-volume and unverified as to compromise. RaqibCTI's UAE and Egypt country tags are each backed by actual named leak-site listings on ransomware.live — Egypt: Great Foods and Luna Group; UAE: Royal M Hotel by Gewan (Fujairah). These are genuine leak-site victim entries (not phantom tags), so the country tags are justified; however, like all Lamashtu claims they are unverified extortion assertions with no independent confirmation of breach, scope or data authenticity. Net: MENA footprint is real on the leak site but small (a handful of claimed victims) and evidentially thin.

Useful?