ransomware

Lamashtu

dormant · last signal 3mo agoAttribution: ModeratePlausible and partly corroborated — some gaps or single-source elements.

Ransomware

Attribution

Unattributed. No public reporting links Lamashtu to a known ransomware operation, RaaS affiliate program, or named lineage. Named after the Mesopotamian demon Lamashtu; the branding is the only distinctive marker and no vendor has published code or infrastructure analysis tying it to a predecessor. Any lineage claim would be speculative.

First seen

2026-04

Last active

2026-06-17

Motivation

Financial (data-theft extortion)

Attribution confidence

medium

MENA targeting

UAE, Egypt

Sectors

Hospitality, manufacturing, agriculture/food

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

Why it mattersRansomware actor, medium confidence, documented targeting UAE, Egypt (Hospitality, manufacturing, agriculture/food sectors).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

Associated with

Targets

Great FoodstargetLeak-site claim · ransomware.live2026-06-17
Luna GrouptargetLeak-site claim · ransomware.live2026-05-04
ROYAL M HOTEL BY GEWAN FUJAIRAH LLCtargetLeak-site claim · ransomware.live2026-05-04

Uses

Exfiltration Over Web ServicetechniqueATT&CK mapping
Data from Local SystemtechniqueATT&CK mapping
Financial ThefttechniqueATT&CK mapping
Data from Network Shared DrivetechniqueATT&CK mapping

Coverage robustness · vs this actor

How evasion-resistant our detection coverage is against Lamashtu's techniques — Summiting the Pyramid scores analytics (1 brittle – 5 robust); the actor inherits through its TTPs. This is a detection-engineering metric, not an attribution signal — see Attribution for confidence.

Techniques with a robust rule

Techniques with any detection

3 / 4

Mean robustness (of covered)

Claimed victims · 3 tracked

Leak-site postings via ransomware.live — claimed by the group, not confirmed breaches. Metadata only. MENA Ransomware Watch →

Claim volume · last 12 months

ONDJFMAMJJAS

Useful?

2026-06-17	Great Foods	Egypt	Agriculture and Food Production
2026-05-04	Luna Group	Egypt	Manufacturing
2026-05-04	ROYAL M HOTEL BY GEWAN FUJAIRAH LLC	UAE	Hospitality