RaqibCTI ransomware
payload
ProvisionalRansomware
Attribution confidence
Provisional — not yet assessed
Corpus activity · 6mo7 mentions
AMJJAS
Provisional profile auto-created from leak-site claims — not analyst-vetted. A group's self-claim of a victim, not a confirmed breach.
Why it mattersRansomware actor, unrated confidence.
What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.
Associated with
Related to
- ←payload · AmateracampaignCorrelated cluster2026-09-21
- ←payload · XMRigcampaignCorrelated cluster2026-09-03
- ←payload · XMRigcampaignCorrelated cluster2026-08-26
Targets
- →Zara Investment HoldingtargetLeak-site claim · ransomware.live2026-08-13
- →Software ArgetargetLeak-site claim · ransomware.live2026-06-26
- →Al Sulaiti Law FirmtargetLeak-site claim · ransomware.live2026-04-20
- →orientalweavers.comtargetLeak-site claim · ransomware.live2026-04-16
- →
Claimed victims · 10 tracked
Leak-site postings via ransomware.live — claimed by the group, not confirmed breaches. Metadata only. MENA Ransomware Watch →
Claim volume · last 12 months
ONDJFMAMJJAS
| Date | Victim | Country | Sector |
|---|
| 2026-08-13 | Zara Investment Holding | Jordan | Financial Services |
| 2026-06-26 | Software Arge | Türkiye | Technology |
| 2026-04-20 | Al Sulaiti Law Firm | Qatar | Professional Services |
|
El Wastani Petroleum Company (WASCO)target
Leak-site claim · ransomware.live2026-04-08
→United Finance EgypttargetLeak-site claim · ransomware.live2026-04-03→SAYEGHtargetLeak-site claim · ransomware.live2026-04-01→A A Al Moosa Enterprises (ARENCO Group)targetLeak-site claim · ransomware.live2026-03-28→Royal Bahrain HospitaltargetLeak-site claim · ransomware.live2026-03-15→sodic.comtargetLeak-site claim · ransomware.live2026-02-17| 2026-04-08 | El Wastani Petroleum Company (WASCO) | Libya | Energy & Utilities |
| 2026-04-03 | United Finance Egypt | Egypt | Financial Services |
| 2026-04-01 | SAYEGH | Lebanon | Education |
| 2026-03-28 | A A Al Moosa Enterprises (ARENCO Group) | UAE | Professional Services |
| 2026-03-15 | Royal Bahrain Hospital | Bahrain | Healthcare |
| 2026-02-17 | sodic.com | Egypt | Manufacturing |
Suggested · co-occurring (unverified)
These entities are frequently mentioned together in source material; co-occurrence is not a verified relationship.
- TechniqueT1105co-mentioned in 3 items
- SectorGovernmentco-mentioned in 2 items
- TechniqueT1574.002co-mentioned in 2 items
- TechniqueT1027co-mentioned in 2 items
- MalwarePAYLOADco-mentioned in 1 item
- TechniqueT1078co-mentioned in 1 item
- TechniqueT1133co-mentioned in 1 item
- TechniqueT1562.004co-mentioned in 1 item
- SectorManufacturingco-mentioned in 1 item
- Sectorgamingco-mentioned in 1 item
- MalwareInsomnia RATco-mentioned in 1 item
- SectorCritical Infrastructureco-mentioned in 1 item
- MalwareSocks5Systemzco-mentioned in 1 item
- TechniqueT1566co-mentioned in 1 item
- MalwareARKTunnelco-mentioned in 1 item
- MalwareGCleanerco-mentioned in 1 item
- MalwareDocro Hijackerco-mentioned in 1 item
- SectorCorporateco-mentioned in 1 item
- MalwareZigCryptoStealerco-mentioned in 1 item
- TechniqueT1089.005co-mentioned in 1 item
- MalwareAmateraco-mentioned in 1 item
- MalwareNetSupport Managerco-mentioned in 1 item
- CountryUkraineco-mentioned in 1 item
- TechniqueT1218.011co-mentioned in 1 item
- TechniqueT1059.001co-mentioned in 1 item
- TechniqueT1059.007co-mentioned in 1 item
- CountryIndiaco-mentioned in 1 item
- TechniqueT1548.002co-mentioned in 1 item
- CountryChinaco-mentioned in 1 item
- TechniqueT1082co-mentioned in 1 item