RaqibCTI ⌘K
payload · Ransomware · RaqibCTI
Knowledge / Actors / payload Corpus ransomware
payload Provisional Ransomware
Attribution confidence
Provisional — not yet assessed
Corpus activity · 6mo 7 mentions
Aug 2026: 2 Sep 2026: 5 A M J J A S
Provisional profile auto-created from leak-site claims — not analyst-vetted. A group's self-claim of a victim, not a confirmed breach.
Why it matters Ransomware actor, unrated confidence.
What's next No pipeline reports reference this actor yet — Radar mentions may still surface early signal.
Associated with
Related to
← payload · Amatera campaign Correlated cluster 2026-09-21 ← payload · XMRig campaign Correlated cluster 2026-09-03 ← payload · XMRig campaign Correlated cluster 2026-08-26 Targets
→ Zara Investment Holding target Leak-site claim · ransomware.live 2026-08-13 → Software Arge target Leak-site claim · ransomware.live 2026-06-26 → Al Sulaiti Law Firm target Leak-site claim · ransomware.live 2026-04-20 → orientalweavers.com target Leak-site claim · ransomware.live 2026-04-16 →
History History profile is being researched
Will appear here shortly. Tracker note: payload is a ransomware group auto-tracked from public leak-site victim claims. This is a provisional, lightweight profile created because the group cleared an activity threshold — it has not been analyst-vetted and makes no attribution claim.
El Wastani Petroleum Company (WASCO) target
Leak-site claim · ransomware.live 2026-04-08
→ United Finance Egypt target Leak-site claim · ransomware.live 2026-04-03
→ SAYEGH target Leak-site claim · ransomware.live 2026-04-01
→ A A Al Moosa Enterprises (ARENCO Group) target Leak-site claim · ransomware.live 2026-03-28
→ Royal Bahrain Hospital target Leak-site claim · ransomware.live 2026-03-15
→ sodic.com target Leak-site claim · ransomware.live 2026-02-17
Suggested · co-occurring (unverified)
These entities are frequently mentioned together in source material; co-occurrence is not a verified relationship.
Technique T1105 co-mentioned in 3 items Sector Government co-mentioned in 2 items Technique T1574.002 co-mentioned in 2 items Technique T1027 co-mentioned in 2 items Malware PAYLOAD co-mentioned in 1 item Technique T1078 co-mentioned in 1 item Technique T1133 co-mentioned in 1 item Technique T1562.004 co-mentioned in 1 item Sector Manufacturing co-mentioned in 1 item Sector gaming co-mentioned in 1 item Malware Insomnia RAT co-mentioned in 1 item Sector Critical Infrastructure co-mentioned in 1 item Malware Socks5Systemz co-mentioned in 1 item Technique T1566 co-mentioned in 1 item Malware ARKTunnel co-mentioned in 1 item Malware GCleaner co-mentioned in 1 item Malware Docro Hijacker co-mentioned in 1 item Sector Corporate co-mentioned in 1 item Malware ZigCryptoStealer co-mentioned in 1 item Technique T1089.005 co-mentioned in 1 item Malware Amatera co-mentioned in 1 item Malware NetSupport Manager co-mentioned in 1 item Country Ukraine co-mentioned in 1 item Technique T1218.011 co-mentioned in 1 item Technique T1059.001 co-mentioned in 1 item Technique T1059.007 co-mentioned in 1 item Country India co-mentioned in 1 item Technique T1548.002 co-mentioned in 1 item Country China co-mentioned in 1 item Technique T1082 co-mentioned in 1 item