◇ SIGN IN

Threat actors

14 shown · Egypt

Curated, citation-backed subset of the MENA Threat Actor Tracker — high and medium confidence only. Ransomware entries reflect a group's claimed victim, not a confirmed breach.

ALLAPTRANSOMWAREFINANCIAL
ransomwarealphv-blackcat

ALPHV / BlackCat

RansomwareConfidence: mediumEgypt, Saudi Arabia

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

medium
aptarid-viper

Arid Viper (APT-C-23 / Desert Falcon)

APT / State-sponsoredConfidence: highPalestine, Egypt, Israel
high
aptbahamut

Bahamut

APT / State-sponsoredConfidence: mediumEgypt, Iran, Palestine, Turkey, Tunisia, Saudi Arabia, Qatar, UAE
medium
aptdesert-falcons

Desert Falcons (original 2015 cluster)

APT / State-sponsoredConfidence: highPalestine, Egypt, Israel, Jordan; secondary: Saudi Arabia, UAE, Morocco, Qatar
high
ransomwarefunksec

FunkSec

RansomwareConfidence: mediumEgypt

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

medium
aptgaza-cybergang-molerats

Gaza Cybergang / Molerats

APT / State-sponsoredConfidence: highPalestinian Territories, Jordan, Israel, Lebanon, Egypt
high
ransomwareghostsec-ghostlocker

GhostSec / GhostLocker

RansomwareConfidence: mediumLebanon, Israel, Egypt, Qatar, Turkey, Morocco

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

medium
ransomwarelockbit-lockbit-3-0

LockBit / LockBit 3.0

RansomwareConfidence: mediumUAE, Saudi Arabia, Kuwait, Qatar, Oman, Bahrain, Egypt

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

medium
ransomwaremoney-message

Money Message

RansomwareConfidence: mediumEgypt

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

medium
aptmuddywater

MuddyWater

APT / State-sponsoredConfidence: highUAE, Saudi Arabia, Israel, Turkey, Iraq, Jordan, Egypt
high
ransomwareqilin

Qilin (fka Agenda)

RansomwareConfidence: mediumUAE, Egypt, Saudi Arabia

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

medium
aptsea-turtle

Sea Turtle

APT / State-sponsoredConfidence: highTurkey, Iran, Egypt, Cyprus, Greece, broader MENA
high
ransomwarestormous

Stormous

RansomwareConfidence: mediumEgypt, Saudi Arabia, Lebanon, Israel, Qatar, Turkey, UAE

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

medium
aptwirte

WIRTE

APT / State-sponsoredConfidence: mediumPalestinian Authority, Jordan, Iraq, Egypt, Saudi Arabia (per Check Point's specific victim list); Lebanon, Syria, Turkey, Armenia, Cyprus (per Securelist's broader campaign list)
medium