◇ SIGN IN

Threat actors

20 shown · Israel

Curated, citation-backed subset of the MENA Threat Actor Tracker — high and medium confidence only. Ransomware entries reflect a group's claimed victim, not a confirmed breach.

ALLAPTRANSOMWAREFINANCIAL
aptagrius

Agrius (Agonizing Serpens / BlackShadow)

APT / State-sponsoredConfidence: highIsrael, UAE
high
aptarid-viper

Arid Viper (APT-C-23 / Desert Falcon)

APT / State-sponsoredConfidence: highPalestine, Egypt, Israel
high
aptballistic-bobcat

Ballistic Bobcat

APT / State-sponsoredConfidence: highIsrael (primary), broader Middle East
high
aptbellaciao-operators

BellaCiao operators (Charming Kitten-linked)

APT / State-sponsoredConfidence: mediumIsrael, Turkey (MENA subset of a wider campaign; source also lists Austria, India, Italy, and US/Europe victims)
medium
ransomwarebqtlock

BQTLock

RansomwareConfidence: mediumUAE, Israel, Saudi Arabia

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

medium
aptcavern-manticore

Cavern Manticore

APT / State-sponsoredConfidence: highIsrael
high
aptcharming-kitten-apt42

Charming Kitten / APT42

APT / State-sponsoredConfidence: highIsrael, Gulf states, broader Middle East
high
ransomwaredarkvault

DarkVault

RansomwareConfidence: mediumIsrael, Saudi Arabia, UAE, Qatar, Oman

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

medium
aptdesert-falcons

Desert Falcons (original 2015 cluster)

APT / State-sponsoredConfidence: highPalestine, Egypt, Israel, Jordan; secondary: Saudi Arabia, UAE, Morocco, Qatar
high
aptgaza-cybergang-molerats

Gaza Cybergang / Molerats

APT / State-sponsoredConfidence: highPalestinian Territories, Jordan, Israel, Lebanon, Egypt
high
ransomwareghostsec-ghostlocker

GhostSec / GhostLocker

RansomwareConfidence: mediumLebanon, Israel, Egypt, Qatar, Turkey, Morocco

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

medium
ransomwarehandala

Handala

RansomwareConfidence: mediumIsrael, UAE (secondary)

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

medium
apthexane

HEXANE (Lyceum)

APT / State-sponsoredConfidence: mediumIsrael, Saudi Arabia, Kuwait, Morocco, Tunisia
medium
aptimperial-kitten

Imperial Kitten (CURIUM)

APT / State-sponsoredConfidence: highIsrael (primary), broader Middle East tech sector
high
aptmuddywater

MuddyWater

APT / State-sponsoredConfidence: highUAE, Saudi Arabia, Israel, Turkey, Iraq, Jordan, Egypt
high
aptoilrig

OilRig (APT34)

APT / State-sponsoredConfidence: highSaudi Arabia, UAE, Iraq, Jordan, Israel, Kuwait, Qatar
high
ransomwarepay2key

Pay2Key (Fox Kitten / Pioneer Kitten, Iran-linked)

RansomwareConfidence: mediumIsrael, UAE, Azerbaijan

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

medium
aptscarred-manticore

Scarred Manticore (Storm-0861)

APT / State-sponsoredConfidence: highSaudi Arabia, UAE, Jordan, Kuwait, Oman, Iraq, Israel
high
ransomwarestormous

Stormous

RansomwareConfidence: mediumEgypt, Saudi Arabia, Lebanon, Israel, Qatar, Turkey, UAE

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

medium
aptvoid-manticore

Void Manticore (Storm-0842)

APT / State-sponsoredConfidence: highIsrael
high