◇ SIGN IN

Threat actors

8 shown · Qatar

Curated, citation-backed subset of the MENA Threat Actor Tracker — high and medium confidence only. Ransomware entries reflect a group's claimed victim, not a confirmed breach.

ALLAPTRANSOMWAREFINANCIAL
aptbahamut

Bahamut

APT / State-sponsoredConfidence: mediumEgypt, Iran, Palestine, Turkey, Tunisia, Saudi Arabia, Qatar, UAE
medium
ransomwaredarkvault

DarkVault

RansomwareConfidence: mediumIsrael, Saudi Arabia, UAE, Qatar, Oman

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

medium
aptdesert-falcons

Desert Falcons (original 2015 cluster)

APT / State-sponsoredConfidence: highPalestine, Egypt, Israel, Jordan; secondary: Saudi Arabia, UAE, Morocco, Qatar
high
ransomwareghostsec-ghostlocker

GhostSec / GhostLocker

RansomwareConfidence: mediumLebanon, Israel, Egypt, Qatar, Turkey, Morocco

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

medium
ransomwarelockbit-lockbit-3-0

LockBit / LockBit 3.0

RansomwareConfidence: mediumUAE, Saudi Arabia, Kuwait, Qatar, Oman, Bahrain, Egypt

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

medium
aptoilrig

OilRig (APT34)

APT / State-sponsoredConfidence: highSaudi Arabia, UAE, Iraq, Jordan, Israel, Kuwait, Qatar
high
ransomwaresarcoma

Sarcoma

RansomwareConfidence: mediumSaudi Arabia, Oman, Kuwait, Qatar, UAE

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

medium
ransomwarestormous

Stormous

RansomwareConfidence: mediumEgypt, Saudi Arabia, Lebanon, Israel, Qatar, Turkey, UAE

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

medium