RaqibCTI — MENA Cyber Threat Intelligence

Threat actors

18 shown · Saudi Arabia

Curated, citation-backed subset of the MENA Threat Actor Tracker — high and medium confidence only. Ransomware entries reflect a group's claimed victim, not a confirmed breach.

ALL APT RANSOMWARE FINANCIAL

ransomwarealphv-blackcat

ALPHV / BlackCat

RansomwareConfidence: mediumEgypt, Saudi Arabia

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

APT33

APT / State-sponsoredConfidence: highSaudi Arabia (primary), broader Gulf

Bahamut

APT / State-sponsoredConfidence: mediumEgypt, Iran, Palestine, Turkey, Tunisia, Saudi Arabia, Qatar, UAE

ransomwareblacknevas

BlackNevas

RansomwareConfidence: mediumSaudi Arabia, UAE

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

ransomwarebqtlock

BQTLock

RansomwareConfidence: mediumUAE, Israel, Saudi Arabia

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

ransomwaredarkvault

DarkVault

RansomwareConfidence: mediumIsrael, Saudi Arabia, UAE, Qatar, Oman

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

ransomwaredragonforce

DragonForce

RansomwareConfidence: mediumSaudi Arabia

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

HEXANE (Lyceum)

APT / State-sponsoredConfidence: mediumIsrael, Saudi Arabia, Kuwait, Morocco, Tunisia

ransomwareincransom

IncRansom

RansomwareConfidence: mediumSaudi Arabia, UAE

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

ransomwarelockbit-lockbit-3-0

LockBit / LockBit 3.0

RansomwareConfidence: mediumUAE, Saudi Arabia, Kuwait, Qatar, Oman, Bahrain, Egypt

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

ransomwaremedusa

Medusa

RansomwareConfidence: mediumSaudi Arabia, UAE, Morocco

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

MuddyWater

APT / State-sponsoredConfidence: highUAE, Saudi Arabia, Israel, Turkey, Iraq, Jordan, Egypt

OilRig (APT34)

APT / State-sponsoredConfidence: highSaudi Arabia, UAE, Iraq, Jordan, Israel, Kuwait, Qatar

ransomwareqilin

Qilin (fka Agenda)

RansomwareConfidence: mediumUAE, Egypt, Saudi Arabia

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

ransomwaresarcoma

Sarcoma

RansomwareConfidence: mediumSaudi Arabia, Oman, Kuwait, Qatar, UAE

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

aptscarred-manticore

Scarred Manticore (Storm-0861)

APT / State-sponsoredConfidence: highSaudi Arabia, UAE, Jordan, Kuwait, Oman, Iraq, Israel

ransomwarestormous

Stormous

RansomwareConfidence: mediumEgypt, Saudi Arabia, Lebanon, Israel, Qatar, Turkey, UAE

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

ransomwarethe-gentlemen

The Gentlemen

RansomwareConfidence: mediumSaudi Arabia, UAE

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.