RaqibCTI — MENA Cyber Threat Intelligence

Threat actors

26 shown · UAE

Curated, citation-backed subset of the MENA Threat Actor Tracker — high and medium confidence only. Ransomware entries reflect a group's claimed victim, not a confirmed breach.

ALL APT RANSOMWARE FINANCIAL

Agrius (Agonizing Serpens / BlackShadow)

APT / State-sponsoredConfidence: highIsrael, UAE

Bahamut

APT / State-sponsoredConfidence: mediumEgypt, Iran, Palestine, Turkey, Tunisia, Saudi Arabia, Qatar, UAE

ransomwareblacknevas

BlackNevas

RansomwareConfidence: mediumSaudi Arabia, UAE

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

ransomwarebqtlock

BQTLock

RansomwareConfidence: mediumUAE, Israel, Saudi Arabia

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

ransomwarecactus

Cactus

RansomwareConfidence: mediumUAE

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

ransomwarecicada3301

Cicada3301

RansomwareConfidence: mediumJordan, Tunisia, UAE

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

ransomwaredarkvault

DarkVault

RansomwareConfidence: mediumIsrael, Saudi Arabia, UAE, Qatar, Oman

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

aptdesert-falcons

Desert Falcons (original 2015 cluster)

APT / State-sponsoredConfidence: highPalestine, Egypt, Israel, Jordan; secondary: Saudi Arabia, UAE, Morocco, Qatar

ransomwareeldorado

Eldorado

RansomwareConfidence: mediumJordan, Lebanon, UAE

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

ransomwareeverest

Everest

RansomwareConfidence: mediumUAE (and broader Gulf)

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

ransomwarehandala

Handala

RansomwareConfidence: mediumIsrael, UAE (secondary)

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

ransomwarehunters-international

Hunters International

RansomwareConfidence: mediumUAE, Tunisia

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

ransomwareincransom

IncRansom

RansomwareConfidence: mediumSaudi Arabia, UAE

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

ransomwarelockbit-lockbit-3-0

LockBit / LockBit 3.0

RansomwareConfidence: mediumUAE, Saudi Arabia, Kuwait, Qatar, Oman, Bahrain, Egypt

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

ransomwaremedusa

Medusa

RansomwareConfidence: mediumSaudi Arabia, UAE, Morocco

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

Meow

RansomwareConfidence: mediumOman, UAE

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

MuddyWater

APT / State-sponsoredConfidence: highUAE, Saudi Arabia, Israel, Turkey, Iraq, Jordan, Egypt

OilRig (APT34)

APT / State-sponsoredConfidence: highSaudi Arabia, UAE, Iraq, Jordan, Israel, Kuwait, Qatar

ransomwarepay2key

Pay2Key (Fox Kitten / Pioneer Kitten, Iran-linked)

RansomwareConfidence: mediumIsrael, UAE, Azerbaijan

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

ransomwareqilin

Qilin (fka Agenda)

RansomwareConfidence: mediumUAE, Egypt, Saudi Arabia

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

ransomwarerhysida

Rhysida

RansomwareConfidence: mediumKuwait, UAE

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

ransomwaresarcoma

Sarcoma

RansomwareConfidence: mediumSaudi Arabia, Oman, Kuwait, Qatar, UAE

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

aptscarred-manticore

Scarred Manticore (Storm-0861)

APT / State-sponsoredConfidence: highSaudi Arabia, UAE, Jordan, Kuwait, Oman, Iraq, Israel

SideWinder

APT / State-sponsoredConfidence: mediumEgypt (primary MENA focus, H2 2024), Djibouti, UAE

ransomwarestormous

Stormous

RansomwareConfidence: mediumEgypt, Saudi Arabia, Lebanon, Israel, Qatar, Turkey, UAE

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

ransomwarethe-gentlemen

The Gentlemen

RansomwareConfidence: mediumSaudi Arabia, UAE

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.