RaqibCTI — MENA Cyber Threat Intelligence

Threat actors

25 shown

Curated, citation-backed subset of the MENA Threat Actor Tracker — high and medium confidence only. Ransomware entries reflect a group's claimed victim, not a confirmed breach.

ALL APT RANSOMWARE FINANCIAL

Agrius (Agonizing Serpens / BlackShadow)

APT / State-sponsoredConfidence: highIsrael, UAE

APT33

APT / State-sponsoredConfidence: highSaudi Arabia (primary), broader Gulf

Arid Viper (APT-C-23 / Desert Falcon)

APT / State-sponsoredConfidence: highPalestine, Egypt, Israel

Bahamut

APT / State-sponsoredConfidence: mediumEgypt, Iran, Palestine, Turkey, Tunisia, Saudi Arabia, Qatar, UAE

aptballistic-bobcat

Ballistic Bobcat

APT / State-sponsoredConfidence: highIsrael (primary), broader Middle East

aptbellaciao-operators

BellaCiao operators (Charming Kitten-linked)

APT / State-sponsoredConfidence: mediumIsrael, Turkey (MENA subset of a wider campaign; source also lists Austria, India, Italy, and US/Europe victims)

aptcavern-manticore

Cavern Manticore

APT / State-sponsoredConfidence: highIsrael

aptcharming-kitten-apt42

Charming Kitten / APT42

APT / State-sponsoredConfidence: highIsrael, Gulf states, broader Middle East

aptdark-caracal

Dark Caracal

APT / State-sponsoredConfidence: mediumLebanon (origin); global victims in 20+ countries incl. MENA

aptdesert-falcons

Desert Falcons (original 2015 cluster)

APT / State-sponsoredConfidence: highPalestine, Egypt, Israel, Jordan; secondary: Saudi Arabia, UAE, Morocco, Qatar

aptgaza-cybergang-molerats

Gaza Cybergang / Molerats

APT / State-sponsoredConfidence: highPalestinian Territories, Jordan, Israel, Lebanon, Egypt

HEXANE (Lyceum)

APT / State-sponsoredConfidence: mediumIsrael, Saudi Arabia, Kuwait, Morocco, Tunisia

aptimperial-kitten

Imperial Kitten (CURIUM)

APT / State-sponsoredConfidence: highIsrael (primary), broader Middle East tech sector

MuddyWater

APT / State-sponsoredConfidence: highUAE, Saudi Arabia, Israel, Turkey, Iraq, Jordan, Egypt

OilAlpha

APT / State-sponsoredConfidence: mediumYemen, broader Arabian Peninsula

OilRig (APT34)

APT / State-sponsoredConfidence: highSaudi Arabia, UAE, Iraq, Jordan, Israel, Kuwait, Qatar

aptpredatory-sparrow

Predatory Sparrow

APT / State-sponsoredConfidence: mediumIran

aptscarred-manticore

Scarred Manticore (Storm-0861)

APT / State-sponsoredConfidence: highSaudi Arabia, UAE, Jordan, Kuwait, Oman, Iraq, Israel

Sea Turtle

APT / State-sponsoredConfidence: highTurkey, Iran, Egypt, Cyprus, Greece, broader MENA

SideWinder

APT / State-sponsoredConfidence: mediumEgypt (primary MENA focus, H2 2024), Djibouti, UAE

StrongPity (PROMETHIUM)

APT / State-sponsoredConfidence: mediumSyria, Turkey (Kurdish-population-focused)

aptta402-molerats

TA402 / Molerats (2021–2023 activity)

APT / State-sponsoredConfidence: highMiddle East governments (Palestine-focused interests)

apttropic-trooper

Tropic Trooper

APT / State-sponsoredConfidence: highMiddle East (unnamed governmental entity focused on human rights studies)

aptvoid-manticore

Void Manticore (Storm-0842)

APT / State-sponsoredConfidence: highIsrael

WIRTE

APT / State-sponsoredConfidence: mediumPalestinian Authority, Jordan, Iraq, Egypt, Saudi Arabia (per Check Point's specific victim list); Lebanon, Syria, Turkey, Armenia, Cyprus (per Securelist's broader campaign list)