◇ SIGN IN

Threat actors

26 shown

Curated, citation-backed subset of the MENA Threat Actor Tracker — high and medium confidence only. Ransomware entries reflect a group's claimed victim, not a confirmed breach.

ransomwarealphv-blackcat

ALPHV / BlackCat

RansomwareConfidence: mediumEgypt, Saudi Arabia

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

medium
ransomwarebianlian

BianLian

RansomwareConfidence: mediumBahrain

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

medium
ransomwareblacknevas

BlackNevas

RansomwareConfidence: mediumSaudi Arabia, UAE

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

medium
ransomwarebqtlock

BQTLock

RansomwareConfidence: mediumUAE, Israel, Saudi Arabia

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

medium
ransomwarecactus

Cactus

RansomwareConfidence: mediumUAE

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

medium
ransomwarecicada3301

Cicada3301

RansomwareConfidence: mediumJordan, Tunisia, UAE

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

medium
ransomwaredarkvault

DarkVault

RansomwareConfidence: mediumIsrael, Saudi Arabia, UAE, Qatar, Oman

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

medium
ransomwaredragonforce

DragonForce

RansomwareConfidence: mediumSaudi Arabia

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

medium
ransomwareeldorado

Eldorado

RansomwareConfidence: mediumJordan, Lebanon, UAE

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

medium
ransomwareeverest

Everest

RansomwareConfidence: mediumUAE (and broader Gulf)

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

medium
ransomwarefunksec

FunkSec

RansomwareConfidence: mediumEgypt

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

medium
ransomwareghostsec-ghostlocker

GhostSec / GhostLocker

RansomwareConfidence: mediumLebanon, Israel, Egypt, Qatar, Turkey, Morocco

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

medium
ransomwarehandala

Handala

RansomwareConfidence: mediumIsrael, UAE (secondary)

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

medium
ransomwarehunters-international

Hunters International

RansomwareConfidence: mediumUAE, Tunisia

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

medium
ransomwareincransom

IncRansom

RansomwareConfidence: mediumSaudi Arabia, UAE

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

medium
ransomwarelockbit-lockbit-3-0

LockBit / LockBit 3.0

RansomwareConfidence: mediumUAE, Saudi Arabia, Kuwait, Qatar, Oman, Bahrain, Egypt

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

medium
ransomwaremedusa

Medusa

RansomwareConfidence: mediumSaudi Arabia, UAE, Morocco

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

medium
ransomwaremeow

Meow

RansomwareConfidence: mediumOman, UAE

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

medium
ransomwaremoney-message

Money Message

RansomwareConfidence: mediumEgypt

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

medium
ransomwarepay2key

Pay2Key (Fox Kitten / Pioneer Kitten, Iran-linked)

RansomwareConfidence: mediumIsrael, UAE, Azerbaijan

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

medium
ransomwareqilin

Qilin (fka Agenda)

RansomwareConfidence: mediumUAE, Egypt, Saudi Arabia

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

medium
ransomwarerhysida

Rhysida

RansomwareConfidence: mediumKuwait, UAE

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

medium
ransomwaresarcoma

Sarcoma

RansomwareConfidence: mediumSaudi Arabia, Oman, Kuwait, Qatar, UAE

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

medium
ransomwarestormous

Stormous

RansomwareConfidence: mediumEgypt, Saudi Arabia, Lebanon, Israel, Qatar, Turkey, UAE

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

medium
ransomwarethe-gentlemen

The Gentlemen

RansomwareConfidence: mediumSaudi Arabia, UAE

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

medium
ransomwaretrigona

Trigona

RansomwareConfidence: mediumOman

Sourced from leak-site trackers — reflects the group's claim of a victim, not a confirmed breach.

medium