◦ PUBLISHED SNAPSHOT

MENA Monthly Report — August 2026

Published snapshot · generated Aug 31, 2026 · 23:59 UTC · completed month

Point-in-time record of the MENA Monthly Report for 2026-08; later intelligence is not reflected — see the live monthly report.
Download Markdown
36
Ransomware claims
▼7 vs last mo (43)
0
MENA-relevant KEV CVEs
tally · no delta
0
New MENA-relevant KEV
▼9 vs last mo (9)
0
New activity groups
none last mo
89
Newly observed
▲85 vs last mo (4)
12
Technique spikes
12-wk momentum · no delta

A deterministic, month-anchored executive digest of the MENA corpus — month totals with a same-span-vs-last-month delta, then a curated top-N by each surface’s own fixed rank. No item is a model-chosen "top threat." First-seen ≠ globally new; claims ≠ breaches; KEV/OSINT ≠ confirmed in-region exploitation; correlation ≠ attribution.

What mattered4

A curated top-4 by each surface’s own deterministic rank — not exhaustive. Every line links to the surface that owns the record.

36 ransomware leak-site claims against MENA organisations▼7 vs last month (43) · most-claimed sector: Other (7 of 36). Leak-site claims, not confirmed breaches; over-indexing is a 90-day lens, not attribution.
CLAIMS
→
T1105 reporting momentum (12-week lens)11 mentions in the recent 4-week half vs 6 in the prior 4 weeks · z=2.12 over a 12-week baseline. 12-week technique momentum (z-score), not a month delta — a spike in reporting volume, not confirmed targeting.
SIGNAL
↗
New actor "payload" first observed in MENA collection2 mentions this month. First appearance in our MENA collection this month — new to Radar, not necessarily new to the world.
ACTOR
→
53 new C2 endpoints, 30 malware families first observed in our MENA collection▲85 vs last month (4) across all first-observation buckets. First appearance in our MENA collection this month — new to Radar, not necessarily new to the world.
EMERGING
→

Have an intelligence requirement this digest should answer? Track a requirement in your workspace →

Aggregates the Emerging, Exploited-in-MENA, Ransomware, Campaigns, KEV and Signals surfaces over the UTC calendar month (first_seen / last_mentioned / claimed_at / date_added / to_at). Deterministic spine: every count, delta and ranked item is a fixed function of the corpus — no model in the data path. A month-to-date read compares the same elapsed span of the prior month (an apples-to-apples pace comparison); a completed month compares the full prior month.