MENA leak-site postings from two public trackers, deduped. Every entry is a claim, not a confirmed breach — metadata only. A group name links to its actor profile when matched to a tracked actor, and correlated activity across sources shows up in Correlated Activity.
A ransomware “group” is a supply chain of roles, not one actor. Access flows in, the intrusion runs through, money goes out.
| Role | Stage | Does |
|---|---|---|
| Initial Access Broker | Access | Obtains and sells network access to other actors. |
| Affiliate | Intrusion | Runs the core intrusion — exec, privesc, lateral movement, deployment. |
| Operator | Intrusion | Supplies the ransomware infrastructure and encryptor (the RaaS brand). |
| Data Manager | Intrusion | Supplies exfil infrastructure; sorts and publishes stolen data. |
| Negotiator | Monetization | Handles ransom negotiation with the victim. |
| Chaser | Monetization | Pressures victims — threats of further attacks / leaks. |
| Accountant | Monetization | Launders the ransom payment. |
Extortion is a ladder of pressure beyond encryption:
Over-index = a group’s share of a MENA sector/country vs the leave-one-out share among all other groups’ MENA claims (lift ≥ 1.5, ≥ 3 supporting claims). Baseline is MENA-only (no global victim data); groups with < 5 claims are suppressed. Leak-site claims, not confirmed breaches — metadata only.
| Group | Over-indexes on | MENA share / baseline | Over-index | Sample | Confidence |
|---|
| CRPxOno actor profile | sector · Financial Services | 50%4% baseline | n=4 | low | |
| CRPxOno actor profile | country · Türkiye | 100%29% baseline | n=8 | low | |
| krybit ↗ | country · Egypt | 36%3% baseline | n=5 | moderate | |
| Deadlock ↗ | sector · Manufacturing | 60%16% baseline | n=3 | low | |
| Deadlock ↗ | country · Türkiye | 100%31% baseline | n=5 | low | |
| thegentlemen ↗ | country · Israel | 25%7% baseline | n=4 | moderate | |
| thegentlemen ↗ | country · Saudi Arabia | 19%6% baseline | n=3 | moderate | |
| thegentlemen ↗ | sector · Other | 30%14% baseline | n=3 | moderate | |
| nightspire ↗ | country · Türkiye | 67%32% baseline | n=4 | low | |
| qilin ↗ | sector · Manufacturing | 31%16% baseline | n=4 | moderate | |
| blacknevas ↗ | country · Türkiye | 57%33% baseline | n=4 | low |
24 groups too thin to profile (< 5 claims) · 1 group had no concentration signal (opportunistic).
| Date | Group | Victim | Country | Sector | Source |
|---|---|---|---|---|---|
| 2026-09-21new | qilin ↗ | Telrad Networks | IsraelIL | Technology | — |
| 2026-09-20new | qilin ↗ | Zorlu Holding | TürkiyeTR | Manufacturing | — |
| 2026-09-20new | krybit ↗prov | acilnet.com | TürkiyeTR | Technology | — |
| 2026-09-18new | N0n | PayPal support operations (Transcom WorldWide) | TunisiaTN | Business Services | — |
| 2026-09-18new | N0n | AstraZeneca Türkiye | TürkiyeTR | Healthcare | — |
| 2026-09-17 | krybit ↗prov | www.harputyapi.com | TürkiyeTR | — | — |
| 2026-09-15 | thegentlemen ↗ | Ardom Eilot | IsraelIL | — | — |
| 2026-09-14 | thegentlemen ↗ | Ardom Eilot | IsraelIL | — | — |
| 2026-09-13 | Barracuda | i2i-systems | TürkiyeTR | Technology | — |
| 2026-09-13 | krybit ↗prov | www.kashkha.com | UAEAE | — | — |
| 2026-09-12 | krybit ↗prov | www.ibnsinatrust.com | UAEAE | Healthcare | — |
| 2026-09-12 | krybit ↗prov | www.eac-airports.com | EgyptEG | — | — |
| 2026-09-12 | krybit ↗prov | intherpro.com | UAEAE | — | — |
| 2026-09-12 | medusalocker | Abourametals | UAEAE | Manufacturing | — |
| 2026-09-12 | krybit ↗prov | lasultanahotels.com | MoroccoMA | Hospitality | — |
| 2026-09-11 | nightspire ↗prov | Ozel & Ozel Laws Office | TürkiyeTR | — | — |
| 2026-09-11 | nightspire ↗prov | DiamondLease | UAEAE | — | — |
| 2026-09-11 | Dark Project | Cumar Marble & Granite | TürkiyeTR | Manufacturing | — |
| 2026-09-10 | lockbit5 ↗prov | alphaomega-eng.com | IsraelIL | — | — |
| 2026-09-08 | blacknevas ↗ | Mefa Group www.mefagroup.com.tr / MEFA Endüstri www.mefaendustri.com / and (Efachem, Eco... | TürkiyeTR | — | — |
| 2026-09-07 | thegentlemen ↗ | Nile Projects Trading | EgyptEG | Other | — |
| 2026-09-07 | thegentlemen ↗ | Yapı Merkezi | TürkiyeTR | Manufacturing | — |
| 2026-09-06 | Panzer | KHALED ALFAGIH ENGINEERING CONSULTANCY | Saudi ArabiaSA | Professional Services | — |
| 2026-09-02 | nightspire ↗prov | Ozel & Ozel Laws Office | TürkiyeTR | Professional Services | — |
| 2026-09-02 | qilin ↗ | Uak University | TürkiyeTR | Education | — |
| 2026-09-01 | krybit ↗prov | hccd-construction.com | EgyptEG | — | — |
| 2026-09-01 | krybit ↗prov | amptc.net | KuwaitKW | — | — |
| 2026-09-01 | krybit ↗prov | meccahighfeed.blogspot.com | Saudi ArabiaSA | Agriculture and Food Production | — |
| 2026-09-01 | krybit ↗prov | seashellhospital.com | EgyptEG | Healthcare services | — |
| 2026-08-31 | BrainCipher ↗ | ahadandco.com | UAEAE | Other | — |
| 2026-08-31 | thegentlemen ↗ | Saudi Consulting Services SAUD CONSULT | Saudi ArabiaSA | Professional Services | — |
| 2026-08-30 | nightspire ↗prov | DiamondLease | UAEAE | Other | — |
| 2026-08-30 | direwolf ↗ | Erdem Hospital | TürkiyeTR | Healthcare | — |
| 2026-08-30 | qilin ↗ | Black Cat Engineering Construction Wll | QatarQA | Manufacturing | — |
| 2026-08-28 | Doommageddon ↗prov | Akpera Gayrimenkul Yatırım A.Ş. | TürkiyeTR | Other | — |
| 2026-08-28 | Doommageddon ↗prov | SITTNAK Lojistik A.Ş. | TürkiyeTR | Transportation | — |
| 2026-08-27 | lockbit5 ↗prov | tnmed.org | TunisiaTN | Healthcare | — |
| 2026-08-26 | krybit ↗prov | mimafoods.net | EgyptEG | — | — |
| 2026-08-25 | blacknevas ↗ | Mefa Group www.mefagroup.com.tr / MEFA Endüstri www.mefaendustri.com / and (Efachem, Eco... | TürkiyeTR | Manufacturing | — |
| 2026-08-24 | dragonforce ↗ | Wozair | UAEAE | Other | — |
| 2026-08-24 | qilin ↗ | A&E + SMA Design | UAEAE | Professional Services | — |
| 2026-08-23 | qilin ↗ | Black Cat Engineering & Construction WLL | QatarQA | Manufacturing | — |
| 2026-08-22 | thegentlemen ↗ | Meridian Logistics Group | Saudi ArabiaSA | — | — |
| 2026-08-22 | shinyhunters | NovoCure Limited | IsraelIL | Healthcare | — |
| 2026-08-22 | nasirsecurity | Kuwait Ministry Of Interior ! | KuwaitKW | — | — |
| 2026-08-22 | nasirsecurity | Dubai Airport - ed | UAEAE | — | — |
| 2026-08-22 | nasirsecurity | Yad Vashem Museum ! | IsraelIL | — | — |
| 2026-08-22 | nasirsecurity | UAE Customs (Federal Customs Authority) - ACCESS GRANTED ! | UAEAE | — | — |
| 2026-08-21 | thegentlemen ↗ | Almeer | UAEAE | Other | — |
| 2026-08-21 | direwolf ↗ | iSON XPERIENCES | UAEAE | Business Services | — |
| 2026-08-21 | direwolf ↗ | MCT Group of Companies | UAEAE | Other | — |
| 2026-08-21 | thegentlemen ↗ | AWJ Holding | UAEAE | — | — |
| 2026-08-19 | Deadlock ↗prov | Global Terminal Services | TürkiyeTR | Transportation | — |
| 2026-08-18 | incransom ↗ | nyklawfirm.com nyk.ae | UAEAE | Professional Services | — |
| 2026-08-15 | blackwater | www.shalina.com | UAEAE | — | — |
| 2026-08-14 | thegentlemen ↗ | Avanta Maroc Ex Adecco | MoroccoMA | Professional Services | — |
| 2026-08-13 | payload ↗prov | Zara Investment Holding | JordanJO | Financial Services | — |
| 2026-08-12 | nightspire ↗prov | Tianji Auto Care Service Company | TürkiyeTR | — | — |
| 2026-08-10 | thegentlemen ↗ | AIMS Group | UAEAE | — | — |
| 2026-08-07 | blacknevas ↗ | OTEGROUP | OmanOM | — | — |
| 2026-08-06 | qilin ↗ | Akuur Law Firm | TürkiyeTR | Professional Services | — |
| 2026-08-05 | nightspire ↗prov | Tianji Auto Care Service Company | TürkiyeTR | Transportation | — |
| 2026-08-05 | everest ↗ | Al-Futtaim Group | UAEAE | — | — |
| 2026-08-03 | safepay | hanan-hov.co.il | IsraelIL | Other | — |
| 2026-08-01 | Gammax | MTCO (Mahmoud Altaheni & Partners Trading Co) | Saudi ArabiaSA | Professional Services | — |
| 2026-08-01 | shinyhunters | Lumenis Ltd. | IsraelIL | Technology | — |
| 2026-08-01 | blacknevas ↗ | OTEGROUP | OmanOM | Other | — |
| 2026-07-31 | CRPxO | ANADOLUBANK | TürkiyeTR | Financial Services | — |
| 2026-07-31 | CRPxO | A101 | TürkiyeTR | Retail & E-Commerce | — |
| 2026-07-31 | thegentlemen ↗ | Salem Saleh Babgi | Saudi ArabiaSA | — | — |
| 2026-07-31 | CRPxO | KUVEYT TURK | TürkiyeTR | Financial Services | — |
| 2026-07-31 | thegentlemen ↗ | Efrata College of Education | IsraelIL | Education | — |
| 2026-07-31 | CRPxO | THY | TürkiyeTR | Transportation | — |
| 2026-07-31 | CRPxO | ASELSAN | TürkiyeTR | Government & Defense | — |
| 2026-07-31 | CRPxO | DOĞAN HOLDİNG | TürkiyeTR | Other | — |
| 2026-07-31 | CRPxO | FINANSBANK | TürkiyeTR | Financial Services | — |
| 2026-07-31 | CRPxO | ANADOLU SİGORTA | TürkiyeTR | Financial Services | — |
| 2026-07-31 | thegentlemen ↗ | Amicell | IsraelIL | Healthcare | — |
| 2026-07-30 | qilin ↗ | Db Tarimsal Enerji | TürkiyeTR | Agriculture and Food Production | — |
| 2026-07-29 | incransom ↗ | harwal.net | UAEAE | — | — |