UAE Cyber Threat Intelligence
Marsad Cyber tracks ransomware activity against organisations in the United Arab Emirates. Ransomware groups have claimed 112 UAE organisations since 2020, 31 of them in 2026, across 13 sectors and 47 distinct groups. Affected organisations are never named on this site.
Data as of , drawn from 192 leak-site claims collected by ransomware.live. How this data is collected and filtered.
| Name | Relative volume | Incidents | Share |
|---|---|---|---|
| Professional Services | 24 | 21.4% | |
| Government and Defense | 13 | 11.6% | |
| Technology | 13 | 11.6% | |
| Financial Services | 12 | 10.7% | |
| Retail and E-Commerce | 10 | 8.9% | |
| Manufacturing | 8 | 7.1% | |
| Transportation | 7 | 6.3% | |
| Healthcare | 6 | 5.4% | |
| Total (all rows) | 112 | 100% |
Showing the top 8 of 112 total.
| Name | Relative volume | Incidents | Share |
|---|---|---|---|
| LockBit 3.0 | 10 | 8.9% | |
| Stormous | 10 | 8.9% | |
| Everest | 9 | 8% | |
| Coinbase Cartel | 6 | 5.4% | |
| DragonForce | 5 | 4.5% | |
| INC Ransom | 5 | 4.5% | |
| Medusa | 5 | 4.5% | |
| RansomHub | 5 | 4.5% | |
| Total (all rows) | 112 | 100% |
Showing the top 8 of 112 total.
Activity by period
Full timelineLatest reports
A Ninth Group Enters the UAE Financial Services Record
Black Nevas Reaches UAE Education a Year After Manufacturing
Everest Returns to UAE Transportation After Twelve Months
INC Ransom Reaches a Fifth UAE Sector With Five Claims
Four in Ten Claims Tagged UAE Carry No UAE Evidence
APT73 Claims Two UAE Organisations on a Single Day
Regulation guides
Latest activity
Marsad is the Arabic word for observatory, and that is what this is: an observation post on ransomware activity against organisations in the United Arab Emirates.
Regional figures on cyber incidents are usually quoted without a source, a date or a method, and rarely separate an attacker's claim from a confirmed breach. This project publishes a narrow set of numbers with all three attached, and publishes the filtering rules alongside them so that any figure here can be argued with.
01
Every figure traces to a snapshot
Numbers come from dated snapshots held in version control. Nothing on this site is estimated, rounded for effect or written by hand.
02
The filter is published
The upstream feed returned 192 records tagged for the UAE. Only 112 carry a verifiable UAE link, and only those reach the figures above.
03
No affected organisation is named
This site never identifies a victim, republishes leaked material or hosts a leak-site address. That rule is enforced in the build, not in the style guide.
Where to look next
How the data is collected and filtered, where it comes from, and the rules governing what this site will and will not publish. Questions and corrections go through the contact page.