APT73 Claims Two UAE Organisations on a Single Day
APT73 is the only group on this tracker whose entire UAE record falls on one date. Both claims landed on 27 April 2026, and both sectors it touched sit inside the heaviest regulatory scope in the country.
What happened
APT73 published both of its UAE claims on 27 April 2026. The group has no other record against a UAE organisation in this dataset, in any period.
It is the only group on this tracker whose entire record falls on a single date. Two entries published together point to one publication event rather than to sustained activity.
Who is affected in the UAE
Government and Defense and Energy and Utilities account for 1 claim each.
Both sectors sit inside the heaviest regulatory scope in the United Arab Emirates. Energy and Utilities holds 4 claims in total on this tracker, so a single entry represents a quarter of that sector’s record.
How this compares
APT73 ranks eleventh of 47 groups on a record of 2 claims. That ranking says more about the tail of this dataset than about the group. Twenty-four of the 47 groups have claimed exactly one UAE organisation.
A same-day pair carries less signal than two claims spread across months. It is one event, not a pattern.
What to do
- Confirm your designation as critical national infrastructure with the authority that makes it, rather than inferring it from your industry.
- Complete the 39 Priority One controls in UAE IAS v2 first, because the standard makes them mandatory without tailoring.
- Check whether DESC ISR v3 also reaches you through a Dubai government contract, which brings 13 control domains with it.
- Keep operational technology networks separate from corporate networks, and prove the separation rather than asserting it.
- Record how a control system runs without its management layer, because that is the first question an incident asks.
Summary
APT73 claimed 2 UAE organisations on 27 April 2026 and has no other UAE record. The pairing of Government and Defense with Energy and Utilities places both claims inside critical national infrastructure scope. Claims are assertions published by attackers, not confirmed breaches.
