Ransomware Groups Targeting the UAE
47 distinct ransomware groups have claimed at least one organisation in the United Arab Emirates since 2020. LockBit 3.0 leads with 10 claimed organisations, and 8 groups have claimed 5 or more. The remaining 39 hold 57 claims between them, which is more than the seven sustained groups hold, and they are covered on the short record page.
Data as of , drawn from 192 leak-site claims collected by ransomware.live. How this data is collected and filtered.
Ransomware groups with repeat UAE activity
A group earns its own page once it has claimed 5 or more UAE organisations. Below that the record describes an episode rather than a pattern, and a page built on two dates would say less than its own table row. Groups under the threshold share one page.
| Name | Relative volume | Incidents | Share |
|---|---|---|---|
| LockBit 3.0 | 10 | 8.9% | |
| Stormous | 10 | 8.9% | |
| Everest | 9 | 8% | |
| Coinbase Cartel | 6 | 5.4% | |
| DragonForce | 5 | 4.5% | |
| INC Ransom | 5 | 4.5% | |
| Medusa | 5 | 4.5% | |
| RansomHub | 5 | 4.5% | |
| Total (all rows) | 112 | 100% |
Showing the top 8 of 112 total.
Groups below the page threshold
These 39 groups have claimed fewer than 5 UAE organisations each, and 24 of them appear exactly once. Dates, sectors and counts for the repeat ones are tabulated on the short record page.
The Gentlemen, FunkSec, APT73, Arcus Media, Blacknevas, BQTLock, DarkVault, FLocker, KillSec, LockBit 2.0, Lynx, MedusaLocker, NightSpire, Snatch, Tengu, Alphv, Auditteam, Blackshrantac, Cicada3301, Cloak, Clop, Crypto24, Daixin, Devman, Gunra, Handala, Hunters, Krybit, Lamashtu, LockBit 5.0, Monti, Nova, Payload, RA World, Ransomexx, Ransomhouse, Spacebears, Warlock, Zerolockersec.