Ransomware Groups With a Short UAE Record
39 of the 47 ransomware groups on this tracker have claimed fewer than 5 organisations in the United Arab Emirates. Together they account for 57 of 112 attributed claims, which is more than the 55 held by the 8 groups with a sustained record.
Data as of , drawn from 192 leak-site claims collected by ransomware.live. How this data is collected and filtered.
Why these groups share one page
A group earns its own page on this site once it has claimed 5 or more UAE organisations. Below that threshold the record cannot carry a profile. Two dates and one sector describe an episode, not a pattern, and a page built on them would restate the table row above it in longer sentences.
The tail is the finding
These groups are not a footnote to the tracker. They hold 50.9% of every attributed UAE claim. A UAE organisation is more likely to be claimed by a group it has never heard of than by one of the 8 named on this site.
Groups with two to 4 claimed UAE organisations
| Group | Claims | Sectors | First claim | Most recent |
|---|---|---|---|---|
| The Gentlemen | 4 | 3 | ||
| FunkSec | 3 | 2 | ||
| APT73 | 2 | 2 | ||
| Arcus Media | 2 | 2 | ||
| Blacknevas | 2 | 2 | ||
| BQTLock | 2 | 2 | ||
| DarkVault | 2 | 2 | ||
| FLocker | 2 | 2 | ||
| KillSec | 2 | 2 | ||
| LockBit 2.0 | 2 | 2 | ||
| Lynx | 2 | 2 | ||
| MedusaLocker | 2 | 2 | ||
| NightSpire | 2 | 2 | ||
| Snatch | 2 | 2 | ||
| Tengu | 2 | 2 |
15 groups with repeat claims below the threshold. A further 24 groups appear exactly once and are listed on the groups hub.
Groups below the page threshold hold 50.9% of every attributed UAE claim, and 24 of them were recorded exactly once.
A single claim describes an episode rather than an actor
Of the 39 groups below the threshold, 24 were recorded against a UAE organisation exactly once. One claim fixes a date and a sector. It cannot show whether a group returned, changed sector or stopped operating.
Leak-site monitoring treats each claim as an assertion by the attacker. A single assertion carries no pattern to read, so this site does not build a profile page on one.
Fifteen groups sit between the single claim and the threshold
The table above lists the 15 groups with repeat claims that still fall short of 5. Their first and most recent dates are shown because the gap between them is the useful figure.
Two claims a week apart and two claims two years apart describe different things. The first reads as one campaign. The second suggests a group that returned to the country after a long absence.
What a long tail means for defence planning
The practical consequence is that actor names are a weak basis for planning in the UAE.
- Treat the named groups as the visible part of the record, not as the whole of it.
- Expect an unfamiliar name, because groups below the threshold hold 50.9% of attributed claims.
- Plan around sectors and control domains, which persist while group names turn over.
- Read the sector pages before the group pages when deciding where to spend.
- Check the methodology before citing any of these counts, because the attribution rule decides which claims enter them.
The 7 groups with a sustained record are the exception in this dataset, not the rule. A control that only answers those 7 leaves the larger share of the record unaddressed.