UAE Ransomware Attacks in 2024
Ransomware groups claimed 27 organisations in the United Arab Emirates during 2024, which is 24.1% of all attributed UAE claims since 2020. Stormous was the most active group in this period with 5 claimed organisations. Figures reflect leak-site monitoring as of 21 October 2026.
Data as of , drawn from 192 leak-site claims collected by ransomware.live. How this data is collected and filtered.
Which groups claim UAE organisations in 2024
All groups| Name | Relative volume | Incidents | Share |
|---|---|---|---|
| Stormous | 5 | 18.5% | |
| LockBit 3.0 | 4 | 14.8% | |
| RansomHub | 4 | 14.8% | |
| Arcus Media | 2 | 7.4% | |
| DarkVault | 2 | 7.4% | |
| FunkSec | 2 | 7.4% | |
| Cicada3301 | 1 | 3.7% | |
| Daixin | 1 | 3.7% | |
| Hunters | 1 | 3.7% | |
| KillSec | 1 | 3.7% | |
| Medusa | 1 | 3.7% | |
| RA World | 1 | 3.7% | |
| Total (all rows) | 27 | 100% |
Showing the top 12 of 27 total.
Which sectors were hit in 2024
| Name | Relative volume | Incidents | Share |
|---|---|---|---|
| Professional Services | 7 | 25.9% | |
| Government and Defense | 6 | 22.2% | |
| Technology | 5 | 18.5% | |
| Financial Services | 0 | 0% | |
| Retail and E-Commerce | 1 | 3.7% | |
| Manufacturing | 1 | 3.7% | |
| Transportation | 1 | 3.7% | |
| Healthcare | 4 | 14.8% | |
| Energy and Utilities | 1 | 3.7% | |
| Hospitality | 0 | 0% | |
| Other | 1 | 3.7% | |
| Education | 0 | 0% | |
| Agriculture and Food Production | 0 | 0% | |
| Total | 27 | 100% |
UAE ransomware claims more than doubled in 2024 to 27 organisations, the largest single rise recorded on this tracker.
UAE ransomware claims more than doubled in 2024
Claims rose 125% in 2024 against the 12 recorded in 2023. That is the largest single increase on this tracker, and the point at which UAE ransomware activity changed scale. Unlike 2023, no single operation dominated the year.
Three groups drove the 2024 rise
Stormous claimed 5 UAE organisations in 2024, LockBit 3.0 claimed 4 and RansomHub claimed 4. Arcus Media follows with 2. No single operation dominated the year in the way LockBit 3.0 dominated 2023.
Professional Services carried 7 claims, Government and Defense 6 and Technology 5. Government and Defense reached its highest figure of any period in 2024. Retail and E-Commerce and Manufacturing recorded 1 claim each.
What this means for UAE organisations
- Treat 2024 as the inflection point in this dataset, because the count more than doubled against the prior year.
- Note that Government and Defense peaked at 6 claims here and has declined in every period since.
- Read the spread across Stormous, LockBit 3.0 and RansomHub as the start of a broader attacker population.
- Compare your own sector’s 2024 figure against its later ones, since sectors diverged sharply after this year.
- Assume improved leak-site monitoring explains part of the rise, which the methodology page sets out in full.
- Avoid attributing the increase to any single cause, because published claims measure attacker behaviour and observation together.
- Note that Stormous, LockBit 3.0 and RansomHub together account for 13 of the 27 claims, so the year was concentrated without being dominated.
- Check whether your sector appears in the 2024 column at all, since Retail and E-Commerce and Manufacturing recorded only 1 claim each.