UAE Ransomware Attacks in 2025
Ransomware groups claimed 35 organisations in the United Arab Emirates during 2025, which is 31.3% of all attributed UAE claims since 2020. Everest was the most active group in this period with 6 claimed organisations. Figures reflect leak-site monitoring as of 21 October 2026.
Data as of , drawn from 192 leak-site claims collected by ransomware.live. How this data is collected and filtered.
Which groups claim UAE organisations in 2025
All groups| Name | Relative volume | Incidents | Share |
|---|---|---|---|
| Everest | 6 | 17.1% | |
| Coinbase Cartel | 5 | 14.3% | |
| Medusa | 3 | 8.6% | |
| BQTLock | 2 | 5.7% | |
| FLocker | 2 | 5.7% | |
| Blacknevas | 1 | 2.9% | |
| Blackshrantac | 1 | 2.9% | |
| Crypto24 | 1 | 2.9% | |
| Devman | 1 | 2.9% | |
| DragonForce | 1 | 2.9% | |
| FunkSec | 1 | 2.9% | |
| Gunra | 1 | 2.9% | |
| Total (all rows) | 35 | 100% |
Showing the top 12 of 35 total.
Which sectors were hit in 2025
| Name | Relative volume | Incidents | Share |
|---|---|---|---|
| Professional Services | 5 | 14.3% | |
| Government and Defense | 4 | 11.4% | |
| Technology | 4 | 11.4% | |
| Financial Services | 4 | 11.4% | |
| Retail and E-Commerce | 4 | 11.4% | |
| Manufacturing | 4 | 11.4% | |
| Transportation | 1 | 2.9% | |
| Healthcare | 2 | 5.7% | |
| Energy and Utilities | 1 | 2.9% | |
| Hospitality | 0 | 0% | |
| Other | 1 | 2.9% | |
| Education | 1 | 2.9% | |
| Agriculture and Food Production | 2 | 5.7% | |
| Total (all rows) | 35 | 100% |
Showing the top 13 of 35 total.
2025 is the highest year on this tracker with 35 claimed UAE organisations, led by two groups that had never appeared before.
2025 is the highest year on record with 35 claimed UAE organisations
Claims rose 29.6% in 2025 against the 27 recorded in 2024. That makes it the highest year on record, at 31.3% of the whole dataset. The more useful detail is who led it. Neither of the two leading groups had claimed a UAE organisation in any earlier period.
The groups leading 2025 were new to the UAE
Everest claimed 6 UAE organisations in 2025 and Coinbase Cartel claimed 5. Neither group recorded a UAE claim in any earlier period. Medusa follows with 3 and BQTLock with 2.
Sector distribution flattened in 2025. Professional Services carried 5 claims, Government and Defense 4, and Technology, Financial Services and Retail and E-Commerce 4 each. That is the most even spread across sectors of any period on this tracker.
What this means for UAE organisations
- Read 2025 as the peak year on current data, while noting that 2026 is still running.
- Treat the arrival of Everest and Coinbase Cartel as evidence that leading groups turn over within a single year.
- Stop planning around last year’s most active group, given that neither 2025 leader appeared in 2024 at all.
- Note that five separate sectors recorded 4 or more claims, so no sector could treat itself as outside the pattern.
- Compare your sector’s 2025 figure with its 2026 figure, because sectors moved in opposite directions afterwards.
- Note that Everest reached 6 claims in a single year, the highest group total of any period on this tracker.
- Read 31.3% as the share of the whole record that fell in one year, which measures how concentrated recent activity has become.
- Apply the attribution method on the methodology page before citing 35 anywhere, since it counts attributed claims rather than raw records.