Ransomware Attacks on Energy and Utilities in the UAE
Ransomware groups have claimed 4 energy and utilities organisations in the United Arab Emirates since 2020, which is 3.6% of all attributed UAE claims. APT73 accounts for 1 of them. The earliest claim in this sector was recorded on and the most recent on .
Data as of , drawn from 192 leak-site claims collected by ransomware.live. How this data is collected and filtered.
Which groups claim UAE energy and utilities organisations
All groups| Name | Relative volume | Incidents | Share |
|---|---|---|---|
| APT73 | 1 | 25% | |
| Handala | 1 | 25% | |
| Lynx | 1 | 25% | |
| RA World | 1 | 25% | |
| Total | 4 | 100% |
How Energy and Utilities claims spread across periods
UAE Energy and Utilities holds only 4 claimed organisations, but the sector carries the heaviest regulatory exposure per claim of any on this site.
Energy and Utilities ranks ninth among UAE sectors with 4 claimed organisations
Energy and Utilities ranks ninth of 13 UAE sectors, well below the average of 8.6 claims per active sector. Four distinct groups appear here, one claim each. The small total should not be read as low exposure, because this sector sits inside critical national infrastructure.
Energy and Utilities claims are rising from a low base
The sector recorded no claims before 2024. It then saw 1 claim in 2024 and 1 in 2025, and the partial year 2026 already stands at 2. Leak-site monitoring recorded the first claim on 23 November 2024 and the most recent on 27 April 2026.
APT73, Handala, Lynx and RA World each account for one claimed organisation. The small total should not be read as low exposure. Energy and utilities operators fall inside critical national infrastructure. A single incident there carries regulatory consequences that a larger count elsewhere would not.
What this means for UAE organisations
- Confirm your status as critical national infrastructure, because UAE IAS v2 then applies across all emirates rather than by emirate.
- Complete the 39 Priority One controls in UAE IAS v2 first, since the standard makes those mandatory for everything in scope.
- Plan the technical programme separately, given that UAE IAS v2 splits 188 controls into 60 management and 128 technical.
- Check whether DESC ISR v3 also reaches you through a Dubai government relationship, bringing its 13 control domains with it.
- Keep operational technology networks separate from corporate networks, and prove the separation rather than asserting it.
- Record how a control system runs without its management layer, because that is the question an assessor and an incident both ask.
- Treat the rise from zero to 2 claims in 2026 as a signal worth watching, not yet as a trend.
