Ransomware and Data-Theft Claims in the Gulf: Six Markets, Q1–Q3 2026

Bottom line

Five findings matter for a board or a CISO anywhere in the Gulf. Each country has its own report, linked at the end.

1. The UAE and Saudi Arabia hold three quarters of the claims. Of 83 observed claims, 45 name UAE organizations and 17 name Saudi ones, which is 75%. The other four markets total 21. Visibility differs by country, so this is a map of what leak sites show, not a ranking of national risk.
2. The groups cross borders. Thirteen of 28 groups appear in two or more markets, and together they made 66 of the 83 claims. The Gentlemen alone appear in four markets with 16 claims, 19% of the total. An indicator list built from one country's incidents protects partly in the next.
3. There is no common tide. Claims ran 30, 23, and 30 by quarter across the six markets, but the markets moved differently. Saudi Arabia peaked in Q3, Kuwait and Bahrain fell silent after Q2, and Qatar and Oman came in bursts. The war that began on 28 February did not produce a uniform rise in extortion claims.
4. The victims are mostly mid-market firms and suppliers, with infrastructure at the edges. Energy suppliers in Saudi Arabia, builders and traders in the UAE, advisers to the state in Qatar, mid-market firms and a hospital in Kuwait, contractors and a logistics group in Oman, a hospital and a car-retail group in Bahrain. Banks appear on forums, not on leak sites, in the markets where we checked.
5. Forums are busier than leak sites, and sellers cross borders too. We reviewed 116 forum posts. One handle listed Kuwaiti and Qatari banks on the same day, one seller appears in both Kuwait and Bahrain, and the same headline offer from a Bahraini security body was posted twice, seven months apart. Treat forum offers as verification tasks, not confirmed incidents.

We rate the Gulf-wide risk from financially motivated groups as High and steady in the UAE and Saudi Arabia, and Medium with elevated pockets elsewhere: government and citizen data, banks, healthcare, logistics, and aviation. These are our assessments, built on leak-site claims that no one has verified.

1. Scope and method

This report summarizes our six country reports. Each counts claims naming organizations in that country that were published on leak sites between 1 January and 30 September 2026, and treats claims dated in October as later developments. A company listed twice for the same incident counts once. We attribute an organization to a country by its headquarters or main operations, so firms headquartered elsewhere with a local office are not counted. Five of the 83 claims are political or destructive rather than extortion, and we count them separately where the difference matters. Trackers sometimes date the same claim differently, by days to weeks, and each country report shows the dates it used.

Three caveats apply to everything below.

• Leak sites, the sites on which groups publish stolen data, show only victims who did not pay or negotiate privately. Real incident counts may be larger.
• A group’s claim is not proof of compromise. We have not independently verified any published dataset.
• Visibility differs by country, and the small markets rest on very small counts, where one claim changes the picture. Treat our counts as what we observed, not as a complete tally of incidents.

Terms. RaaS: ransomware-as-a-service, a platform that developers rent to independent affiliates. EDR: endpoint detection and response, security software on servers and laptops. Initial access broker: a seller of ready-made entry into a network.

2. Six markets at a glance

The group column counts each group once per market, so it sums to 47, while 28 distinct groups made the 83 claims. Forum windows differ slightly by report; Oman and Bahrain include posts from before 2026.

3. The groups that cross borders

Twenty-eight groups made 83 claims, and 15 of those groups appear in only one market. The other 13, listed below, made 66 claims. Three patterns stand out. First, a few brands run the whole region: The Gentlemen, DragonForce, and INC Ransom each work three or four markets. Second, new brands move fast: Payload claimed Bahrain, the UAE, and Qatar in 36 days, and LockBit 5.0 claimed Kuwait and Oman in about seven weeks. Third, some brands stay local: Within the Gulf, Krybit is almost entirely a UAE story, though it also posts in France, and Qilin appears only in Qatar and Kuwait.

Groups seen in two or more markets: 13 of 28, with 66 of 83 claims. The group profiles, tradecraft, and hunting notes sit in the country reports. Nineteen of the 28 groups also posted French victims in the same period, which our France report covers.

A group does not stop at a border, so an indicator list should not either.

4. Timelines compared

The regional total looks flat, but it hides six different shapes. Saudi Arabia ran 4, 4, 9, with four Q3 claims from one group in 31 days. The UAE ran 16, 12, 17, helped in Q3 by a new brand, Krybit. Qatar ran 0, 4, 1, with four claims in 25 days. Kuwait ran 4, 2, 0, with a LockBit 5.0 cluster early. Oman ran 4, 0, 3, in two bursts. Bahrain ran 2, 1, 0. Two markets have gone quiet on leak sites since mid-year, and one has doubled its pace, which is what small counts and a few active groups produce. We would not read a trend into the total.

The war is physical first. According to public timelines, Iranian missile and drone strikes hit Bahrain, Kuwait, Oman, Qatar, and Saudi Arabia from 28 February or 1 March, and the UAE's own cyber authority describes a war-driven attack stream. Our leak-site data does not show a matching jump in extortion claims in the first quarter or after. The cyber effect of the war appears instead as disruption and as political claims, covered next.

5. Who is being hit

Each country report classifies its own claims, so the sector labels differ. The common thread is these points.

• UAE. Most claims of any market, no sustained decline, an aviation cluster forming. Read the report
• Saudi Arabia. Volume more than doubled in Q3, energy supply chain the main focus. Read the report
• Oman. Energy skew faded, logistics and insurance appeared late. Read the report
• Kuwait. Half the claims from one cluster, silence after May, busy forums. Read the report
• Qatar. Four claims in 25 days, advisers to the state, banks on forums. Read the report
• Bahrain. Smallest record, recycled forum claims, a heavy denial-of-service wave. Read the report

Three themes recur. Mid-market firms are the typical victim in every market, because they hold valuable data behind smaller defenses. Suppliers and advisers matter more than their size suggests, because they hold their clients' files: engineering consultancies and a security integrator, law and design firms, contractors, and a logistics group. And healthcare shows up in the smaller markets, with hospitals in Kuwait and Bahrain and a research institute in Qatar. No bank appears on a leak site in the UAE, and banks appear on forums, not on leak sites, in Qatar and Kuwait.

6. The political and war stream

Five of the 83 claims are political or destructive: two from the Iran-linked persona Handala (one Saudi, one UAE) and three from the persona Nasir Security (one each against a UAE federal authority, the Kuwaiti Ministry of Interior, and an Omani energy company). Nasir's three claims came with religious or resistance rhetoric, no data volume, and no proof, and we treat them as influence activity until evidence appears. The persona frames its targets as US allies. These claims have no ransom, deadline, or price, so they do not follow the extortion pattern, but they can still trigger a real investigation.

Denial-of-service is a separate stream. A SOCRadar profile of the pro-Iran group DieNet counts 59 attack claims on 2 and 3 March, including 21 against Kuwaiti targets, 15 against Bahraini ones, four against the UAE, and a multi-country industrial-control claim that includes Saudi Arabia, Oman, and Qatar. The same profile says DieNet often inflates its claims. These are not ransomware and are outside our counts, but they landed on the same ministries, airports, banks, and telecom operators that appear elsewhere in this report, and the defense is capacity and filtering, not a ransomware playbook.

7. Beyond the leak sites: forums

Across the six reports we reviewed 116 forum posts: 36 for Saudi Arabia, 33 for the UAE, 24 for Kuwait, 12 for Qatar, six for Oman, and five for Bahrain. We name no victims in any of them, because the claims are unverified and naming a target may amplify an unproven claim.

• Government and security data is offered in every market. Ministries, security bodies, and civil registries appear in Kuwait, Bahrain, Saudi Arabia, and elsewhere, often with round headline figures. Two cases suggest padding or recycling: a Kuwaiti database labeled with more people than the country has, and a 200 GB Bahraini claim posted twice.
• Sellers cross borders. The handle cabyc posted five Kuwaiti and four Qatari financial-sector listings on 13 June. A handle named Ashborn in Kuwait and TheAshborn in Bahrain is probably one seller. Anonymous2090 appears in the Saudi, UAE, and Qatari samples. Nasir Security appears in three markets.
• Edge access is for sale. Firewall and VPN access offers, including one for a Bahraini hotel, are the kind of listing a ransomware affiliate buys, and vendors describe exposed edge devices as the most common way in.

Confidence. That the posts exist: high. That each describes a real breach: low. That any maps to a ransomware incident: low. We cannot link any listing to any claim, and we do not.

8. The regulatory frame compared

A 72-hour notification window is common across the Gulf, but its source differs, and that matters for how far you can rely on it. In Saudi Arabia the regulator itself describes the rule. In Qatar the statute sets no number of hours and the 72 hours come from regulator guidance. In the other markets we rely on law-firm commentary. The table says what each country report found and how far we checked it. We are not lawyers, so take legal advice for any specific case.

9. Outlook for Q4 2026 and Q1 2027

These are our forecasts, not findings, and each rests on the limited data above.

1. The UAE and Saudi Arabia stay the volume centers. Their mid-market pipelines are steady, and new brands such as Krybit keep arriving.
2. The Gentlemen and LockBit 5.0 are the most likely regional repeat names. The first has claims in four markets, and the second made two country clusters inside eight weeks.
3. Small markets stay lumpy. Zero to five claims a quarter in each of Qatar, Kuwait, Oman, and Bahrain is a reasonable range, and one active group can move any of them. This is a low-confidence range.
4. Forum listings will surface as claims. Some forum-listed access will reappear as leak-site victims within weeks, and bank, government, and hospitality listings deserve verification now.
5. The war stream is a wildcard. Denial-of-service waves and political claims followed the strikes and can return quickly with any escalation, in any of the six markets.

10. What to do this quarter

1. Build defenses around group behavior, not borders. Share indicators and tradecraft across your country offices and your regional peers, since the same groups work several markets.
2. Start with your network edge. Inventory every internet-facing VPN, firewall, and remote-access gateway. Set a proposed internal target of 48 hours to patch actively exploited flaws, use compensating controls where patching cannot be immediate, and prioritize by confirmed exploitation, exposure, asset criticality, and vendor guidance.
3. Check whether your credentials are for sale. Search infostealer logs, combolists, and broker listings for employee and vendor accounts, change the passwords of accounts whose credentials appear, revoke active sessions, and check for password reuse. Banks, ministries, and hospitality operators should do this first.
4. Rank your suppliers by what they hold. Engineering and legal advisers, integrators, contractors, and logistics providers hold your drawings, contracts, and credentials. Ask each for MFA, EDR, and offline-backup evidence.
5. Assume endpoint security can be switched off, and protect recovery. Alert on service stops, new scheduled tasks, and unexpected remote-management tools, protect the virtualization layer, and test offline backups, especially for clinical systems.
6. Prepare for denial of service. Government, aviation, banking, and telecom portals should confirm upstream filtering and scrubbing arrangements with their providers before the next escalation.
7. Rehearse the double-extortion call, with the right regulator. Know who notifies which authority and by when in each country you operate in, who briefs the board, and who decides on negotiation. Write it down and test it.
8. Watch for your organization's name. Leak sites, Telegram channels, and broker forums may carry your data before you learn of a breach. Detection there can buy days.

The six country reports

• Ransomware and Data-Theft Claims in Saudi Arabia: Q1–Q3 2026
• Ransomware and Data-Theft Claims in the UAE: Q1–Q3 2026
• Ransomware and Data-Theft Claims in Qatar: Q1–Q3 2026
• Ransomware and Data-Theft Claims in Kuwait: Q1–Q3 2026
• Ransomware and Data-Theft Claims in Oman: Q1–Q3 2026
• Ransomware and Data-Theft Claims in Bahrain: Q1–Q3 2026

Sources

Each country report lists its own sources. The ones that shape this summary:

• Check Point Research, The State of Ransomware Q1 2026
• SOCRadar, Dark Web Profile: DieNet
• Infosecurity Magazine, The Gentlemen overtakes Qilin
• The National, Ransomware activity rises across Middle East (CloudSEK data)
• Check Point, LockBit 5.0 returns

Sources are linked in their original language.