Ransomware and Data-Theft Claims in Oman: Q1–Q3 2026

Bottom line

Five findings matter for a board or a CISO in Oman.

1. Oman has the third-largest record of the six Gulf markets we track, and 2026 is its busiest year so far. Seven observed claims against 45 in the UAE and 17 in Saudi Arabia, and six in Kuwait, five in Qatar, and three in Bahrain, though visibility differs by country. By our count Oman had four claims in 2023 and six in each of 2024 and 2025. The 2026 pace of seven in nine months is higher, but earlier years rest on a thinner record, so we read it as suggestive.
2. One brand made three claims in three weeks. LockBit 5.0 posted an industrial-equipment group, a bottled-water producer, and a construction contractor between 25 February and 18 March, in the same weeks it posted three Kuwaiti firms. No other group has more than one claim here.
3. The energy skew has faded. Five of our 16 claims for 2023 to 2025 named energy and oil-services firms. In 2026 none of the six extortion claims does. The one energy-sector claim, against an oil and gas developer, is a political post with no proof.
4. Infrastructure and insurance names appeared late in the window. An insurer was listed on 6 July and offered again on a forum two days later, in a post that lists identity and vehicle documents. A national logistics group, with ports, a drydock, and rail, was listed on 23 September with sample links. These claims are unverified.
5. The war is physical first. Iranian drones hit Omani ports in March, but our leak-site data holds one war-aligned claim, and it came with no proof. Defend against the groups' behavior, not just the local headline.

We rate the risk to Omani mid-market commercial firms and contractors as Medium. For logistics and port operators, insurers, and energy firms we rate it Elevated, driven by the late-window claims and the war context. These are our assessments, built on a small record.

1. Scope, and what the numbers can bear

This report covers claims naming Omani organizations that were published between 1 January and 30 September 2026. A claim dated 6 October (University of Buraimi) is cited separately as a later development and is not in the seven or the quarterly figures. Six of the seven claims are financially motivated extortion claims. The seventh, against an energy company, is a politically framed claim with no ransom element, and we count it separately where the difference matters. A company listed twice for the same incident counts once. We attribute an organization to a country by its headquarters or main operations, using its domain and public profile. Trackers sometimes date the same claim differently, by days to weeks, and we show both dates where it matters. Visibility differs by country, so the counts are not complete incident totals and are not a like-for-like measure of national risk.

Three caveats apply to everything below.

• Leak sites, the sites on which groups publish stolen data, show only victims who did not pay or negotiate privately. Real incident counts may be larger. With counts this small, a single incident changes the picture.
• A group’s claim is not proof of compromise. We have not independently verified any published dataset.
• Attributing a victim to a country is imperfect, and some firms operate across the region. Treat our counts as what we observed, not as a complete tally of incidents.

Terms. RaaS: ransomware-as-a-service, a platform that developers rent to independent affiliates. EDR: endpoint detection and response, security software on servers and laptops. Initial access broker: a seller of ready-made entry into a network.

2. Timeline: a February burst, a quiet spring, a late-summer return

The pattern is two bursts with a gap between them. Four claims landed between 25 February and 18 March, including the political post, and nothing appeared between 19 March and 5 July. Three more followed, one a month: 6 July, 1 August, and 23 September, from three different groups. Another claim, against a university, arrived on 6 October, outside the window. The dates alone cannot tell us whether the gap reflects a pause in activity or the timing of when we saw the listings.

The war context is physical first. According to the public timeline, Iranian drones struck the ports of Duqm and Salalah on 3 March, hitting fuel tanks at Salalah and suspending container operations there, with further strikes on Sohar and other coastal sites. A SOCRadar profile of the pro-Iran DDoS group DieNet lists Oman in one multi-country industrial-control-system claim in March, and the same profile says DieNet often inflates its claims. Our leak-site data holds one war-aligned claim, against an energy company on 15 March, with no proof. The war is relevant to risk, but it is not evidence that cyberattacks on Omani organizations have increased, and our data does not show such an increase.

3. The groups at a glance

Five groups made seven claims, and LockBit 5.0 made three of them. LockBit 5.0 does not appear in our Saudi, UAE, or Qatar data, but it also claimed three Kuwaiti firms. The Gentlemen is the only group here that also works the UAE, Saudi Arabia, and Qatar. Qilin listed two Omani firms in December 2025, a logistics company and a biscuit maker, which sit just before this window.

4. Who is being hit

Our own classification of the seven claims. Each claim is counted once.

• Industrial, construction, and trading groups: 3. An industrial-equipment division of a family group, a construction contractor, and an automotive and diversified group.
• Food and beverage: 1. A bottled-water producer.
• Insurance: 1. Arabia Falcon Insurance Company.
• Logistics and ports: 1. Asyad Group, a national logistics provider.
• Energy, political claim: 1. CC Energy Development, claimed by a war-aligned persona.

The sector map changed. Across 2023 to 2025 our record leans toward oil and gas services, a petrochemical trader, and a national oil investor. In 2026 the extortion claims moved toward commercial groups, an insurer, and a logistics operator. The most consequential name is the logistics group, because ports, drydocks, and rail documents sit close to national infrastructure.

A ledger that shifts from oil to logistics is a ledger that is following the money, not the pipeline.

5. Case files

Counts show the shape of the problem. Individual cases show how it works. Each case below states what was claimed, what the timing and structure suggest, and how far we trust it.

Case 1. Three LockBit 5.0 claims in 21 days (25 February to 18 March)

Claims. The Gulf Equipment & Technology division of Al Alawi, a family group operating since 1967 (25 February). Tanuf Water, a bottled-water producer (28 February). Abu Hatim, an engineering and construction contractor (18 March).
Reading. Three mid-market firms in different sectors were listed in three weeks, in the same weeks LockBit 5.0 listed three Kuwaiti firms. Six claims across two small markets in about seven weeks is consistent with one or more affiliates working a regional access pool, but the evidence does not establish a shared intrusion, supplier, or vector. The contractor is the most useful name for supply-chain teams, because contractors hold drawings and project files for their clients.
Confidence. High on the counts and dates. Low on why the cluster formed.

Case 2. An insurer, listed twice in two days (6 and 8 July)

Claim. On 6 July The Gentlemen listed Arabia Falcon Insurance Company, a Muscat insurer formed by a merger of two local insurers. On 8 July a forum seller, Errësira, posted a sale thread headed "New Breach" that names the same company. The post itemizes ten categories of material: business registration records, Ministry of Commerce certificates, Omani ID cards and expatriate residency cards, Royal Oman Police driving licenses, vehicle registration cards, motor insurance documents and policy schedules "from local companies like" the insurer, corporate letters for transferring vehicles and heavy equipment, and police forms for vehicle transfer and registration. It gives the size as 8 GB uncompressed and 20,000 or more images, says samples were attached, and asks for serious offers through private messaging. We have left out the seller's contact details.
Reading. The two posts do not describe the same thing. The group's listing carried no data volume that we saw. The forum list reads like a collection of scanned documents handled in vehicle registration, transfer, and insurance transactions, and it speaks of several insurers, not one. That could mean the material came from the insurer, from a broker or agent that processes vehicle paperwork for several companies, or from a mix. The evidence does not tell us which, and it does not show that the two posts come from one intrusion. If the offer is accurate, the people affected would be vehicle owners and company representatives whose documents were submitted, not only this insurer's policyholders. Identity-card and licence images are directly reusable for impersonation and fraud, and follow-on phishing that quotes real vehicle details would be believable.
Confidence. High that both posts exist. Low that either is accurate in full, and low that they describe the same dataset.

Case 3. A national logistics group, with samples (23 September)

Claim. On 23 September a group called Spirals listed Asyad Group, Oman's national logistics provider, marking terminal, drydock, and rail documents as available and linking sample files. Another tracker dates the claim to 26 September.
Reading. Offering samples is a way to prove possession and to raise pressure. Terminal, drydock, and rail documents are operational and engineering files, not just office records, which is why this claim matters more than its size suggests. We have no public profile of Spirals, so we cannot say how reliable its past claims were. Port and logistics operators across the Gulf should read this as a prompt to check what their suppliers and contractors hold.
Confidence. Moderate that the listing exists. Low on what the samples contain.

Case 4. A political claim against an energy company (15 March)

Claim. On 15 March, two weeks after Iranian drones hit Omani ports, Nasir Security posted a claim against CC Energy Development, an oil and gas developer, with religious rhetoric and no data volume. The same claim appears in the forum record that day. The same company was listed by another group in 2023.
Reading. The persona also claimed a UAE federal authority and the Kuwaiti Ministry of Interior. This reads as influence activity tied to the war: no ransom, deadline, or price. A claim of this kind can still prompt a real investigation, because the cost of ignoring it is higher than the cost of checking.
Confidence. High that the claim was posted. Low that any breach occurred.

Case 5. A diversified group on a new brand’s list (1 August)

Claim. On 1 August Black Nevas listed OTE Group, part of Saad Bahwan Holding, a diversified group that distributes several car brands, electronics, and polymer concentrates across four countries. Another tracker dates the claim to 9 September, the same date it records for a Saudi jewelry maker.
Reading. Black Nevas also sells stolen data directly, in addition to extorting the victim, and its UAE listings have offered access to corporate networks. For a diversified group with operations in several countries, an Omani listing may affect partners elsewhere, and its brand partners and distributors should check their own exposure.
Confidence. Moderate that the listing exists. Low on the contents. The date is uncertain by about five weeks.

Case 6. A group hit four times in three years

Claims. The Towell group of companies appears in our record four times: LockBit 3.0 in June 2023, Dispossessor in November 2023, Babuk2 and RansomHub on the same day in August 2024 for an engineering arm, and LockBit 5.0 in May 2025 for the holding company. A special oilfield-services firm was listed twice in 2024, by LockBit 3.0 in April and Meow in August.
Reading. Being listed once does not end the exposure. Repeat listings could reflect unresolved access, reused credentials, shared data being re-sold, or simply a large, visible target. The public record does not say which. Organizations that have been listed before should treat the first listing as a standing risk, not a closed event.
Confidence. High on the dates. Low on why the repeats happened.

6. Active threat actors: presence, motivation, and TTPs

Five actors made all seven claims. Their public technical detail comes from global incident reporting, not from the Omani cases. We have no incident-level evidence from Omani victims, so read the tradecraft below as known behavior of each group in general, not proof of what happened to a named Omani firm. Technique IDs refer to MITRE ATT&CK.

Summary: motive and presence

What the actors share

Group names differ, but their methods overlap. In publicly documented worldwide activity, both profiled ransomware-as-a-service groups steal data to publish before or alongside encryption, and The Gentlemen also disables security tools. That does not show these methods were used in the Omani claims in this report.

Marks reflect public reporting on each group worldwide, not Omani incident evidence.

Actor profiles

A war-aligned persona and a new brand

• Nasir Security. A war-aligned persona that also claimed a UAE federal authority and the Kuwaiti Ministry of Interior. On 15 March it posted a claim against an Omani energy company with religious rhetoric and no data volume or proof, and the same claim appears in the forum record that day. We treat it as influence activity until evidence appears.
• Spirals. A new name in our data. Its only Omani claim is a national logistics group on 23 September, with sample links for terminal, drydock, and rail documents. Another tracker dates the claim to 26 September. We have no public profile and assume commodity tradecraft until evidence says otherwise.

Earlier groups in the Omani record

• LockBit 3.0, Dispossessor, Babuk2, RansomHub. Between 2023 and 2024, claims against a trading and industrial group, an oilfield-services firm, and an engineering arm of the same group.
• Clop. An oil and gas developer in July 2023 and a power-sector body in November 2025, a pattern consistent with campaigns that exploit one flaw to reach many victims, though we cannot link these two to a specific flaw.
• Trigona, Fog, Meow, Termite, Sarcoma, Embargo. One or two claims each in 2023 to 2025: a perfumer, a technical university, an oilfield-services firm, a national oil investor, a petrochemical trader, and a building and engineering group.
• Qilin. A logistics company and a biscuit maker in December 2025.

7. Beyond the leak sites: forum claims

Ransomware crews post victims on their own sites. Everyone else posts on criminal forums: data sellers, access brokers, hacktivists, and attention seekers. We reviewed six Oman-targeted forum posts published between 22 September 2025 and 30 September 2026, four of them inside the report window. That is a very short sample, so we read it as a snapshot, not a trend. We name no victims here beyond the insurer already named on a leak site in Case 2, because the claims are unverified and naming a target may amplify an unproven claim.

What the six posts target

• Aviation: 1. A 30 September offer of an airport database that the seller labels 17 million records.
• Insurance and vehicle documents: 1. The 8 July post (Case 2), the only one of the six that itemizes its contents: ten categories, 8 GB, and more than 20,000 images, mostly identity and vehicle papers.
• Energy: 1. The 15 March political claim (Case 4).
• Sport: 1. A 12 January post offering 3 GB said to come from a national football body.
• Government and education, before the window: 2. Employee records from a government body (22 September 2025) and a post naming an education site (27 November 2025).

Who is posting

Six handles made six posts, one each, and the insurer post came from Errësira. The set is too small to show concentration. Nasir Security is the one handle that also appears in our Kuwaiti and UAE samples.

The airport offer needs verification before anyone reacts. A figure of 17 million records is large for the country's population, and sellers often count rows or logs, not people. An airport operator should check whether any sample matches its systems and how old the data is.

Why this matters for ransomware risk

Access and data sold on forums are the front end of the ransomware chain. A leak-site record of seven claims says little about how much access is on sale, and we cannot link any listing to any claim, and we do not. The reason to watch forums is the interval between a sale and a public claim, which is usually days to weeks. The insurer case shows that the interval can also run the other way, with a forum post appearing after a leak-site listing.

Confidence. That the posts exist: high. That each describes a real breach: low. That any maps to a ransomware incident: low.

8. Update outside the report window: October 2026

On 6 October The Gentlemen listed the University of Buraimi, a private university near the UAE border. It is the group’s third Omani claim in 15 months and its second in three months, and it is outside this report’s window and not in the seven.

9. How they get in

Leak sites show victims, not intrusions, so this section draws on public regional and vendor reporting. The consistent picture:

• Exposed edge devices and valid accounts. The Gentlemen are reported to work through exposed firewalls and VPN gateways and valid credentials, and LockBit 5.0 affiliates through valid accounts and remote-management tools.
• Bought access and stolen credentials. Forum sellers offer access and database extracts cheaply, and combolists feed credential stuffing, account takeover, and business email compromise.
• Supplier trust. The contractor, the group of companies with repeated listings, and the logistics operator all sit inside supply chains, which is one hypothesis worth investigating among several.

10. The regulatory frame

Oman’s Personal Data Protection Law was issued by Royal Decree No. 6 of 2022. Law-firm commentary says its Executive Regulation was issued by Ministerial Decision No. 34 of 2024 and that the law became fully enforceable on 5 February 2026, administered by the Ministry of Transport, Communications and Information Technology. The same commentary describes a duty to notify the regulator within 72 hours of a breach that may put data subjects’ rights at risk, administrative fines of up to OMR 2,000 per violation, and heavier criminal penalties for unlawful transfers of data outside Oman. We have not checked these points against the text of the decree or the regulation, and the ministry’s page on personal data protection is the official starting point. Financial institutions and other regulated sectors answer to their own regulators in addition. Take legal advice for any specific case. We are not lawyers.

11. Outlook for Q4 2026 and Q1 2027

These are our forecasts, not findings, and each rests on the limited data above.

1. Leak-site volume stays moderate, with clusters. One claim was recorded in the first week of October. We expect two to five claims in the quarter, a low-confidence range resting on a very small record that group activity and leak-site coverage could change.
2. The Gentlemen is the most likely repeat name. It has three Omani claims in 15 months, the latest on 6 October, so expect more claims against insurers, schools, and private health providers.
3. Logistics and port names stay in view. Operational documents are valuable, and a new brand with a sample is likely to be followed by others.
4. Repeat listings continue. Groups that have been listed before are more likely to appear again than first-time targets.
5. The war stream is a wildcard. Ports and energy sites were physical targets in March. A cyber dimension has been thin in our leak-site data, but it can appear quickly.

12. What to do this quarter

1. Start with your network edge. Inventory every internet-facing VPN, firewall, and remote-access gateway. Set a proposed internal target of 48 hours to patch actively exploited flaws, use compensating controls where patching cannot be immediate, and prioritize by confirmed exploitation, exposure, asset criticality, and vendor guidance.
2. Check whether your credentials are for sale. Search infostealer logs, combolists, and broker listings for employee and vendor accounts, change the passwords of accounts whose credentials appear, revoke active sessions, and check for password reuse.
3. Rank your contractors and suppliers by what they hold. Contractors, logistics providers, and distributors in your supply chain hold your drawings, contracts, and operational documents. Ask each for MFA, EDR, and offline-backup evidence.
4. If you have been listed before, treat it as open. Rotate credentials that were in scope, review remote access, and confirm that the original entry point was closed.
5. Watch for remote-management tools you did not install. Alert on new scheduled tasks, new remote-management agents, and large outbound transfers before any file changes.
6. Rehearse the double-extortion call. Know who notifies your regulator, who briefs the board, and who decides on negotiation. Write it down and test it.
7. Watch for your organization's name. Leak sites, Telegram channels, and broker forums may carry your data before you learn of a breach. Detection there can buy days.

Sources

• Check Point Research, The State of Ransomware Q1 2026
• Check Point, LockBit 5.0 returns
• Proven Data, LockBit 5.0 technical analysis and TTPs
• Infosecurity Magazine, The Gentlemen overtakes Qilin
• 2026 Iranian strikes on Oman (event timeline)
• SOCRadar, Dark Web Profile: DieNet
• Ministry of Transport, Communications and Information Technology, Personal Data Protection
• CMS, Oman personal data protection law: entering the enforcement phase (secondary source)
• DLA Piper, Oman's new implementing regulation (secondary source)

Sources are linked in their original language.