Ransomware and Data-Theft Claims in the UAE: Q1–Q3 2026

Bottom line

Five findings matter for a board or a CISO in the Emirates.

1. The UAE has the most published extortion claims of any Gulf market in our data, and the count shows no sustained decline. Claims ran 16, 12, then 17 by quarter. The Q3 rebound came from a new brand (Krybit, five claims since June) and from DragonForce and INC working mid-market firms in steady batches.
2. Four groups produce more than half. The Gentlemen and DragonForce have seven claims each, INC and Krybit five each: 24 of 45 (53%). Behind them sit seventeen groups, thirteen of which appear once.
3. The targets are the building and trading economy. Industrial and construction firms (10) and diversified family groups (8) make up 40% of claims. Technology (7), hospitality and retail (4), and finance (3) follow. No bank appears on a leak site.
4. An aviation cluster is forming. A government air wing in January, an airline caterer and a retail conglomerate in August, and Flydubai on 6 October. The UAE Cyber Security Council also reported contained attacks on aviation, energy, and education in August.
5. A second, war-driven stream runs beside the criminal one. The council's head says the IRGC is behind many attacks and cited 640,000 attempts in a single day in September. That stream shows up as hacktivist claims and Telegram posts, not as ransom demands. Section 7 covers it.

We rate the risk to UAE mid-market firms, contractors, and family groups as High and steady. For aviation, energy, and government we rate it High, driven by both criminals and the war stream.

1. Scope, and what the numbers can bear

This report covers claims naming UAE organizations that were published between 1 January and 30 September 2026. The 45 include two war-aligned claims that are not financial extortion: Sharjah National Oil Corporation (Handala) and the Federal Customs Authority (Nasir Security). We keep them in the counts and treat them separately in the analysis. Claims dated October (Flydubai, the UAE Pro League, PMG, and Seven Seas) are cited separately as later developments and are not in the 45 or the quarterly figures. Of the 45, 43 are financially motivated extortion claims and two are destructive or politically motivated claims. Counts are observed leak-site claims: publicly posted claims that name an organization, collected up to 10 October 2026. A company listed more than once for the same incident counts once. We attribute an organization to a country by its headquarters or main operations, using its domain and public profile, and we leave out entries whose main operations are elsewhere. Visibility differs by country, so the counts are not complete incident totals and are not a like-for-like measure of national risk.

Three caveats apply to everything below.

• Leak sites show only victims who did not pay or negotiate privately. Real incident counts may be higher. One report cites a demand above USD 5 million against an unnamed UAE private company in September, which appears on no leak site we track.
• A group’s claim is not proof of compromise. We have not verified any dataset.
• Attributing a victim to a country is imperfect, and the UAE is a regional hub: many firms operate across several Gulf states. Some UAE victims will be missed, and some regional firms are counted by their UAE headquarters. Treat our counts as what we observed, not as a complete tally of incidents.

Terms. RaaS: ransomware-as-a-service, a platform that developers rent to independent affiliates. EDR: endpoint detection and response, security software on servers and laptops. Infostealer: malware that steals saved credentials and sessions from infected devices. White-label: a model in which affiliates run attacks under their own brand using the platform.

2. Timeline: the Gulf’s two largest markets move differently

Q1 was busy for two reasons. The Gentlemen posted four claims in 24 days, and the war began. Iranian strikes hit Gulf states from 28 February, and reporting says drone strikes damaged three AWS data centers in the UAE in early March, causing outages. Q2 dipped to 12. Q3 recovered to 17 as Krybit arrived and DragonForce and INC kept their pace. Early Q4 is already at four claims in nine days (Seven Seas, Flydubai, the UAE Pro League, and PMG).

Stream one is the war. The head of the UAE Cyber Security Council said the IRGC is "one of the main players" behind attacks on the country, and that daily breach attempts rose from 90,000 to 200,000 before the conflict to between 600,000 and 800,000 after it, with 640,000 on a single day in September. These are attempted breaches as the official described them, not confirmed intrusions, and the figures are not broken down by actor. He described advanced, organized attacks on aviation, energy, and education in August, after attacks on financial institutions in July, and said AI has accelerated the attacks. Positive Technologies put the UAE at 35% of Gulf cyberattacks in H1 2026, against Saudi Arabia at 15%. Most of this volume is automated and never becomes a leak-site post. The part that does shows up as persona claims in March (Section 5, Case 2).

Stream two is criminal. It ignores the war and works exposed VPNs, firewalls, and weak credentials, as it does everywhere. CloudSEK counted Middle East ransomware activity rising from 17 incidents in April 2025 to 357 in June 2026. Rescana's May advisory adds that attackers weaponize vulnerabilities within 48 hours of disclosure and that most UAE breaches begin with phishing or fraudulent messages.

The UAE and the Kingdom side by side

Seven groups appear in both countries: The Gentlemen, DragonForce, INC Ransom, APT73, Krybit, Tengu, and Handala. The UAE is more fragmented at the top and more diverse by sector. The Kingdom is more concentrated in one group and one value chain, and it is accelerating while the UAE is flat. Visibility differs by country, so the gap in observed claims does not show a proportional gap in actual incidents. Our companion report on the Kingdom covers the Saudi side in full.

3. The groups at a glance

Qilin is absent here too. The world's most prolific group by Q1 counts has no 2026 claim in our UAE data, as in the Kingdom. We read that as a gap in visibility, not safety, and return to it in the outlook.

The UAE has more repeat operators than the Kingdom. Four groups run steady operations (The Gentlemen, DragonForce, INC, Krybit), four more posted twice, and thirteen appeared once. For a defender the lesson is the same as in the Kingdom: the long tail is too wide to track by name.

4. Who is being hit

Our own classification of the 45 claims. Each claim is counted once, and industrial and construction firms are combined into one analytical category. Where a group spans several sectors we classify by its primary business, and diversified family groups form their own category.

• Industrial and construction: 10. Al Arif Contracting, Al Shafar GRC, Al Ishrak Contracting, Midal Cables, Harwal, MCT, Wozair, Aboura Metals, Intherpro, Geebee Garments.
• Diversified family and holding groups: 8. Al-Futtaim, Lals, AASA, Al Khaja, Al Dhow, AIMS, ARENCO, Mohammad Omar Bin Haider.
• Technology: 7. GBM, Sibca, secure.ae, Shipox, Propertyfinder, Progress Security Systems, GIT Dubai.
• Hospitality and retail: 4. Two hotels, a home-interiors retailer, a fashion brand.
• Transport and aviation: 3. Emirates National Group, Autostrad, Emirates Flight Catering.
• Professional services: 3. A training firm, a law firm, a printing and office-automation firm.
• Financial: 3. A debt collector, an insurance and reinsurance group, a forex broker.
• Government, energy, and utilities: 5. A federal ministry, a Dubai government air wing, the federal customs authority (persona claim), Sharjah's utility authority, and Sharjah National Oil Corporation (persona claim).
• Education and other: 2. Abu Dhabi Indian School and Dolrad.

Three patterns stand out. Builders and manufacturers lead: 22% of claims sit in industrial and construction firms, which run lean IT, depend on subcontractor networks, and hold project data on large clients. Family groups are a second target class, as in the Kingdom: eight diversified groups, including a retail and automotive conglomerate with operations across the region. And the claims reach the public sector selectively: three government bodies on leak sites against eight on forums.

In the UAE the ransomware risk is not in the headline brands. It is in the contractor, the supplier, and the family group next door.

5. Case files

Counts show the shape of the problem. Individual cases show how it works. Each case below states what was claimed, what the timing and structure suggest, and how far we trust it.

Case 1. The aviation ecosystem (Nova, Everest, Q1 to Q4)

Claims. Dubai Air Wing, the government VIP aviation body (Nova, 13 Jan, with a promise of employee and financial data to follow). Emirates Flight Catering and the Al-Futtaim Group (Everest, both 5 Aug). Flydubai (Everest, 6 Oct): 4.36 GB across 16,517 files, which the group says include flight-operations and crew-training documents, personnel records, and proprietary Boeing source code. In Q4 a separate claim also named Seven Seas, a maritime services group.
Reading. The targets sit in a chain: a government flight body, a ground-services supplier, a retail and automotive conglomerate, and a carrier. Everest's model suits the chain. It buys or recruits access, steals data early, and sometimes skips encryption entirely, so an airline can lose data without any outage. The Flydubai claim also shows leverage by third-party code: source code belonging to an aircraft maker is a supplier problem, not only a carrier problem. The UAE Cyber Security Council's August statement on contained aviation attacks is consistent with attention on this sector, but it does not tie any criminal claim to a state actor.
Confidence. Moderate. The claims and their contents come from the actor. No victim has confirmed them.

Case 2. The war stream in March (Handala, Nasir Security)

Claims. 2 March: Handala claims Sharjah National Oil Corporation, with 1.3 TB of financial data, oil contracts, and project details. 3 March: it claims Aramco in the Kingdom. 23 March: Nasir Security posts two teasers promising the "most massive hack operation in UAE history". 26 March: it claims access to the Federal Customs Authority, with religious and resistance rhetoric and no evidence.
Reading. These claims arrive in the first four weeks of the war and are written as messages, not offers. Neither names a price or deadline. In the same period reporting says Iranian drones damaged three AWS data centers in the UAE, which shows the physical and cyber fronts running together. Public reporting links Handala to Iran's intelligence ministry and describes its wipers, so a claim from it deserves a recovery plan even when its volumes look inflated. Nasir Security has no public profile, no data, and no sample, so we class it as influence activity.
Confidence. Moderate on Handala's attribution, low on both groups' claimed impact.

Case 3. The Gentlemen: a Q1 burst, then a slower drip

Claims. Sibca (21 Jan), Marina Home Interiors (6 Feb), Emirates National Group (12 Feb), Autostrad (13 Feb), then a gap of 127 days to Al Khaja Holding (20 Jun), Al Dhow Group (1 Jul), and AIMS Group (9 Aug).
Reading. Four claims in 24 days against three in the following six months can be read as affiliates working a batch of acquired access and then moving on, though other explanations fit. Targets include family groups, logistics firms, and ICT integrators. In the Kingdom the same group did the opposite: one claim in each of Q1 and Q2, then four in Q3. Together the two patterns suggest the same affiliate pool moving its attention, though it has not left the UAE (the AIMS claim is only two months old).
Confidence. High on the cadence. Moderate on the rotation reading.

Case 4. DragonForce works in batches (June and July)

Claims. 12 June: Al Shafar GRC (a glass-fiber concrete maker), Corniche Hotel Abu Dhabi, and Al Ishrak Contracting. 14 July: Midal Cables and Graphic International Centre, a printing and office-automation firm active since 1982.
Reading. Five of DragonForce's seven UAE claims arrived in two same-day batches. The victims share no sector, which is what white-label affiliates produce: one operator works down a list of mid-market firms they could reach, then posts together. The same-day pattern is a detection hint in itself. If one UAE firm you work with is named, check whether their IT supplier, ISP, or managed-service provider also serves the others.
Confidence. High on the batching. Low on any shared vector.

Case 5. Krybit’s Gulf run (June to September)

Claims. Progress Security Systems (12 Jun), AASA Group (19 Jun), GIT Dubai (1 Jul), Intherpro (12 Sep), Kashkha (13 Sep), plus Efada in the Kingdom (24 Sep). Six Gulf claims from a brand that appeared in March.
Reading. Two of the five UAE victims sell security or imaging technology (Progress Security Systems, an Abu Dhabi integrator, and GIT Dubai), a profitable class of target because their clients trust them. Claims arrive in short runs: two in June a week apart, one on 1 July, then two on consecutive days in September after a ten-week silence. That fits an affiliate cashing in access in short windows and staying quiet in between. A brand this young is also likely to rebrand, so track its infrastructure and affiliates, not only its name.
Confidence. High on counts. Low on tooling and on how long the brand lasts.

Case 6. 27 April: a ministry and a utility on the same day (APT73)

Claims. The Ministry of Climate Change and Environment, and the Sharjah Electricity, Water and Gas Authority, on the same day as two Saudi claims by the same group.
Reading. Our Kingdom report covers this batch in full. The UAE angle is the targets themselves: a federal ministry and a utility authority on a leak site are rare in our data, and they arrived alongside two unrelated private organizations. A shared IT or service supplier is one hypothesis worth checking.
Confidence. Moderate that it is one batch, low on the vector.

Case 7. Real-estate data that keeps resurfacing (Coinbase Cartel)

Claims. Propertyfinder, claimed in November 2025 and listed for auction on 30 March 2026, with its CRM. Coldwell Banker UAE in December 2025, tagged with USD 17.3 million in revenue. Earlier real-estate targets include Asteco (2024).
Reading. The same sector keeps appearing, and the same data can be re-listed months later. Coinbase Cartel steals data without encrypting anything, and about 80% of its victims had infostealer infections beforehand. A real-estate platform holds names, phone numbers, passport and Emirates ID copies, and payment details for buyers and tenants, so credential hygiene and session revocation matter more here than backups.
Confidence. Moderate. The infostealer link comes from vendor analysis of the group overall, not from these victims.

Case 8. A staged leak: 700 GB in two steps (Stormous)

Claims. 2 May: Stormous posts a teaser against an insurance and reinsurance group, claiming control of 700 GB including compliance audit data and banking records. 11 May: it posts an updated, fuller listing.
Reading. Staging a disclosure resets the clock and extends press coverage, giving the group two pressure events from one victim. Insurers and reinsurers hold other firms' claims and audit data, so the harm can reach clients who were never part of the intrusion. The UAE's financial regulators and the insurer's own reinsurance partners will want notice quickly.
Confidence. Moderate.

6. Active threat actors: presence, motivation, and TTPs

The nine actors profiled below account for 31 of the 45 claims. The other 14 are spread across twelve groups, covered at the end of this section. Their public technical detail comes from global incident reporting, not from the UAE cases. We have no incident-level evidence from UAE victims, so read the tradecraft below as what each actor is known to do, not proof of what happened to a named UAE company. Technique IDs refer to MITRE ATT&CK.

Summary: motive and presence

What the actors share

Brands differ, but behavior converges. The matrix shows which techniques each major group is documented using. A technique that many groups share is a better detection target than any single group’s indicators.

Marks reflect public reporting on each group worldwide, not UAE incident evidence.

Actor profiles

The long tail, and one earlier precedent

• APT73. Two claims on 27 April, covered in Case 6 and in our Kingdom report.
• BlackNevas. Two UAE claims in October 2025 (Choithrams, a grocery chain, and Trojan Construction, an Abu Dhabi group of eight subsidiaries) in which it offered corporate-network access and an IT insider pressed into cooperating. It is not in our 2026 UAE data, but it has returned to the Gulf with Saudi and Omani claims.
• Medusalocker. Two claims (Dolrad, 1 July; Aboura Metals, 12 September), both with email-harvest metadata in the listing. Thin public reporting.
• Stormous. Staged disclosure on an insurance and reinsurance victim: a 700 GB teaser on 2 May, then a full update on 11 May. Staging escalates pressure and extends press coverage.
• Nova. Claimed Dubai Air Wing, a government aviation body, on 13 January. CloudSEK counts Nova as Gulf-focused across its 17-month review window, and it also claimed Saudi victims in 2025.
• Nasir Security. A war-aligned persona. On 23 March it posted two teasers promising the “most massive hack operation in UAE history”, then on 26 March claimed access to the Federal Customs Authority, with religious and resistance rhetoric. No data volume or proof offered. We treat it as influence activity until evidence appears.
• Meowciety403. One claim: a Dubai forex and brokerage firm, posted 2 September. The listing cites 216 PDF files covering HR, legal, and daily corporate-action reports, plus API keys. API keys in a leak are the part to act on first.
• Akira. One claim on 28 September against an apparel manufacturer with UAE and Bangladesh facilities, announcing 100 GB to follow, including passports and financials. Akira is a major global brand, so a single Gulf claim is not a trend.
• Br0K3R (historical). An Iran-linked access broker active since about 2017 that sells domain access to ransomware crews and takes a share of payouts. Its victim list includes UAE organizations. It is the clearest precedent for state-adjacent access feeding criminal ransomware.
• Lynx, CipherForce, Lamashtu, Payload. One claim each: an IT firm, a logistics platform, a Fujairah hotel, and a Dubai conglomerate. Mid-market, mixed maturity, no distinctive Gulf pattern.

Before 2026: the UAE record

The UAE has been a steady ransomware target for years. Government and large-organization victims over 2022 to 2025 include Dubai Municipality (Daixin, June 2024), an alleged UAE government web-root dump (Pyrx, 2024), American Hospital Dubai (Gunra, 40 TB claimed, July 2025), Lux Actuaries and Consultants (Medusa, 928.5 GB, October 2025), Rixos Hotels (Embargo, March 2025), and the Emirates Red Crescent and the Society of Engineers (Kazu, November 2025). Late 2025 also saw a run of small-business claims, such as tourism operators and a private school priced in Monero (Bqtlock, 50 to 66 XMR), which shows the low end of the market. The Iran-linked access broker Br0K3R, active since about 2017, lists UAE victims and sells domain access to criminal crews, which is the clearest precedent for state-adjacent access feeding ransomware.

7. Beyond the leak sites: forum and Telegram claims

Ransomware crews post victims on their own sites. Everyone else posts on criminal forums and Telegram channels: data sellers, access brokers, hacktivists, and attention seekers. Our tracking set holds 142 UAE-tagged posts, led by the handles BIGBROTHER (7), Anonymous2090 (6), dravik1 (5), and sexyskin (5). We reviewed in detail 33 posts published between 25 July and 10 October 2026. This is an eleven-week sample, so we read it as a snapshot of the market, not a trend. We name no victims here. The claims are unverified, many are recycled, and naming a target would amplify an unproven claim.

What the 33 posts target

• Government and security: 8 (24%). Two posts on one interior-ministry claim (4 TB), a ministry of education, an industry ministry, an identity and citizenship authority, a government agency, an "authorized software" claim, and a military-unit post. The highest stakes and the least verifiable.
• Mass personal data: 6. Listings of ID and driving-licence images, resident records, GSM data, real-property owner data, a travel platform with 4 million records, and an influencer platform with 63,000.
• Consumer and mobility platforms: 5. Vehicle marketplaces, an EV-charging platform, and a holiday operator.
• Finance and insurance: 3. A claim of 64 GB of bank accounts and IDs, a named regional bank, and an insurance data listing.
• Healthcare: 2. A hospital and patient portal and a healthcare careers site.
• Network access for sale: 2. An SSL-VPN access listing on a Fortinet device, and CMS access to a payments platform.
• Energy, holding, professional, technology, and other: 7. Including one post naming the national oil company.

Who is posting, and on which platform

Two layers show clearly. Forums carry the commercial layer. Data sellers and access brokers post personal-data dumps, consumer platforms, and access listings, mostly under one-off handles. dravik1 alone posted five (an interior-ministry claim twice in two days, a bank-accounts claim, an ID and licence set, and a Sharjah claim). Telegram carries the war layer. Three posts name an industry ministry, an identity authority, and the national oil company, under names such as Infrastructure Destruction Squad, 404Crew Cyber Team, and Qital-e-adl. Those are persona names with political framing, and they target government and energy, not victims chosen for resale value.

Six handles posted in both the UAE and our Saudi sample over the same weeks: DaOnlySpark, Keishell, 4ss3, honeydutch, Anonymous2090, and s-root. It is a regional seller base working both markets. Two examples show why that matters. 4ss3 posted a military-unit claim in the UAE on 2 September and a Saudi Army claim on 26 August, a week apart. Anonymous2090 spans hospitals, holding groups, universities, and real estate across both samples, with no sector logic. When one handle names state or military entities in both countries within days, the better reading is attention-seeking, and verification should come before escalation.

Why this matters for ransomware risk

An SSL-VPN access listing on a Fortinet device is the front end of a ransomware chain, because FortiGate exploitation is a documented entry route for several groups in this report (NightSpire, Dire Wolf, INC). We cannot link the listing to any claim, and we do not. But organizations running Fortinet SSL-VPN should treat the listing as a reason to check their own devices now, because the interval between an access sale and a leak-site post is usually days to weeks.

Confidence. That the posts exist: high. That each describes a real breach: low. That any maps to a ransomware incident: low. For government claims, verify before you escalate. Check whether the data is old or public, whether it matches your records, and whether the poster offers sample files.

8. How they get in

Leak sites show victims, not intrusions, so this section draws on public regional reporting. The consistent picture:

• Phishing and social engineering lead on the front line. Rescana reports that over 75% of UAE breaches begin with phishing or fraudulent messages. DragonForce's help-desk approach fits this profile.
• Vulnerabilities are weaponized within 48 hours. The May advisory lists exploited flaws in Ivanti, Microsoft Office, and Cisco IOS XR among its priorities, and the region as a whole shows 38% of incidents starting from vulnerability exploitation (Positive Technologies).
• Edge devices are the door. Fortinet and Citrix flaws appear in the documented tradecraft of INC, NightSpire, and others, and an SSL-VPN access listing was on sale in August.
• Stolen credentials and sessions. Coinbase Cartel's model rests on infostealer logs, and about 80% of its victims had prior infections.
• Insiders and coercion. Everest recruits insiders, and BlackNevas has offered an IT employee pressed into cooperating.
• AI is accelerating the work. The council's head says AI has dramatically accelerated attacks, and CloudSEK reports Iran-linked groups using AI for tooling and phishing lures.

9. The regulatory frame

The federal personal data protection law is Federal Decree-Law 45 of 2021, supervised by the UAE Data Office created under Federal Decree-Law 44 of 2021. The law sets a breach-reporting duty, but the reporting period and the procedures are left to executive regulations. Published accounts conflict on whether those regulations have been issued: some commentators say they had not been as of mid-2026, others say they have. We could not verify either account from an official source, and we could not verify a generally applicable statutory notification deadline in the sources we reviewed, so we state none. That is not a claim that none exists. Free zones add their own regimes: the DIFC and ADGM each run separate data protection laws with their own regulators. Financial institutions answer to their sector regulator, and the UAE Cyber Security Council coordinates national cyber defense. Our description of these regimes is general and relies on secondary reporting rather than a review of the legislation text. Rules differ by emirate, free zone and sector, so confirm which regime governs each entity before an incident. We are not lawyers: take legal advice for any specific case.

10. Outlook for Q4 2026 and Q1 2027

These are our forecasts, not findings, and each rests on the limited data above.

1. Volume stays high. Four claims were recorded in the first nine days of October 2026. We expect 12 to 18 in the quarter, consistent with the 2026 range.
2. Aviation, sport, and entertainment stay in view. Flydubai and the UAE Pro League in the first week point to brand-name targets where the story itself is leverage.
3. Krybit and DragonForce continue. Krybit may rebrand, but its affiliates will not leave. DragonForce keeps working mid-market firms in batches.
4. Third-party and supply-chain claims grow. Expect more consultants, integrators, contractors, and platform vendors, where one compromise exposes several clients.
5. Access listings will surface as claims. Expect forum-listed UAE access to reappear as leak-site victims within weeks.
6. Qilin remains the open question. The group leading the world has no UAE claim in our data. If its affiliates turn to the Gulf, volume could jump quickly.
7. The war stream follows politics. A ceasefire lowers destructive risk, and escalation raises it, with energy, aviation, and government first in line.

11. What to do this quarter

1. Patch the edge first. Inventory every internet-facing VPN, firewall, and remote access gateway, starting with Fortinet SSL-VPN and Citrix. Set a proposed internal target of 48 hours to patch actively exploited flaws, use compensating controls where patching cannot be immediate, and prioritize by confirmed exploitation, exposure, asset criticality, and vendor guidance.
2. Harden the help desk. Require strong identity checks before any password reset or MFA re-enrollment, especially for privileged users. This is the DragonForce door.
3. Hunt for your own credentials and sessions. Check infostealer logs for employee and vendor accounts, reset what appears, and revoke sessions as well as passwords.
4. Rank your suppliers by what they hold. Find the five outside firms with the most sensitive data on you, such as consultants, integrators, and platform vendors. Ask each for MFA, EDR, and offline-backup evidence.
5. Minimize the data you hold on customers. Real-estate, travel, and mobility platforms are repeat targets. Retain ID and passport copies only as long as you must.
6. Separate the wiper plan from the extortion plan. Offline, tested restores for destructive attacks. Legal, communications, and negotiation readiness for data theft. They are different exercises.
7. Prepare for coercion of staff. Give employees a safe, fast way to report any approach, especially in IT and finance, and treat it as an incident.
8. Rehearse the double-extortion call. Know which regime governs you (federal, DIFC, ADGM, or a sector regulator), who notifies whom, who briefs the board, and who decides on negotiation. Write it down and test it.
9. Watch for your name. Leak sites, Telegram channels, and broker forums post your data before you hear about it. Detection there buys days.

Sources

• The National, Iran's IRGC behind many cyberattacks on UAE, says security chief
• The National, Ransomware activity rises across Middle East (CloudSEK data)
• Positive Technologies H1 2026 Gulf findings, via TECHx
• Check Point Research, The State of Ransomware Q1 2026
• Rescana, UAE Cyber Threat Landscape 2026
• Rescana, Flydubai Everest breach claim advisory
• Cybernews, Flydubai data hijacked
• SOCRadar, Al-Futtaim Group data breach claim
• SOCRadar, Emirates Flight Catering data breach claim
• Cyberwarfare during the 2026 Iran war (event overview)
• Hive Pro, Handala claims destructive wiper attack on GCC nation
• Picus Security, Handala threat group profile
• Proven Data, Coinbase Cartel
• Hive Pro, Coinbase Cartel: the encryption-free data extortion group
• Barracuda, NightSpire: wannabe warlords in ransomware's shadow realm
• Infosecurity Magazine, The Gentlemen overtakes Qilin
• Sophos, GOLD IONIC deploys INC ransomware
• Blackpoint Cyber, DragonForce threat profile
• SOCRadar, Dark Web Profile: Krybit
• Chambers, Cybersecurity 2026: UAE trends and developments

Sources are linked in their original language.