On this page
- How many ransomware attacks hit Saudi Arabia in 2025?
- Which ransomware groups are targeting Saudi organisations?
- Which sectors are ransomware groups hitting in Saudi Arabia?
- How do ransomware groups get into Saudi networks?
- What do NCA ECC controls require that helps against ransomware?
- How should a Saudi organisation prepare for a ransomware attack?
- How do you test whether your ransomware defences actually work?
- How Sumrite helps
- Frequently asked questions
Saudi ransomware reports usually lead with headline incidents. This post uses counted data instead. It draws on three published sources: the NAUSS regional report, Positive Technologies’ Middle East threat research, and SOCRadar’s Gulf threat report. It then maps what those sources say about attacker behaviour to the controls Saudi organisations already have to run.
For the wider Saudi threat picture, read our overview of cyber threats facing Saudi businesses in 2026.
How many ransomware attacks hit Saudi Arabia in 2025?
NAUSS counted 31 ransomware victims in Saudi Arabia in 2025, up from 17 in 2024, an increase of about 82%. Across 14 Arab countries, the report counted 147 victim organisations in 2025, up from 96 in 2024. Saudi Arabia accounted for about 21% of the regional total.
The NAUSS Ransomware Trends Report in Arab Countries 2025 is published by the Centre for Cybercrime and Economic Crime at Naif Arab University for Security Sciences in Riyadh. Released in 2026, it covers 1 January to 31 December 2025. Its unit of analysis is a distinct victim organisation named on a ransomware leak site and checked against open sources. Repeat posts about the same victim count once.
| Measure (NAUSS) | 2024 | 2025 |
|---|---|---|
| Ransomware victims, Arab region | 96 | 147 |
| Arab countries affected | 15 | 14 |
| Victims in Saudi Arabia | 17 | 31 |
| Victims in the UAE | 26 | 38 |
| Victims in Egypt | 11 | 24 |
| Saudi share of regional victims | about 18% | about 21% |
Two caveats matter when you quote these numbers. First, NAUSS calls the totals a lower bound. Victims who pay quietly never appear on a leak site. Second, one chart in the report labels Saudi Arabia’s 2025 share as 34%, but the report’s own counts (31 of 147) and text give about 21%. Use 21%.
Other sources see the same ranking. SOCRadar’s Gulf Region Threat Landscape Report 2026, published 18 August 2026, puts Saudi Arabia at 17.80% of ransomware attacks in the Gulf, second to the UAE at 56.36%.
Which ransomware groups are targeting Saudi organisations?
CL0P was the most active ransomware group against Saudi victims in 2025, with 5 incidents, followed by Kill Security with 3 and Qilin with 1, according to NAUSS. Those three groups account for 9 of the 31 Saudi incidents. The remainder is spread across a long tail of smaller operations.
Across the whole Arab region in 2025, NAUSS tracked 48 active groups. CL0P and Qilin led with 9 victims each, and INC Ransom and Kill Security followed with 8 each. LockBit, a leading group in 2024, declined sharply. RansomHub, which topped the 2024 list with 19 victims, also dropped out of the lead.
Positive Technologies’ Current cyberthreats in the Middle East report covers Q2 2025 to Q1 2026. It names Ralord, Tengu, KillSec, Everest, Qilin, RansomEXX and Cl0p among groups that attacked Saudi organisations. Across the Middle East in that period, ransomware made up 30% of the malware used in attacks.
What this means for defenders: the group names change every year, but the methods do not. Plan against techniques, not brands.
Which sectors are ransomware groups hitting in Saudi Arabia?
NAUSS reports that ransomware in Saudi Arabia expanded across critical manufacturing, energy-adjacent sectors, commercial enterprises and government entities in 2025. It does not publish Saudi-only sector counts. Across the region, Commercial Facilities led with 44 victims, followed by Critical Manufacturing with 23 and Financial Services with 16, up from 7 in 2024.
Positive Technologies’ executive summary for the same Q2 2025 to Q1 2026 period gives Saudi-specific figures for all successful cyberattacks, not only ransomware:
- Government agencies
- 35% of successful attacks on Saudi organisations
- Manufacturing and industry
- 20%
- Retail and services
- 10% each
- Saudi share of Middle East attacks
- 12%, second after Israel
- Period covered
- Q2 2025 to Q1 2026
Manufacturing appears in every source. Plants run long-lived systems that are hard to patch and costly to stop, and that combination pushes victims towards paying. If you run operational technology, read the NCA ECC compliance guide alongside NCA’s OT controls.
How do ransomware groups get into Saudi networks?
Ransomware groups active in Saudi Arabia mainly get in through phishing, exploited public-facing applications and stolen credentials. NAUSS maps 28 MITRE ATT&CK techniques across the three most active groups. Phishing (T1566) and user execution (T1204) recur across all of them.
The group-level detail in NAUSS is useful:
- CL0P: NAUSS lists exploitation of public-facing applications (T1190) as its primary vector. CL0P is known for mass exploitation of file-transfer software.
- Qilin: NAUSS describes heavy reliance on credential-based intrusion, with phishing as a common first step.
- Timing: Regional incidents rose in the second half of 2025 and peaked in November, with 31. NAUSS links the Q4 rise to holiday staffing, year-end change freezes and commercial activity.
Positive Technologies reports a similar mix for Saudi Arabia. Malware featured in 55% of attacks, vulnerability exploitation in 40%, and social engineering and DDoS in 30% each. Those percentages overlap because one attack often uses several techniques.
Each entry point has a matching test. Exposed applications call for web application VAPT and external network VAPT. Phishing calls for phishing simulations; we cover AI-written lures in AI-powered phishing in Saudi Arabia. Stolen credentials call for identity hardening and an assumed-breach exercise.
What do NCA ECC controls require that helps against ransomware?
The NCA Essential Cybersecurity Controls (ECC-2:2024) do not mention ransomware by name, but five ECC subdomains directly reduce ransomware risk: backup and recovery, vulnerability management, penetration testing, incident and threat management, and cybersecurity resilience. ECC applies to government entities and private organisations that own, operate or host critical national infrastructure. NCA strongly encourages all other entities in the Kingdom to adopt it.
The control text below is from the official ECC-2:2024 document on nca.gov.sa.
| ECC-2:2024 subdomain | What it requires | Ransomware relevance |
|---|---|---|
| 2-9 Backup and Recovery Management | Backups of critical assets, quick recovery, periodic testing of recovery | Recovery without paying |
| 2-10 Vulnerability Management | Find and fix technical vulnerabilities | Closes the T1190 entry point |
| 2-11 Penetration Testing | Periodic tests of externally provided services, including email and remote access | Proves the perimeter holds |
| 2-13 Incident and Threat Management | Response plans, escalation, reporting incidents to NCA, threat intelligence | Fast, coordinated containment |
| 3-1 Resilience in BCM | Continuity of security systems, disaster recovery plans | Keeps the business running |
| 1-10 Awareness and Training | Awareness programme covering phishing emails | Reduces initial access |
For a control-by-control view, use our NCA ECC checklist. For control 2-11 in detail, see NCA penetration testing requirements. Financial institutions also answer to the SAMA Cyber Security Framework.
How should a Saudi organisation prepare for a ransomware attack?
Prepare for ransomware by closing the common entry points, limiting how far an attacker can spread, and proving you can restore critical systems without the attacker’s key. Each step below produces evidence that also counts towards ECC.
- Inventory internet-facing assets. List every VPN, remote access gateway, file-transfer server and web application. Ransomware crews scan for these first.
- Patch by exploitability, not age. Prioritise vulnerabilities with known exploits on internet-facing systems, in line with ECC 2-10.
- Enforce phishing-resistant MFA on email, remote access and administrator accounts, so a stolen password alone is not enough.
- Separate and protect backups. Keep at least one copy offline or immutable, with separate credentials, and test a full restore under time pressure (ECC 2-9).
- Segment the network. Make it hard to move from a user laptop to domain controllers, backup servers or OT networks.
- Write and rehearse the response plan. Decide who isolates systems, who calls NCA, who talks to customers and who handles personal data notifications under the PDPL (ECC 2-13).
- Plan for the Q4 peak. NAUSS saw incidents peak in November. Keep monitoring staffed through holidays and change freezes.
A ransomware incident usually involves data theft as well as encryption. If personal data is taken, the Personal Data Protection Law (PDPL) breach notification duties apply on top of NCA reporting. For the financial impact, see our analysis of the cost of a data breach in Saudi Arabia.
How do you test whether your ransomware defences actually work?
You test ransomware defences by simulating the attack chain end to end: initial access, spread, privilege escalation and impact, then a timed recovery. A policy document proves intent, not resilience. Testing turns each control into evidence.
External and internal penetration testing
Finds the exposed services and internal weaknesses ransomware crews use, such as unpatched servers, weak service accounts and flat networks. See [penetration testing in Saudi Arabia](/blog/penetration-testing-saudi-arabia).
Assumed-breach red teaming
Starts from a compromised laptop and measures how far an operator can get before detection. See [red team operations](/services/red-team-operations).
Phishing simulations
Measures whether staff click, enter credentials or report the lure, including AI-written messages.
Restore drills
Times a real restore of a critical system from protected backups and records the result for ECC 2-9.
Use ransomware groups’ known techniques as the test plan. A test that only runs automated scans will not show whether an operator can reach your backups.
How Sumrite helps
Sumrite runs ransomware-readiness testing end to end with our verified NCA-registered partner firm: internal and external network VAPT, assumed-breach red team exercises, phishing simulations and restore verification. Every finding maps to the ECC-2:2024 controls above, with retesting once you have fixed it. Sumrite has served 100+ Saudi clients across Riyadh, Jeddah, Dammam and other cities. Our Saudi Arabia page explains how we deliver a VAPT report for Saudi reviews in 48 hours.
Find out how far ransomware could get
Tell us which systems keep your business running and we will scope a test that follows a real ransomware attack chain. Book a scoping call.
Frequently asked questions
How many ransomware attacks hit Saudi Arabia in 2025?
Naif Arab University for Security Sciences (NAUSS) counted 31 Saudi ransomware victims in 2025, up from 17 in 2024. That placed Saudi Arabia second among Arab countries after the UAE, which had 38. NAUSS counts victims named on ransomware leak sites, so the real number is likely higher.
Which ransomware groups target Saudi Arabia?
The NAUSS Ransomware Trends Report in Arab Countries 2025 attributes 5 Saudi incidents to CL0P, 3 to Kill Security and 1 to Qilin. Positive Technologies also names Ralord, Tengu, Everest, RansomEXX, Qilin, KillSec and Cl0p among groups that attacked Saudi organisations between Q2 2025 and Q1 2026.
Does NCA ECC have a ransomware control?
The NCA Essential Cybersecurity Controls (ECC-2:2024) do not use the word ransomware. Several ECC subdomains still address it directly: 2-9 Backup and Recovery Management, 2-10 Vulnerability Management, 2-11 Penetration Testing, 2-13 Cybersecurity Incident and Threat Management and 3-1 Cybersecurity Resilience in business continuity.
How do ransomware groups get into Saudi organisations?
The NAUSS report finds phishing and user execution recurring across the most active groups, with exploitation of public-facing applications and stolen credentials also prominent. Positive Technologies reports malware in 55%, vulnerability exploitation in 40% and social engineering in 30% of attacks on Saudi organisations between Q2 2025 and Q1 2026.
What is the best way to test ransomware readiness?
Ransomware readiness is best tested with a combination of internal network penetration testing, an assumed-breach red team exercise, phishing simulations and a timed restore from backups. Each test answers a different question: can attackers get in, can they spread, will staff report the lure, and can the business recover.
