PIONEER KITTEN is an example of MENA’s emerging cyber threats. An Iran-based adversary that focuses on gaining access to entities of interest to the Iranian government; a blend of commercial IAB and espionage.
The combination of initial access brokers and ransomware-as-a-service is guiding a new, dangerous era of cyber threats worldwide. True that the U.S. is the first target by numbers, but MENA is becoming a growing target.
The question we’re here to answer is how initial access brokers operate in MENA, and what makes it different?
IAB and RaaS groups never decided to make MENA a primary target, but their environment grows to match the marketplace.
The first common thing between IABs and MENA is economic. IAB’s most targeted sectors are government, retail, and IT, which happen to be the most fundamental sectors of MENA, more than any Western country.
The High-Tech Crime Trends Report 2026 has numbers that explain why MENA is worth a broker's attention. Underground markets’ paid tier saw a 58% jump in MEA-region activity in 2023, with 903,002 compromised hosts put up for sale. Egypt alone accounted for 160,006 of those logs, the single largest concentration in the region, harvested mostly by four stealers: Raccoon, LummaC2, RedLine, and Vidar.
In 2025, Group-IB identified more than 200 cases of corporate access linked to META (Middle East, Turkey, and Africa) organizations being publicly advertised for sale. GCC countries logged over 100 reported ransomware incidents on their own, and other affected countries included South Africa, Egypt, Morocco, and Turkey. The most targeted sectors were real estate (39), financial services (25), and manufacturing (23). And the buyers aren't random opportunists but the largest groups in the industry: LockBit and BlackCat.
What's changing isn't just how often access gets sold, but how the broker operates once it's sold.
The old model was to hand over credentials, take payment, and leave the picture. Pioneer Kitten, for instance, shows how that's shifting. Rather than handing off domain admin access to ransomware affiliates and walking away, it stayed in the deal, helping with deployment and taking a cut of whatever the ransom amounted to. Other brokers are following, and that’s a harder problem than the one with those who sell and leave.
In the U.S., a breach like this becomes a headline, a lawsuit, or a public case study that other companies learn from. That’s how cyber awareness is built there due to the density and overlap of state laws and sector rules: public IoCs, known APTs, and direct data that can protect you from what’s close.
In MENA, things are different. For example, Saudi Arabia’s National Cybersecurity Authority requires incident reporting, while SDAIA requires notification within 72 hours when a breach is likely to cause harm. Across the region, organizations are increasingly expected to report significant incidents, assess potential impact, and comply with evolving cybersecurity and privacy regulations. Regional authorities have also expanded their ability to investigate breaches and hold organizations accountable. However, this does not necessarily translate into public breach databases or widely publicized case studies. An incident can be reported, investigated, and resolved without ever becoming public. This means the absence of headlines about your sector or country is not proof that nothing is happening. Organizations should remain vigilant even when threats are not publicly visible.
The generic IAB advice is still the foundation:
Yet, for MENA specifically, protection is more about finding hidden signals and paying attention to your security details:
Passing a compliance audit confirms you met a baseline. It tells you nothing about whether your access is already listed for sale somewhere. Audits are fundamental, but relying on them for your security is a risk.
Active dark web and credential-leak monitoring matters more here precisely because the regional disclosure culture won't always surface a peer's breach. A CTI platform becomes valuable for monitoring, analysis, and flagging issues in one place. Defendis is built specifically for this.
Government, financial, and telecom dominate MENA's economy and happen to be exactly what IABs go after most. So concentrate on MFA, conditional access, and privileged access management first.
Fast government and enterprise digitization, following Vision 2030 and Morocco's own 2030 cybersecurity strategy, expands the attack surface immediately. Security measures and monitoring should move at the same pace, not after.
Automated scanning doesn't check whether your organization is well-known or not. Having data, credentials, and the least attention in the market makes you the best target.
The silence around most incidents in MENA doesn't mean these operators are scarce. It means the region rarely finds out, and when it does, it's late.
The organizations that hold up best here won't be the ones with the cleanest compliance file. They'll be the ones who stopped waiting for a headline to tell them they were already on the list.
