Ransomware victim disclosure

Matouk Bassiouny

Claimed by raworld · listed 2 years ago

19m

Age

since listed · data leaked

Status timeline

Listed
Oct 25, 2024
Data leaked

At a glance

Group: raworld
Status: Data leaked
Country: EG
Sector: Business Services
Listed on leak site: Oct 25, 2024

About the victim

AI dossier — public-source company profile

Matouk Bassiouny is a full-service MENA (Middle East & North Africa) law firm headquartered in Cairo, Egypt. The firm specializes in arbitration, corporate law, M&A, finance, capital markets, and dispute resolution, serving multinational corporations and regional clients across multiple sectors with offices in Egypt, UAE, Sudan, Algeria, Libya, and satellite locations in New York and South Korea.

Industry: Legal Services – Corporate, M&A, Arbitration, Dispute Resolution
Address: Cairo, Egypt

Attack summary

Severity: high — Law firm breach with data publication indicates likely exfiltration of sensitive client confidential information (M&A details, litigation strategies, corporate transactions), which poses significant business and legal risk to multinational and regional clients, even without explicit proof file count.

The raworld group claims to have breached Matouk Bassiouny and published data. No specific details on encryption, exfiltration method, or data types are stated in the available post excerpt.

high

Data the group says was taken

AI dossier — extracted from the leak post

Client confidential files
Legal matter documentation
Corporate transaction records
Dispute resolution case files

What the group claims

Matouk Bassiouny is a prominent law firm based in Cairo, Egypt, known for its expertise in arbitration, corporate law, and dispute resolution. The firm serves a diverse clientele, including multinational corporations and local businesses, offering legal services across various sectors. With a strong regional presence, Matouk Bassiouny is recognized for its skilled legal team and client-focused approach.

Sources

Victim sitematoukbassiouny.com
Leak posthttp://raworldw32b2qxevn3gp63pvibgixr4v75z62etlptg3u3pmajwra4ad.onion/post/4213.html

Source

Indexed 2 years ago

This page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.

Is this your supplier? Your competitor? You?

Pro plans monitor your domain, corporate emails, and crypto wallets across every new ransomware leak-site post, breach dump and Telegram callout — alerts within 5 minutes.

Disclosure context

About raworld

Raworld is a relatively new ransomware group that emerged in May 2023, operating with primarily financial motivations and demonstrating a broad international targeting approach. The group's origin and specific affiliations remain unclear based on publicly available information, though their targeting patterns suggest they may operate independently rather than as part of a larger ransomware-as-a-service ecosystem. Limited public documentation exists regarding their specific attack methodologies, though their victim profile spanning multiple sectors including business services, technology, manufacturing, and healthcare suggests they likely employ opportunistic targeting rather than highly specialized initial access vectors. With 112 documented victims across major economies including Germany, the United States, United Kingdom, France, and Italy, Raworld has demonstrated significant operational capability despite their recent emergence, though specific details about notable high-profile attacks or law enforcement disruption efforts have not been widely reported by major threat intelligence organizations. As of current reporting, the group appears to remain active, though the limited public intelligence available makes definitive assessment of their operational status challenging. The group has been linked to 112 public disclosures across our corpus. First observed on a leak site on May 6, 2023; most recent post December 28, 2024. The operation is currently inactive.

Timeline of this disclosure

October 25, 2024Matouk Bassiouny listed by raworldon the group's public leak site

Other recent disclosures by raworld

raworld has been linked to 112 public victims on Darkfield. A sample of the most recent:

Watertown Public SchoolsEducation · United States · December 28, 2024