Skip to main content
Darkfield

Ransomware victim disclosure

← All victims

Dubai International Airport

Claimed by NASIR · listed 3 days ago

1000 documents
Records
3d
Age
since listed · listed for ransom

Status timeline

  1. ListedJun 10, 2026

Current state: Listed for ransom

At a glance

Group
NASIR
Status
Listed for ransom
Country
United Arab Emirates
Sector
Transportation/Aviation
Listed on leak site
Jun 10, 2026
Records
1000 documents

About the victim

AI dossier — public-source company profile

Dubai International Airport is a major international aviation hub serving the emirate of Dubai, United Arab Emirates. It is one of the world's busiest airports by international passenger traffic and cargo volume.

Industry
Transportation/Aviation

Attack summary

Severity: critical — Claimed exfiltration of passport data and PII at scale (1,000+ documents) from critical infrastructure (major international airport), involving biometric/identity information of multiple nationalities with direct geopolitical threat context.

The NASIR group claims to have obtained unauthorized access to Dubai International Airport's systems and possesses classified intelligence information. The group threatens to release approximately 1,000 documents including passport photos and data of multiple nationalities on a specified anniversary date.

critical

Data the group says was taken

AI dossier — extracted from the leak post
  • Passport reproductions
  • Passenger photos
  • Personal identification data
  • Classified intelligence documents

What the group claims

Threat actor claims to have gained access to classified intelligence information from Dubai International Airport over several months. They announce plans to release 1,000 documents including passport photos and reproductions of multiple nationalities (Emirati, American, Arab, and others) on the anniversary of a Hezbollah attack. They state they will not publish photos of Emirati citizens to protect them.

The leak post

captured from the group's site
We are the sons of the Nasir Resistance. We have succeeded in obtaining the capability for hacking and accessing classified intelligence information from Dubai International Airport over the past months, and this capability is now active and operational.Therefore, we challenge and offer a reward of fifty thousand dollars to anyone who can uncover our presence within the systems of Dubai International Airport.On the anniversary of Hezbollah’s glorious attack on the Israeli spider’s house, we will release one thousand documents from Dubai International Airport. These include photos and reproductions of passports of multiple nationalities — Emirati, American, Arab, and others — for review and use by the concerned parties, particularly Hezbollah and the resistance forces in Iraq.We have chosen not to publish photos of Emirati citizens in order to prevent their exploitation by any parties and to protect them from the malicious intents of the United Arab Emirates.God is Great.And from God comes success. 
نحن ابناء المقاومة النصىير لقد تمكنا للحصول علي الامكانية الهك و الرصد المعلومات السرية في المطار الدبي الدولي منذ الاشهىر المنصرمة و هذة الامكانية في تناول اليد و قيد العمل. لهذا نحن نت…

Data the group says was taken

  • passport photos
  • passport reproductions
  • classified intelligence documents

Screenshot of the leak post

Leak screenshot for Dubai International Airport

Sources

Source

Indexed 3 days ago

This page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.

Is this your supplier? Your competitor? You?

Pro plans monitor your domain, corporate emails, and crypto wallets across every new ransomware leak-site post, breach dump and Telegram callout — alerts within 5 minutes.

Disclosure context

About NASIR

NASIR is an emerging ransomware group first observed in June 2026 with a apparent financial motivation, having claimed responsibility for attacks against at least seven known victims across the Middle East region. The group's targeting pattern strongly suggests a geopolitical or regional focus, with victim organizations concentrated in the United Arab Emirates, Israel, Saudi Arabia, and Kuwait, spanning high-value sectors including government, energy and oil, transportation, aviation, and cultural and memorial institutions. Given the limited open-source intelligence currently available on NASIR, its country of origin, affiliation with known threat actor ecosystems, and whether it operates under a Ransomware-as-a-Service model or as an independent closed group have not been publicly confirmed by authoritative sources such as CISA, the FBI, or Mandiant as of this writing. The group's sector targeting — particularly government, energy infrastructure, and aviation — suggests a deliberate focus on critical national infrastructure across Gulf Cooperation Council states and Israel, which may indicate either a financially motivated actor seeking high-value targets capable of large ransom payments, or an actor with ideological or geopolitical objectives. No specific tools, encryption methods, or extortion tactics employed by NASIR have been publicly documented or attributed by reputable security researchers at this time, and no major law enforcement actions against the group have been publicly reported. NASIR should be considered an emerging and closely monitored threat given its critical infrastructure targeting pattern, with the expectation that additional technical attribution and campaign details will surface as the group's operational tempo develops. The group has been linked to 8 public disclosures across our corpus. First observed on a leak site on June 10, 2026; most recent post June 11, 2026. The operation is currently active.

Timeline of this disclosure

  • June 10, 2026Dubai International Airport listed by NASIRon the group's public leak site
Records
1000 documents

Other recent disclosures by NASIR

NASIR has been linked to 8 public victims on Darkfield. A sample of the most recent:

See the full NASIR dossier →

Sector and geography

This disclosure adds to ransomware activity in the Transportation/Aviation sector. Geographically, Dubai International Airport is reported in United Arab Emirates, a country with 32 ransomware disclosures in our corpus.

If your organisation is affected

A listing by NASIR means Dubai International Airport appeared on a ransomware extortion site and is being pressured to pay before any publication. If this is your organisation, or a supplier you depend on, the priority is to confirm the intrusion and contain it before the window to act closes.

  • Engage your incident-response team and preserve forensic evidence before remediating — do not wipe affected systems first.
  • Force a password reset and revoke active sessions for exposed accounts; rotate any credentials, API keys or certificates that may have been in the stolen data.
  • Assess regulatory notification duties (GDPR, NIS2, sector regulators) — many carry a 72-hour reporting clock from awareness.
  • Monitor for the data appearing on NASIR's leak site and across paste and breach channels, and brief downstream partners who may be exposed through you.

How we know this. Darkfield monitors public ransomware leak sites continuously, archiving every new disclosure and the data later released against the victim. Each entry on this page is sourced from the operator's own publication and cross-checked against complementary OSINT feeds (RansomLook, ransomware.live, RansomWatch). We do not collect or host stolen data — only the metadata, timestamps and screenshots needed to make the public disclosure searchable and accountable. Records here are corrected when the original post is edited, retracted, or merged with another disclosure.