Flydubai Ransomware Claim by Everest - Oct 2026

Claim Summary

The Everest ransomware group has allegedly listed Flydubai, the Dubai-based low-cost carrier, on its dark web leak site. According to the threat actor, the claimed attack date is October 6, 2026. The group has not disclosed a data volume, and no sample files, screenshots, or proof-of-compromise artifacts have been publicly referenced in the listing data reviewed by Yazoul Security.

Flydubai is a government-owned airline founded in 2008, operating passenger and cargo services across the Middle East, Africa, Asia, and Europe from Dubai International Airport. As a state-linked aviation operator, any purported intrusion would carry elevated regulatory and national-interest implications.

At this stage, this remains an unverified claim. Listing a victim on a leak site does not confirm that data was exfiltrated, that systems were encrypted, or that the claim is genuine.

Threat Actor Profile

The claim is attributed to everest, a ransomware operation that has been tracked across multiple regions and sectors. Public research on Everest is limited, and our internal tracking does not currently associate the group with a documented, stable toolset. Known tools and tactics are listed as unknown in the source intelligence, which limits confident attribution of tradecraft.

What is generally understood about groups using the Everest brand is that they have historically favored double extortion - combining data theft with encryption - and have targeted large enterprises where operational disruption creates pressure to negotiate. However, because no public research references are available for this specific cluster, we cannot confirm whether this activity matches prior Everest campaigns or represents an affiliate using the brand.

No YARA rules or detection signatures specific to this claim are available at the time of writing. Analysts should rely on generic ransomware detection guidance: monitoring for mass file modification, shadow copy deletion, unusual outbound data transfers, and unauthorized access to backup infrastructure.

Alleged Data Exposure

The leak site entry does not specify a data volume. The claimed data description appears to be a general company profile rather than a technical inventory of stolen files, which is a notable weakness in the claim’s credibility. Ransomware groups seeking to pressure victims typically publish file trees, sample documents, or partial datasets to substantiate their assertions. The absence of such evidence here means the alleged exposure cannot be characterized.

If the claim were accurate, plausible categories of data at risk for an airline could include passenger records, loyalty program data, employee information, and operational or vendor documentation. None of this has been confirmed, and we are not publishing any data samples, credentials, or access details.

Potential Impact

For a government-owned carrier, potential consequences of a genuine incident could include operational disruption to booking or ground systems, regulatory scrutiny under UAE cybersecurity and aviation frameworks, and reputational damage given the airline’s role in regional connectivity. Supply chain and partner airlines could also face downstream risk if shared systems were affected.

These are hypothetical impacts based on the claim, not observed outcomes. Flydubai has not publicly confirmed any incident as of this report.

What to Watch For

• Official statements from Flydubai or UAE authorities confirming or denying an incident.
• Publication of verifiable proof-of-compromise artifacts by the threat actor.
• Regulatory filings or aviation authority advisories referencing service disruption.
• Credential or data resale activity on other criminal forums that could corroborate the claim.
• Follow-on extortion attempts against Flydubai customers, partners, or passengers.

Organizations in aviation and adjacent sectors should review backup isolation, multi-factor authentication coverage, and third-party access controls regardless of this claim’s validity.

Disclaimer

This report is based solely on an unverified claim published by a ransomware group on its leak site. Yazoul Security has not independently verified that Flydubai was compromised, that any data was stolen, or that the threat actor’s assertions are truthful. Ransomware operators frequently exaggerate or fabricate claims to pressure victims and attract attention. Nothing in this report should be treated as confirmation of a security incident. Readers should await official confirmation from the organization or relevant authorities before drawing conclusions.