A ransomware crew that surfaced only this month has put three Egyptian technological universities on its leak site in five days, and says it took a combined 1.5 terabytes from them. The group, which calls itself UmBra, is a big part of why Egypt's count on the extortion sites has jumped this month. These are claims the crews posted themselves, and none has been independently verified.
In IntelFusions' own incident data, Egypt has drawn eight leak-site claims since October 6, 2026, against two in the six weeks before that. They come from five separate crews, so this is not a single campaign, but the education cluster stands out.
Three universities in five days, one new crew
UmBra posted Beni Suef Technological University (BTU) on October 6, describing it as Egypt's first technological university and claiming 900GB of data (tracker entry). It followed with a faculty of Cairo University on October 8, claiming 163GB (tracker entry), and Helwan International Technological University on October 10, claiming 481GB (tracker entry). None of the posts says what kind of records the data holds.
The ransomware.live tracker labels UmBra a new group and warns that its claims should be treated with caution until independently verified. Ten listings in our data, all posted between October 6 and October 10, include two more universities, IIT Roorkee and the Manipal Academy of Higher Education in India, plus South African mining group Tharisa. Half of its victims so far are universities. The crew has posted nothing since October 10. Its full list is on our UmBra profile.
For Helwan, the tracker's page also shows infostealer data from Hudson Rock: 165 compromised employees and 18,219 compromised users on the university's domain. That is a known credential exposure, not evidence of how UmBra got in, or that it got in at all.
A Telecom Egypt listing that describes a training academy
On October 18, N0n posted a listing under the name and web domain of Telecom Egypt, the country's incumbent telecom operator (tracker entry). Read the post, though, and it describes something much narrower: a "computer training academy" whose course materials, exam preparation files, student account folders and course database the crew says it holds. It does not describe network, customer or subscriber data. Readers should not take the listing as a claimed breach of the carrier's core systems. N0n is a prolific newcomer we first covered in New extortion crew opens with a ministry and an ISP, and it also listed an unnamed Egyptian organization on October 15.
The other recent Egyptian listings are a real estate developer, MODON Developments, posted by Krybit on October 24 (tracker entry), a LockBit listing of lcww.com.eg, and a NightSpire claim against Royal EGT.
Universities should hunt back to early October
For the named institutions, and for peers across Egypt's higher education sector:
- Review outbound traffic, new administrator accounts and remote access tools for the weeks before each listing date.
- Reset any staff and student credentials that infostealer monitoring reports as exposed, and enforce multi-factor authentication on email and remote access.
- Check backups of student information and learning management systems are offline and tested.
- Report confirmed or suspected compromise to EG-CERT, Egypt's national computer emergency response team.
Leak-site claims are sometimes inflated, recycled or false, and a crew this new has no track record to judge it by. But a group whose first week was half universities, on two continents, looks like one treating campuses as a deliberate focus rather than a coincidence, and Egypt's newer technological universities accounted for three of the five.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.