Moa.gov.eg listed on Lockbit5 ransomware leak site

• Ransomware group: Lockbit5
• Country: Egypt
• Sector: Government & Defense
• Announcement date: February 23, 2026

LockBit5 claims access to Egyptian government domain

The moa.gov.eg domain, which belongs to the Egyptian Ministry of Agriculture and Land Reclamation, has been listed on the LockBit ransomware group's leak site. This announcement, made on February 23, 2026, marks a new instance of the group targeting a government entity. The listing serves as a public claim by the threat actors regarding their involvement with the institution.

Details of the claimed attack

The LockBit ransomware group has officially listed the moa.gov.eg domain on their dedicated leak platform. According to the claims made by the threat actors, the incident occurred on January 20, 2026. The group alleges that they have successfully gained access to the institution's data during this period. Such claims are a common tactic used by ransomware groups to pressure organizations into meeting their demands.

Information regarding the compromised data

At this stage, there is no information available regarding the nature of the leaked or compromised data. The provided screenshot associated with the listing displays a redirection page for the LockBit 5.0 platform. The listing names no specific data types that have been targeted or exfiltrated.

Implications and security context

This action by the LockBit group may pose a significant cyber threat to government institutions. The exposure of sensitive agricultural and administrative data held by the institution could lead to operational disruptions. If sensitive information is indeed compromised, the institution may face legal obligations under data protection regulations in Egypt. Furthermore, any leaked personal data could create risks of identity theft for employees or citizens.

LockBit is a Ransomware-as-a-Service (RaaS) group that has been tracked since 2019. It is reported that the group returned with a new version after their infrastructure was disrupted in February 2024. This resurgence highlights the persistent nature of RaaS models, where developers provide ransomware tools to affiliates to carry out attacks.

General defensive considerations

Ransomware attacks often involve a process of initial access, lateral movement, and data exfiltration. Once data is stolen, groups often use double extortion, where they threaten to release the information on public leak sites if a ransom is not paid. This tactic is designed to maximize pressure on the victim by threatening reputational damage and regulatory penalties.

For organizations in the government and defense sectors, maintaining robust security postures is critical. Common defensive steps include implementing multi-factor authentication, maintaining regular offline backups, and conducting frequent security audits. Protecting sensitive administrative and citizen data is essential to maintaining public trust and ensuring the continuity of essential government services.