Qatar

This page covers cyber threats to Qatar. It brings together Qatari official news reports, Al Jazeera and AP reporting on the one major incident, and Brandefense research. Official Qatari websites such as the National Cyber Security Agency and the Ministry of Communications and Information Technology could not be read in full in our review, so the national picture here rests on reports of NCSA events by the Qatar News Agency and Qatar Tribune.

Threat groups that official sources link to Qatar

We found no threat group that an official source names as targeting Qatar. We checked MITRE ATT&CK group, software and campaign pages for a mention of Qatar and found none. We also read CISA advisories on Iranian, North Korean and other state-backed actors and found no mention of Qatar. For that reason no group profile is linked from this page. Our own Equation Group profile lists Qatar among countries that group targeted less heavily (see the research section).

Incidents on record

The incident listed below is the major one that Qatari officials and major news outlets reported widely. Where sources differ, the incident page says so. Small incidents are not listed.

How attackers target Qatar: Brandefense research

Our research mentions Qatar in two posts. Events and fraud: our World Cup 2022 analysis says the tournament drew fake tickets, phishing pages, fake mobile apps, fake social media accounts and malware. It reports that accounts of the Hayya platform, which let World Cup participants enter Qatar, were put up for sale on dark web markets. It also describes a fake streaming app that installs AndroidRAT and a cracked FIFA 23 game that carries RedLine malware. State-linked: the Equation Group profile lists Qatar among the countries that group targeted, but less heavily than a first list of countries.

How Brandefense helps

Brandefense says its threat intelligence platform watches dark web forums and marketplaces, credential trading, phishing infrastructure and threat actor activity. In plain words, Cyber Threat Intelligence is how a security team learns which groups and malware are aimed at its country and sector. Dark Web Monitoring is how it learns that staff or customer logins are for sale, and Phishing Monitoring is how it finds fake sites that copy its brand.

Law and national strategy

Qatar’s National Cyber Security Agency (NCSA) runs the national cyber program. The Qatar News Agency reported in October 2025 that NCSA tests organizations against the Data Privacy Protection Law, the Cyber Incident Management Framework, the Data Classification Policy and the Institutional Framework for Cyber Crisis Management. On 5 October 2026 NCSA introduced a national and an institutional framework for cyber risk management at its fifth Cyber Governance and Assurance Conference. An NCSA policy director tied cybersecurity to Qatar National Vision 2030. We could not open the text of the national cyber strategy or the privacy law, so we give no article-level detail.

How incident response is organized

NCSA runs a yearly National Cyber Drill. The 12th drill was set for 16 November 2025, with more than 160 domestic organizations from over ten sectors, including finance, energy, government services and communications. Qatar also hosted the first joint Arab cybersecurity exercise under the Council of Arab Cybersecurity Ministers. An NCSA director said the 2024 drill showed readiness gaps in the move to cloud computing, and that NCSA then developed rules for it. NCSA also signed an agreement with CREST International on accredited penetration-testing providers, and in October 2026 it recognized companies with certificates under the national information assurance standard (NIA) and the Qatar Common Criteria scheme.

Sectors and rating

NCSA named finance, energy, government services and communications as sectors in the 2025 drill. It announced a new compliance program with the Qatar Financial Markets Authority (QFMA) for QFMA-regulated entities. We found no official Qatari rating or index in the pages we could open.

The official pages we opened name no attack counts. Figures for Qatar will come from Brandefense Atlas.