Du

Du was compromised in a ransomware attack attributed to dragonforce in November 2025. The organization, operating in the Telecommunications sector in UAE, was added to the group's data leak site as part of an extortion campaign.

dragonforce operates as a financially motivated ransomware-as-a-service (RaaS) operation, exfiltrating sensitive data and threatening public disclosure to pressure victims into paying ransom demands.

Emirates Integrated Telecommunications Company P.J.S.C., commercially rebranded as du in February 2007, is one of the two main telecom operators in the United Arab Emirates. du offers fixed line, mobile telephony, internet and digital television services across the UAE. It also provides carrier services, a data hub, internet exchange facilities and satellite service for broadcasters. It expanded its services in support of economic and social transformation of UAE and operates subsidiaries such as EITC Investment Holdings Limited, Edara (Telco Operations FZ-LLC), Smart Dubai Platform Project Company LLC and EITC Singapore PTE. LTD.

Intelligence correlations link this incident to 1 vulnerability(ies) including CVE-2025-5777, which may have been leveraged as initial access vectors or for lateral movement.