T between April 2025 and 31 August 2026, as cybercriminals, hacktivists and state-linked actors increasingly targeted organisations across the country, according to CloudSEK’ s Middle East Cyber Threat Landscape 2025 – 2026.
CRITICAL INFRASTRUCTURE
UAE records 2,588 cyberthreat indicators as attacks expand across critical sectors
he UAE recorded 2,588 cyberthreat activity indicators
T between April 2025 and 31 August 2026, as cybercriminals, hacktivists and state-linked actors increasingly targeted organisations across the country, according to CloudSEK’ s Middle East Cyber Threat Landscape 2025 – 2026.
The report placed the UAE among the region’ s most targeted countries, with activity affecting critical infrastructure, maritime and industrial companies, government entities and financial services organisations. Threats ranged from ransomware and phishing to darkweb exposure and state-linked operations.
One notable incident occurred on 15 April 2026, when hacktivist group Handala targeted UAE critical infrastructure. According to CloudSEK, Handala has historically focused primarily on Israeli organisations, making the incident a significant expansion beyond its traditional targeting.
CloudSEK also observed increased activity involving MuddyWater, an Iran-linked threat group. Campaigns included phishing attacks using regional airline-themed lures and corporate-document decoys, while another operation targeted UAE maritime and industrial companies with malware designed to provide access to compromised systems.
Ransomware activity surged
The UAE threat landscape formed part of a sharp increase in ransomware activity across the Middle East. CloudSEK recorded ransomware activity rising from 17 threat intelligence feeds in April 2025 to 357 in June 2026, representing an increase of more than 20 times over the April baseline.
Turkey was the region’ s most targeted country for ransomware, followed by Israel, the UAE, Egypt and Saudi Arabia. Groups frequently targeted sectors where disruption could have an immediate operational impact, including industrial operations, infrastructure, manufacturing, facility management and property management.
CloudSEK also linked the UAE to specific ransomware activity during the reporting period. LockBit5 targeted soeuae. ae in August 2026, while NasirSecurity claimed an operation involving targets including Dubai Airport and UAE Customs, alongside organisations in other countries.
Dark-web exposure remained a concern
Beyond direct attacks, CloudSEK identified sustained criminal interest in UAE and Gulf organisations across underground cybercrime platforms.
Stolen credentials, initial-access listings and leaked corporate information were particularly concentrated around organisations in the UAE, Saudi Arabia and Kuwait. Financial services and government were among the sectors most frequently appearing in dark-web activity, followed by banking, e-commerce, retail, education and telecommunications.
The report also documented activity involving threat actor xpl0itrs, linked to TeamPCP, which advertised access to Middle Eastern government and financial services environments for between $ 2,000 and $ 40,000 per victim. UAE entities were among those affected, according to CloudSEK.
Across the wider Middle East, three forces were shaping the threat environment simultaneously: politically motivated hacktivism, financially motivated ransomware and state-linked cyber espionage. Government and financial services were the most targeted sectors overall, while critical infrastructure and energy attracted significant attention from advanced threat actors.
Artificial intelligence was also beginning to appear in offensive operations. CloudSEK documented MuddyWater using Google’ s Gemini model for PowerShell code obfuscation and identified evidence suggesting AI-assisted malware development by the IRGClinked Nimbus Manticore group.
CloudSEK assessed the Middle East cyberthreat environment immediately following the reporting period as“ ELEVATED-HIGH”, identifying UAE and Saudi critical infrastructure organisations among those facing the greatest risk from ransomware escalation and advanced threat actors.
The findings indicate that UAE organisations increasingly face overlapping threats rather than a single dominant attack vector, combining financially motivated cybercrime, politically driven campaigns, underground criminal activity and state-linked operations.
WWW. INTELLIGENTCISO. COM / MIDDLE-EAST 29