I am seeing a 700 percent surge in Iranian state sponsored attacks since June 13, 2025. That is not a typo.
This is the new baseline for cyber risk in the Middle East, and Gulf critical infrastructure is already inside the blast radius. UAE and Saudi Arabia now absorb the majority of regional targeting, incident costs are materially higher than global averages, and the operational tempo of Iranian aligned actors has not slowed.
The uncomfortable truth is simple: budgets are rising, but readiness is not keeping pace. Attackers are not impressed by spending. They are impressed by gaps.
Key takeaways
- The Gulf is absorbing spillover from a regional cyber conflict that is no longer containable
- Iranian aligned groups are operating with proven playbooks across IT and OT environments
- OT exposure remains structurally high, especially remote access, monitoring, and vulnerability hygiene
- Initial access is increasingly commoditized through credential markets and supplier ecosystems
- Boards must treat geopolitical escalation as an immediate cyber scenario, not a strategic abstraction
Why this matters now
If you operate energy, water, transport, government services, or financial infrastructure in the Gulf, you should assume you are already a target.
Not because you did something wrong.
Because your region sits at the intersection of geopolitical intent, high value operational systems, and supplier heavy ecosystems that are easier to compromise than most leaders admit.
- This is not a future threat.
- This is operational reality.
The numbers boards have not fully absorbed. UAE and Saudi Arabia now absorb 66 percent of all cyberattacks targeting the region.
The average cost per incident in the Middle East sits at $8.75 million, nearly double the global $4.45 million average. Ransomware groups targeting UAE organizations increased from 12 in 2023 to 19 in 2024.
DDoS activity surged 70 percent year over year and now accounts for 73 percent of reported regional incidents. These are not background statistics.
They are leading indicators of sustained pressure on the region’s most critical services.
What changed in 2025
I do not see the Iran Israel cyber war as contained.
Gulf states are absorbing spillover activity from both sides, and that spillover is now persistent. Since June 13, Iranian aligned groups including APT33, APT34, MuddyWater, and CyberAv3ngers have intensified campaigns against energy, aerospace, defense, and water environments across the GCC.
Microsoft tracked an expansion from 9 to 14 active Iranian threat groups within two weeks of the October 2023 escalation. That operational tempo has not slowed.
Saudi Arabia and the UAE have evolved from passive targets to active participants in regional cyber conflict.
But readiness does not mature at the same speed as adversary intent.
Attackers are not waiting.
What Iranian APTs are actually doing
When leadership asks, “What does this look like in practice,” I prefer specificity over slogans.
Here is what I am seeing.
APT34 OilRig
- Weaponized CVE 2024 30088, a Windows Kernel privilege escalation vulnerability, within weeks of its June 2024 disclosure
- Deployed STEALHOOK backdoor to exfiltrate credentials via Microsoft Exchange servers
- Used malicious password filter DLLs to capture plaintext passwords during password changes
- Ran supply chain style lures, including fake UAE IT company sites, to compromise government adjacent contractors
MuddyWater
- Deployed BugSleep, a newer implant discovered in May 2024
- Used scheduled task persistence on aggressive intervals
- Demonstrated tooling designed to evade or degrade endpoint visibility
- Group IB reporting showed elevated volumes, including concentrated spearphishing bursts across multiple sectors
CyberAv3ngers
- IRGC affiliated group sanctioned by US Treasury in February 2024
- Deployed IOCONTROL, an ICS specific malware family
- Targeted hundreds of OT and ICS devices globally, including Unitronics PLCs, Orpak fuel systems, and Phoenix Contact equipment
- Demonstrated a clear pattern of targeting equipment commonly found in industrial environments
These are not theoretical capabilities.
They are operational.
OT exposure is worse than most realize
Dragos tracks 23 threat groups worldwide with 9 active in OT operations, including groups associated with Gulf sector targeting.
And the structural weaknesses remain consistent across environments.
- 65 percent of OT environments maintain insecure remote access conditions
- Only 52 percent of organizations use OT specific monitoring
- Only 31 percent have SOC capability with OT specific expertise
- 13 percent of engineering workstations and HMIs maintain insecure internet connections
- 36 percent of OT assets contain Known Exploited Vulnerabilities
This is why “we have IT security” is not an OT security strategy.
OT failures are rarely caused by exotic exploits. They are caused by visibility gaps, access sprawl, and slow governance.
FrostyGoop demonstrated how unauthenticated Modbus TCP communications can be abused in real operations. There are tens of thousands of internet exposed Modbus devices globally. The Ukraine heating outage affecting hundreds of buildings showed what real world OT impact looks like when availability is the goal.
The credential market makes entry cheap
The Gulf region commands premium attention on criminal markets. UAE and Saudi Arabia dominate regional cybercrime postings.
In many cases, initial access is not “hacked.” It is purchased.
- Corporate access can sell for as little as $15 to $35
- High privilege access for banks can command prices in the tens of thousands
- VPN access listings have surpassed RDP in many marketplaces
- Victims often appear on leak sites within weeks of being listed by initial access brokers
Stolen credentials remain a leading initial access vector in Middle East breaches, and they carry the highest cost per incident in the region.
MFA is not a guarantee either.
Push fatigue and session theft tactics have scaled. Adversary in the middle platforms automate real time interception, and cookie theft markets continue to expand. When identity is the control plane, identity becomes the battlefield.
Where I still see gaps
Across Gulf environments, the same patterns repeat.
- Government and manufacturing remain top targets, followed by energy and military sectors
- One in three successful attacks in the region now involves an APT group
- 80 percent of incidents result in confidential data exposure
- Critical vulnerabilities persist for years in some environments
- Default credential abuse remains common in industrial penetration testing
- Underreporting remains the norm due to reputational risk, masking true scale
If leadership dashboards rely on reported incidents, they will systematically underestimate exposure.
Real incidents from the last 12 months
This is not abstract.
- DragonForce ransomware hit Al Bawani, a major Saudi construction firm, with claims of 6TB exfiltration including sensitive infrastructure data.
- BlackMeta ran sustained DDoS operations against a UAE bank for more than 100 hours.
- Stormous issued public extortion demands against UAE government entities.
Kuwait’s Ministry of Health was compromised in September 2024.
Bahrain’s Ministry of Interior faced claimed breaches with large scale data theft.
Bybit, a Dubai based crypto exchange, suffered a $1.4 billion theft attributed to North Korean state backed actors.
Halliburton reported $35 million in losses following ransomware impact in August 2024. None of these required zero days.
Most exploited known gaps in remote access, credential management, identity governance, and third party oversight.
Supply chain exposure is systemic
Supplier ecosystems are the quiet multiplier.
SecurityScorecard analysis found that a large percentage of top UAE enterprises have suppliers that experienced breaches. Exposure extends through fourth parties as well.
Supply chain attacks have increased, and APT34’s playbook has included supplier themed compromise paths designed to harvest access and pivot into regulated targets.
The lesson is not “ban third parties.”
The lesson is “treat third party access like production code.” Version it, review it, monitor it, and remove it when it no longer serves a validated business purpose.
Ransomware economics favor attackers
Confirmed attacks against Middle Eastern organizations increased materially in 2024, with the UAE seeing notable growth. Major families continue to operate despite disruptions, and extortion models have matured.
Double extortion is standard.
Triple extortion is increasingly deployed, combining theft, disruption, and customer pressure.
Manufacturing remains among the highest payment rate sectors globally, and the region’s operational dependence on availability makes that economic pressure sharper.
Regulation is hardening, and enforcement is coming
- Saudi Arabia’s NCA enforcement posture has escalated.
- PDPL enforcement and breach notification requirements are real.
- UAE IA controls and penalty structures are maturing.
- Regulators are no longer issuing guidance.
They are preparing to enforce.
This matters because regulators often become the forcing function that boards respond to. The organizations that treat compliance as the floor, not the ceiling, will be the ones that sustain operations under pressure.
What leadership must do now
This is where most posts become vague. I will not.
1) Unify geopolitical risk and cyber risk
Stop treating them as separate conversations.
For the Gulf, they are the same conversation with the same consequences.
2) Assume pre positioning is underway
The question is not whether adversaries mapped your environment.
It is whether you have validated yours.
3) Eliminate low hanging vectors immediately
- Remove default credentials on PLCs and HMIs, including Unitronics exposure paths
- Reduce remote access sprawl, enforce just in time access where possible
- Patch high leverage perimeter and identity vulnerabilities quickly
- Implement phishing resistant MFA for privileged access and remote access
4) Build OT specific detection and response
- OT monitoring coverage must reach 100 percent for critical environments
- Baseline Modbus, DNP3, and OPC UA traffic patterns
- Establish OT incident decision authority and escalation paths
- Train SOC analysts on OT context, not just tools
5) Treat vendor access as a board level control surface
- Inventory every vendor connection
- Validate purpose, scope, and expiry
- Monitor sessions and enforce segmentation
- Audit fourth party exposure where feasible
6) Pressure test response under real conditions
Tabletops help.
Live simulations expose decision latency, authority gaps, and invisible dependencies.
If your containment cycle still measures in months, you are optimizing paperwork, not resilience.
The board question that matters
If the Iran Israel conflict escalates further, what is our exposure, and who owns that answer?
Ownership is the difference between risk awareness and risk management.
Conclusion
Gulf states are spending billions on cyber defense.
But spending is not readiness.
Attackers are not impressed by budgets.
They are impressed by gaps.
If your organization operates energy, water, transport, or financial infrastructure in the Middle East, the threat environment has permanently shifted.
The question is whether your posture has shifted with it.
What is the one assumption your team has not pressure tested this year?
Sources
- Dragos 2025 OT ICS Year in Review Positive Technologies Middle East
- Threatscape Report 2024 to 2025 Trend Micro APT34 Research October 2024
- Microsoft Digital Defense Report 2024 to 2025
- IBM Cost of Data Breach Report 2024
- CybelAngel Middle East Analysis 2024
- Claroty Team82 Research Group IB
- MuddyWater Analysis CISA CyberAv3ngers Advisory
- SecurityScorecard Third Party Risk Analysis
- Resecurity DragonForce Research Dark Reading
- Middle East Banking Security Report