In 2024, organizations around the Middle East continued the arduous work of improving cyber resiliency while facing an increasingly hostile threat environment.

Fueled by ongoing conflicts and geopolitical tensions, state-sponsored attackers, hacktivists, and their blended cousins, “hactivist soldiers,” regularly targeted organizations’ networks and data with a variety of cyberattacks, from denial-of-service to ransomware.

Yet increasingly, the region is also a target of financial cybercriminals as well: Ransomware group Stormous, for example, has been associated with pro-Russia hacktivists but — over the past year — has more frequently conducted attacks against organizations in the Middle East, says Sergey Shykevich, threat intelligence group manager at Check Point Research.

“I think that when [Stormous attackers] started, the motivation was mainly hacktivism, but it was probably like a nice excuse to make money,” he says. “They’re not doing anything on the hacktivism front, but they’re continuing to attack organizations in the Middle East just for money.”

In addition, organizations in the region have to worry about financially motivated cybercriminals targeting the region, as it continues to develop economically. With the Gulf Cooperation Council (GCC) countries accounting for about 54% of the more than 3,000 startups in the MENA region, cybersecurity is becoming an economic necessity, research firm Statista stated in its “MENA Startups 2025” report.

Overall, the focus on cybersecurity in the Middle East led to a great deal of maturing, says Jon France, CISO for the (ISC)2 security professional group and based in the United Arab Emirates.

“The region has definitely been maturing very, very quickly,” he says. “We’re seeing large-scale digital transformation projects, both within government and within the private sector, and they’ve done it with cybersecurity in mind as well, so it’s been a focus … for a large portion of that.”

Top 5 Cybersecurity Trends in the Middle East in 2024

Here are the top cybersecurity trends in 2024 for the Middle East region.

1. Ransomware Attacks Surge

Ransomware attacks affected organizations throughout the region in 2024. While state-sponsored groups are well funded and not as reliant on ransomware, cybercriminal groups — and hacktivists needing funding — increasingly attacked companies, especially small and midsize businesses (SMBs). Hacktivists groups, such as Stormous, have increasingly engaged in ransomware and extortion attacks to make up for less funding than their state-sponsored counterparts.

Over the past 18 months, for example, more than half of SMBs in Saudi Arabia (62%), the UAE (62%), and South Africa (56%) have been victimized by a ransomware attack, according to a November 2024 report by software firm Datto.

2. Spyware and Cyber Espionage

The continued conflicts throughout the region has led to significant threats to the citizens of the Middle East, with nation-state groups using sophisticated spyware to target them. NSO Group’s Pegasus system has been used against human rights activists, journalists, and lawyers, Citizen Lab noted in late 2024 report, with the UAE and Morocco becoming major operators in the spyware market.

“While the 2017 Mexico scandal caused many Pegasus operators to scale back operations for fear of discovery, the UAE and Morocco represent an exception to this trend,” the Citizen Lab noted.

3. Zero-Days Lead to Major Breaches

State-sponsored attacks continued to lead to significant breaches due to the use of zero-day exploits. In September 2024, Iran-linked group UNC1860 used two zero-day vulnerabilities in their attacks against government and telecommunications entities throughout the Middle East, according to Mandiant. Later that same month, another Iran-linked group, UNC1433, was discovered to have targeted Israeli entities using spearphishing campaigns that lead to a malware infection.

4. Denial-of-Service Attacks Target Finance, Healthcare

Financial services and healthcare companies were the most-often targeted sectors in the Middle East, the two sectors accounting for more than half (52%) of denial-of-service attacks against organizations in the EMEA region, according to the Netscout 2H 2024 Threat Report. With cybercriminal attackers moving from volume attacks to more targeted attacks, organizations in the region are seeing an increasing number of direct-path denial-of-service attacks.

5. Supply Chain Security Concerns Grow

The threat of a supply chain compromise became a real concern for organizations in the Middle East in 2024, following a wave of explosive attacks in Lebanon in September, attributed to Israeli intelligence. While physical supply chain attacks are unlikely to be seen again, the incidents demonstrated that any electronics can potentially be vulnerable.

Outlook for 2025

The use of artificial intelligence will continue to transform the cybersecurity landscape in the Middle East region, says Shykevich. On the attack side, AI is already allowing cybercriminals to amplify their attacks, while the defenders are just getting started.

“Attackers utilize AI a lot, both for social engineering… [and] writing malicious code or malicious tools,” he says. “From the defending side, the adoption of AI is happening, but we’re definitely in the early stages.”

Source