Ransomware activity rises across Middle East as criminal groups attack Gulf

Ransomware attacks in the Middle East have surged recently, targeting Gulf businesses and sectors, according to a new study by cybersecurity firm CloudSEK. From April to June 2025, CloudSEK recorded the number of ransomware incidents skyrocket from 17 to 357. Shashank Shekhar, CloudSEK's managing editor, explained that the Middle East was previously not a primary target for ransomware, but this changed rapidly in 2025.

Groups such as The Gentlemen and Nova have been actively targeting Saudi businesses and other Gulf companies. Established criminal groups are now focusing on the region, taking advantage of the growing digital infrastructure and common vulnerabilities like unpatched firewalls and VPN gateways as entry points. Experts noted that ransomware is a borderless activity, with attackers prioritizing the easiest and most profitable victims rather than their location.

Israel and Turkey faced distinct threats; Israel faced targeted attacks due to its nature, while Turkey attracted ransomware groups due to its industrial sectors. Critical infrastructure is especially attractive, as disruptions can lead to higher ransoms required for service restoration. A recent incident in the UAE saw a hacker demand over $5 million after claiming to breach a private company, destroy data, and attempt to leak stolen information.

UAE authorities collaborated with the company to neutralize the attack. The UAE saw a significant rise in cyber threats since the war began, with over 800,000 hacking attempts per day as of April. Iranian-linked groups, along with China, Israel, North Korea, and Russia, were involved in various cyber operations, with AI tools amplifying established methods and lowering the entry barrier for new hackers.