Ransomware activity rises across Middle East as criminal groups attack Gulf

Ransomware activity has surged across the Middle East, with criminal groups increasingly targeting Gulf businesses, according to new research. Cybersecurity firm CloudSEK documented a rise from 17 incidents in April 2025 to 357 in June, indicating a shift in focus for established groups. Shashank Shekhar, CloudSEK's managing editor, noted that the Gulf was not initially a primary target but has become one rapidly since 2025.

Groups like The Gentlemen and Nova have targeted Saudi businesses, with The Gentlemen building databases of compromised network devices. The increase in digital infrastructure and unpatched firewalls and VPN gateways have provided more entry points for attackers. Gavin Millard, Tenable's vice president of intelligence, emphasized that ransomware is part of a global trend, with attackers seeking easy and profitable victims.

Israel and Turkey faced distinct threats, with Israel targeted due to its status and Turkey due to its economic sectors. Critical infrastructure is particularly attractive to ransomware groups, as disruptions can significantly impact services and demand higher ransoms. The UAE reported a hacker demanding over $5 million after claiming to breach and destroy data, with authorities working to contain it.

The UAE saw an 800,000 daily hacking attempt increase since the war, with authorities thwarting attacks on aviation, energy, and education sectors. AI is amplifying established methods, making it easier for lone attackers to have state-level capabilities, according to Millard.