{"id":48224,"date":"2026-09-18T06:37:27","date_gmt":"2026-09-18T06:37:27","guid":{"rendered":"https:\/\/insider18.com\/?p=48224"},"modified":"2026-09-18T07:10:21","modified_gmt":"2026-09-18T07:10:21","slug":"uae-and-saudi-arabia-accounted-for-half-of-gulf-cyberattacks-during-first-six-months-of-2026-report-finds","status":"publish","type":"post","link":"https:\/\/insider18.com\/index.php\/2026\/09\/18\/uae-and-saudi-arabia-accounted-for-half-of-gulf-cyberattacks-during-first-six-months-of-2026-report-finds\/","title":{"rendered":"UAE and Saudi Arabia Accounted for Half of Gulf Cyberattacks During First Six Months of 2026, Report Finds."},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
\u00a0<\/div>

According to the Positive Technologies executive, cybercriminals are increasingly relying on sophisticated methods, particularly malware enhanced by artificial intelligence and phishing campaigns delivered through email, WhatsApp and other popular messaging platforms.<\/h3><\/div><\/section>

\u00a0<\/p>

\u00a0<\/p>

UAE and Saudi Arabia Among Gulf\u2019s Most Targeted in H1 2026<\/h2>

\u00a0<\/p>

The UAE and Saudi Arabia emerged as major targets for cyberattacks across the Gulf during the first six months of 2026, together accounting for about half of the incidents analysed in a report by cybersecurity research firm Positive Technologies. The UAE recorded the largest share of attacks in the region, while Saudi Arabia ranked third. PT Security<\/p>

According to the study, the UAE represented 35 per cent of the cyber incidents recorded across the countries covered by the research. Iran followed with 17 per cent, while Saudi Arabia accounted for another 15 per cent.<\/p>

The findings cover Bahrain, Iraq, Iran, Kuwait, Oman, Qatar, Saudi Arabia and the UAE and examine cyberthreat activity during the first half of 2026. Positive Technologies said its research was based on open-source intelligence, dark-web information and data from various sources tracking cyber incidents, including malware operations, ransomware, distributed denial-of-service attacks and website defacements. PT Security<\/p>

The company also cautioned that the actual number of cyberattacks is likely to be higher because many incidents are never publicly disclosed. Factors such as reputational concerns can prevent organisations from reporting attacks, meaning available data cannot capture the entire threat landscape. PT Security<\/p>

Cyber activity concentrated in the first quarter<\/h3>

A striking feature of the report was the uneven distribution of incidents during the first half of the year.<\/p>

Positive Technologies found that 96 per cent of the cyber incidents recorded during the period occurred in the first quarter, while only 4 per cent were recorded during the second quarter. Researchers linked the sharp difference partly to the escalation of regional conflict and the associated increase in politically motivated cyber activity. PT Security<\/p>

The report noted that geopolitical tensions contributed to increased activity from hacktivist groups and advanced persistent threat actors.<\/p>

During the period of heightened tensions, cyber operations included attacks motivated by political objectives as well as activity by financially motivated criminals.<\/p>

The reduction in reported incidents during the second quarter was partly associated with a temporary easing of regional tensions. Positive Technologies said hacktivist activity declined as the conflict de-escalated, contributing to the significant drop in the number of recorded incidents. PT Security<\/p>

Researchers also pointed to a change in the nature of some attacks. Highly visible incidents such as distributed denial-of-service campaigns and website defacements can produce large numbers of publicly identifiable attacks. More targeted operations may remain undetected for longer periods because attackers focus on maintaining access, gathering information and avoiding detection. PT Security<\/p>

Why the UAE and Saudi Arabia attracted attention<\/h3>

The UAE was identified as the most targeted country in the report, representing 35 per cent of successful cyberattacks recorded across the Gulf.<\/p>

Saudi Arabia accounted for 15 per cent, placing it third behind Iran.<\/p>

Positive Technologies said the concentration of attacks against the UAE and Saudi Arabia was linked in part to the strength of their economies and their extensive digital transformation across multiple industries. PT Security<\/p>

Alexey Lukatsky, Chief Evangelist Officer at Positive Technologies, said organisations across sectors such as information technology, telecommunications and banking were among those exposed to cyber threats in the two countries.<\/p>

The broad range of industries operating in highly digital environments creates a large potential target base for different categories of attackers.<\/p>

The report also indicates that the threat is not confined to one type of organisation. Government bodies, industrial companies and organisations operating across multiple sectors were all affected.<\/p>

Government organisations were the biggest sectoral target<\/h3>

Government institutions recorded the highest share of successful cyberattacks across the Gulf during the period examined.<\/p>

They represented 27 per cent of incidents, according to Positive Technologies. Cross-industry or sector-agnostic attacks followed with 23 per cent, while industrial organisations accounted for 17 per cent. PT Security<\/p>

The distribution reflects the presence of several types of threat actors operating simultaneously across the region.<\/p>

Government agencies can be attractive targets for politically motivated groups, hacktivists, state-aligned actors and financially motivated criminals.<\/p>

Positive Technologies found that attacks against government institutions produced different consequences. Half of the incidents resulted in disruption to core operations, while 39 per cent led to confidential information being exposed. PT Security<\/p>

The findings suggest that government organisations face threats ranging from attempts to disrupt services to operations aimed at obtaining sensitive information.<\/p>

Industrial organisations also face significant risks<\/h3>

Industrial companies were the third-largest sectoral target, accounting for 17 per cent of successful cyberattacks in the Gulf.<\/p>

Saudi Arabia was particularly affected within this category, with half of the attacks against industrial organisations targeting facilities in the kingdom, according to the report. PT Security<\/p>

The industrial sector can be particularly sensitive because attacks against companies involved in energy, infrastructure and other critical activities can potentially affect essential operations.<\/p>

Positive Technologies identified activity involving both financially motivated criminals and state-aligned groups targeting industrial organisations.<\/p>

The report cited examples involving companies connected to the energy industry and other strategically important activities. In one case, a ransomware group compromised a company providing drilling and production services to the oil and gas sector.<\/p>

Another incident involved the theft of more than 400GB of sensitive information from a Saudi energy company involved in renewable energy, water supply and power-storage projects. PT Security<\/p>

The research also identified activity associated with the Nasir Security group, which Positive Technologies said was suspected of having links to Iran. The group targeted energy companies in the UAE, Saudi Arabia and Oman and used supply-chain techniques to compromise businesses providing engineering, construction and security services. PT Security<\/p>

Vulnerability exploitation tops attack methods<\/h3>

When the researchers examined how attackers gained access to their targets, exploitation of software and hardware vulnerabilities emerged as the leading method.<\/p>

Vulnerability exploitation accounted for 38 per cent of cyberattacks recorded across the Gulf, making it the most common initial access technique in the study.<\/p>

Malware was the second-largest category, representing 31 per cent of incidents, while social engineering accounted for 27 per cent. PT Security<\/p>

Positive Technologies said vulnerability exploitation was observed across nearly all the countries covered by the research.<\/p>

The company linked the high level of vulnerability-based attacks partly to the continued use of legacy systems, including older industrial control and SCADA environments, as well as the relative ease with which known weaknesses can be exploited.<\/p>

Attackers can also take advantage of publicly available information about vulnerabilities and proof-of-concept exploits.<\/p>

The report noted that nearly one-third of vulnerability exploitation incidents recorded in 2025 occurred within 24 hours of a vulnerability being discovered, highlighting how quickly attackers can move once information about a weakness becomes available. PT Security<\/p>

AI is changing malware activity<\/h3>

Malware was another major component of the regional cyberthreat landscape.<\/p>

According to Positive Technologies, malware deployment accounted for 31 per cent of attacks during the period.<\/p>

The company has also highlighted the growing role of artificial intelligence in malware-related activity. Cybercriminals are increasingly able to use AI tools to accelerate different parts of their operations, potentially reducing the time and expertise required to develop or modify malicious software.<\/p>

The report found that half of malware-driven attacks recorded in the Gulf targeted organisations in the UAE and Saudi Arabia.<\/p>

In 80 per cent of these incidents, the outcome included a data breach, while 73 per cent resulted in disruption to core business operations. PT Security<\/p>

Remote-access tools represented 43 per cent of the malware observed, while ransomware accounted for 35 per cent.<\/p>

The two types of malicious software can serve different purposes. Ransomware is commonly associated with financially motivated attacks, while remote-access tools can provide attackers with persistent access to compromised systems and may be used for espionage, surveillance or data theft.<\/p>

Phishing remains a major entry point<\/h3>

Social engineering accounted for 27 per cent of attacks identified in the research.<\/p>

Phishing remains an important component of this category, with attackers using communications channels that people regularly rely on for work and personal interactions.<\/p>

Cybercriminals may attempt to persuade recipients to open malicious attachments, follow fraudulent links, disclose login credentials or otherwise provide access to protected systems.<\/p>

The use of email alongside messaging platforms such as WhatsApp broadens the channels through which attackers can reach potential victims.<\/p>

Social engineering can also work alongside malware. Positive Technologies cited campaigns in which phishing messages were used to establish initial access before malicious software was deployed.<\/p>

This combination allows attackers to exploit both technical vulnerabilities and human behaviour during the same operation.<\/p>

Businesses face operational consequences<\/h3>

The consequences of cyberattacks extend beyond stolen information.<\/p>

Positive Technologies found that disruption to core business operations was the most common outcome, accounting for 58 per cent of the consequences recorded across the Gulf. PT Security<\/p>

The UAE represented 43 per cent of the attacks that resulted in operational disruption.<\/p>

The high level of digital connectivity between businesses and infrastructure can increase the potential impact of an incident. When organisations rely heavily on interconnected systems, an attack affecting one part of an operation can potentially have consequences elsewhere.<\/p>

Data breaches were another major outcome, appearing in 46 per cent of recorded cases.<\/p>

Such incidents can involve the theft or exposure of confidential information and may be associated with both politically motivated operations and ransomware campaigns.<\/p>

Positive Technologies also recorded damage to state interests in 29 per cent of incidents.<\/p>

The range of consequences reflects the diversity of threat actors active in the region. Some groups seek financial gain, while others pursue political or strategic objectives.<\/p>

IoT and connected systems add another layer of risk<\/h3>

The report also identified a notable share of attacks against internet-connected devices.<\/p>

IoT devices accounted for 17 per cent of compromised targets, a figure that researchers said is significant given the extensive use of connected technology across the Gulf.<\/p>

The rapid digitalisation of infrastructure has increased the number of connected devices deployed by organisations and public authorities.<\/p>

While connected systems can improve efficiency and provide new services, poorly secured devices can also create additional opportunities for attackers.<\/p>

Positive Technologies said the combination of widespread IoT deployment, vulnerability exploitation and cross-sector attacks creates conditions that could support the development of large botnets. PT Security<\/p>

The company noted that IoT botnets accounted for about 35 per cent of global DDoS attacks in 2025, illustrating the potential scale of the threat posed by compromised connected devices.<\/p>

A changing regional threat environment<\/h3>

The findings show that the Gulf\u2019s cyberthreat landscape is being shaped by several factors at the same time.<\/p>

Economic development and digital transformation have increased the number of valuable systems and organisations that attackers can target.<\/p>

At the same time, geopolitical tensions have contributed to politically motivated cyber activity, particularly during periods of conflict escalation.<\/p>

The result is a threat environment involving financially motivated cybercriminals, hacktivists and state-aligned groups.<\/p>

The types of attacks also vary considerably. Vulnerability exploitation remains the leading method, while malware and social engineering continue to account for substantial portions of incidents.<\/p>

Positive Technologies expects AI-driven cyberattacks and the development of new botnets to remain important areas of concern as the regional cyber landscape evolves. PT Security<\/p>

For organisations in the UAE, Saudi Arabia and elsewhere in the Gulf, the report highlights the importance of addressing both technical weaknesses and human vulnerabilities.<\/p>

The findings also demonstrate that cybersecurity risks are not limited to a particular industry. Government institutions, industrial companies, financial organisations, technology businesses and other sectors can all become targets.<\/p>

The data from the first half of 2026 therefore presents a picture of a region facing a diverse and rapidly changing range of cyber threats, with the UAE and Saudi Arabia among the countries experiencing the largest share of recorded incidents. PT Security<\/p>

<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

A new report reveals that the UAE and Saudi Arabia were collectively responsible for around half of all cyberattacks recorded across the Gulf during the first six months of 2026, highlighting the region\u2019s growing exposure to digital security threats.<\/p>\n","protected":false},"author":1,"featured_media":48225,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"pmpro_default_level":"","footnotes":""},"categories":[12,9],"tags":[],"post_template":[],"top_category":[],"class_list":["post-48224","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-business","category-uae","pmpro-has-access"],"acf":[],"_links":{"self":[{"href":"https:\/\/insider18.com\/index.php\/wp-json\/wp\/v2\/posts\/48224","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/insider18.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/insider18.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/insider18.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/insider18.com\/index.php\/wp-json\/wp\/v2\/comments?post=48224"}],"version-history":[{"count":4,"href":"https:\/\/insider18.com\/index.php\/wp-json\/wp\/v2\/posts\/48224\/revisions"}],"predecessor-version":[{"id":48230,"href":"https:\/\/insider18.com\/index.php\/wp-json\/wp\/v2\/posts\/48224\/revisions\/48230"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/insider18.com\/index.php\/wp-json\/wp\/v2\/media\/48225"}],"wp:attachment":[{"href":"https:\/\/insider18.com\/index.php\/wp-json\/wp\/v2\/media?parent=48224"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/insider18.com\/index.php\/wp-json\/wp\/v2\/categories?post=48224"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/insider18.com\/index.php\/wp-json\/wp\/v2\/tags?post=48224"},{"taxonomy":"post_template","embeddable":true,"href":"https:\/\/insider18.com\/index.php\/wp-json\/wp\/v2\/post_template?post=48224"},{"taxonomy":"top_category","embeddable":true,"href":"https:\/\/insider18.com\/index.php\/wp-json\/wp\/v2\/top_category?post=48224"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}