Ransomware activity in the Middle East surges to record highs, CloudSEK reports

Ransomware activity targeting the Middle East has surged to its highest level in a 17-month period, increasing more than twenty-fold from April 2025 to June 2026, as reported by TahawulTech. This escalation is part of a broader shift in the region's cyber threat landscape, where financially motivated cybercrime is increasingly intertwined with politically driven hacktivism, state-linked espionage, and the rapid exploitation of critical vulnerabilities.

CloudSEK's analysis reveals a complex threat environment, with organizations facing simultaneous high-volume disruptive attacks, ransomware, and espionage operations. Ransomware feeds jumped from 17 in April 2025 to a peak of 357 in June 2026, while hacktivism, though dominant earlier, saw a sharp decline after March 2026. Israel was the most targeted country overall, but Türkiye faced the highest ransomware targeting, particularly affecting industrial, manufacturing, and logistics sectors. Government and financial services were the most targeted sectors overall.

Emerging threats include the use of AI in offensive operations, with actors like MuddyWater using Google's Gemini for code obfuscation and evidence of AI-assisted malware development by Nimbus Manticore. Unpatched internet-facing infrastructure, including vulnerabilities in Fortinet, Ivanti, and Kubernetes, remains a primary entry point. The UAE and Saudi Arabia are facing growing ransomware and espionage pressure, with critical infrastructure in these nations, alongside Israeli government and Turkish industrial organizations, assessed as high-risk.

Source: TahawulTech