The Middle East continues to see an uptick in cyberattacks, with a surge in financially motivated threats despite the focus on the widening military conflict in the region.
The United Arab Emirates, Iran, and the Kingdom of Saudi Arabia accounted for about two-thirds of all attacks (67%) discovered through open source methods, which scan for attack information on Dark Web forums and on threat actors' Telegram channels, according to threat intelligence firm Positive Technologies. The UAE and Saudi Arabia have both aggressively pursued digital transformation of their public and private sectors, leading to larger attack surface areas and more targets of interest to cybercriminals. Meanwhile, Iran's media organizations and telecom infrastructure are typically popular targets of attack, says Darya Lavrova, lead analyst at Positive Technologies.
"[P]eriods of heightened conflict tend to contribute the most to cyber incidents overall, largely driven by hacktivists and politically aligned groups," she says. "That said, financially motivated cybercriminals are also actively targeting various infrastructure."
Positive Technologies used open source intelligence (OSINT) gathered from Dark Web forums, Telegram channels — often favored by attackers — and various aggregators tracking website defacements, malware operations, and distributed denial-of-service (DDoS) attacks, Lavrova says. The vast majority of cyberattacks likely remain unreported because of concern over reputational harm, she says.
Positive Technologies' open source intelligence-based analysis matches information provided by other companies. Organizations in the UAE and Saudi Arabia experienced nearly 2,700 attacks per week in the past half-year, compared with about 2,300 attacks per week for a typical organization across the globe, according to data provided by cybersecurity firm Check Point Software Technologies.