The UAE and Saudi Arabia together absorbed roughly half of all cyberattacks recorded across the Gulf region in the first half of 2026, this was among the many finds of a recent study by cybersecurity firm Positive Technologies, that was released at GISEC 2026. The study also noted that it was government agencies that took the heaviest brunt of those attacks.
The report found that financially motivated criminals weren’t acting alone. Hacktivists and state-aligned groups were also invloved, however they played a different role of disrupting operations that undermined national interests.
The Gulf’s combination of strong economies, advanced digital infrastructure and complex geopolitics has made it a magnet for a wide range of threat actors, the researchers said.
Get updated faster and for FREE: Download the Gulf News app now – simply click here.
The first quarter alone accounted for 96% of all cyber incidents recorded in the first half of 2026, a spike the report ties directly to the conflict involving Iran. Attack volumes fell sharply as de-escalation efforts progressed. The study shows that some countries improved their defenses, though researchers cautioned that a meaningful number of attacks likely go undetected given how sophisticated the tactics have become.
Why was UAE a prime target?
Broken down by country, the UAE was the single hardest-hit nation, accounting for 35% of all attacks in the region, followed by Iran at 17% and Saudi Arabia at 15%. Positive Technologies attributes the concentration of attacks on the UAE and Saudi Arabia largely to their rapid digital transformation and economic growth, both of which widen the attack surface for opportunistic and state-aligned actors alike.
According to the findings, government agencies were hit the most. They accounted for 27% of successful attacks across the Gulf. Campaigns with no specific sector target came close behind, at 23%. Industrial companies ranked third at 17%. Half of those industrial attacks hit Saudi Arabia alone, suggesting the kingdom’s industrial sector has a particular weak spot.
Darya Lavrova, Lead Analyst at Positive Technologies, said that cybercriminals’ goals are no longer just to extract money. “The objective of cybercriminals here is not solely financial gain, but also includes tactics such as spreading disinformation among the public during conflicts,” she said.
Lavrova also warned that state-sponsored groups are likely to keep targeting critical infrastructure to establish long-term footholds. “State-sponsored threat groups will seek to infiltrate critical infrastructure and establish persistence for espionage purposes,” she added.
Interesting to note is that the near-total concentration of attacks in Q1 versus the rest of the year, and more specifically industrial-sector attacks and other disruptions show us just how interconnected the digital economy has become.
