Middle East Cyber Threat Landscape Report 2026

The 2026 Middle East cyber landscape saw 170 ransomware and data-extortion incidents concentrated in Turkey, the UAE, Israel, Egypt, and Saudi Arabia, targeting public institutions and critical sectors (manufacturing, healthcare, finance, energy). Prominent ransomware actors included TheGentlemen, LockBit5, DragonForce, IncRansom and Nightspire, while Handala conducted politically-motivated leaks; APTs such as MuddyWater and OilRig pursued espionage using living-off-the-land tools (PowerShell, WMI, RDP, PsExec) and cloud services. Dark web activity shows database sales, credential leaks, and offers of unauthorized access, prompting recommendations to strengthen threat intelligence, identity security, attack-surface management, and advanced detection.