State-sponsored cyber threats, including Advanced Persistent Attacks (APTs) and hacktivism, saw a sharp rise in the Middle East during 2024, with GCC countries identified as primary targets. These cyberattacks, largely driven by geopolitical tensions, are highlighted in Group-IB’s High-Tech Crime Trends Report 2025.

The report offers a detailed analysis of the interconnected nature of cybercrime and the shifting threat landscape in the Middle East and Africa. It provides actionable insights for businesses, cybersecurity professionals, and law enforcement to strengthen their defense strategies. While APTs in the Middle East saw a 4.27% rise compared to a global surge of 58%, a significant 27.5% of these state-backed espionage threats specifically targeted GCC nations, underlining the region’s vulnerability.

Commenting on the release of the report, Ashraf Koheil, Regional Sales Director MEA at Group-IB, said: “Our report captures the dynamic and complex nature of cyber threats faced by the Middle East today. It shows that cybercrime is not a collection of isolated incidents, but an evolving ecosystem where one attack fuels the next. From sophisticated state-sponsored attacks to rapidly evolving hacktivism and phishing campaigns, the insights presented in this report are essential for organizations seeking to strengthen their cybersecurity defenses.”

GCC nations remained prime targets for cyberattacks in 2024 due to their strategic economic and political significance. Other notable targets included Egypt (13.2%) and Turkey (9.9%), reflecting their geopolitical roles, while countries such as Jordan (7.7%), Iraq (6.6%), Nigeria, South Africa, Morocco, and Ethiopia also faced rising threats.

The Middle East and Africa (MEA) ranked third globally for hacktivist attacks, accounting for 16.54% of incidents, trailing Europe (35.98%) and Asia-Pacific (39.19%). Key industries affected included government and military sectors (22.1%), financial services (10.9%), education (8%), and media and entertainment (5.2%), with attacks often targeting critical infrastructure and essential services. These assaults were largely fueled by geopolitical tensions, serving as tools for ideological expression or political retaliation.

The report also highlighted persistent cybersecurity challenges in the MEA region, such as phishing and data breaches. With rapid digital transformation, the region has become a prime target for sophisticated scams, particularly in the energy, oil and gas (24.9%) and financial services (20.2%) sectors, driven by economic motives. Phishing attacks continue to be a major threat, heavily affecting internet services (32.8%), telecommunications (20.7%), and financial services (18.8%) in the META region.

“We must embrace a collective defense strategy that unites financial institutions, telecommunications providers, and law enforcement agencies. By sharing intelligence, coordinating proactive security measures, and executing joint actions, we can disrupt fraudulent activities before they cause harm. This collaborative approach not only enhances our ability to detect and prevent fraud but also strengthens the resilience of our critical infrastructure, protects our national security,” added Ashraf Koheil.

The report revealed that ransomware attacks in the MEA region remained relatively low, with only 184 incidents, marking the lowest globally. However, significant concerns persist regarding Initial Access Brokers (IABs) and the vulnerabilities they exploit. In 2024, IAB activity was notable, with GCC nations (23.2%) and Turkey (20.5%) as the most targeted areas. Egypt reported the highest number of compromised hosts (88,951), followed by Turkey (79,789) and Algeria (49,173), highlighting substantial cybersecurity gaps.

Stolen credentials and sensitive corporate information sold on the dark web have become critical entry points for cybercriminals, including ransomware operators and state-sponsored attackers. The report disclosed over 6.5 billion leaked data entries, with nearly 2.5 billion unique email addresses and 3.3 billion leaked entries containing phone numbers (631 million unique). Additionally, 460 million passwords were exposed globally in 2024, 162 million of which were unique. This surge in leaked data fuels the dark web economy and heightens risks for organizations and individuals worldwide.

Dmitry Volkov, CEO of Group-IB, said, “Group-IB played an intensified role in its global fight against cybercrime and contributed to eight major law enforcement operations across 60+ countries, leading to 1,221 cybercriminal arrests and the dismantling of over 207,000 malicious infrastructures. These efforts disrupted large-scale cybercriminal networks, highlighting the critical role of collaboration between private cybersecurity firms and international law enforcement.”

The report highlighted that threat actors utilized advanced tactics, techniques, and procedures (TTPs) like social engineering, ransomware, and credential theft. Emerging methods, including the Extended Attributes Attack, the Facial-Recognition Trojan (GoldPickaxe.iOS), and the ClickFix infection chain, illustrate the growing complexity and sophistication of cyber threats in the region.