Introduction

The latest developments in the Middle East – marked by a significant surge in military activity and retaliatory strikes across the region – have been accompanied by a parallel intensification of cyber operations.

It is common in such situations for state-sponsored hackers, hacktivist groups, and advanced persistent threat (APT) units to conduct coordinated campaigns against government systems, critical infrastructure, and private entities during conflict or warlike times.

This article examines the evolving cyber threat landscape that could arise from the current regional conflict and the potential implications for organisations operating within the Gulf.

Cyber Operations Surge in Parallel with Physical Conflict

As tensions develop, the cyber domain has become an increasingly active battleground. Cyber activity in the Middle East has historically featured a blend of destructive attacks, espionage, and large‑scale disruption. The current conflict reflects similar patterns, including:

  • deployment of wiper malware against government and commercial systems
  • DDoS campaigns targeting public‑sector platforms and media outlets
  • attempts to infiltrate energy, aviation, and communications infrastructure
  • digital influence operations aimed at shaping public narratives

It is common in such times for state‑aligned cyber units to launch broad offensive operations designed to disrupt military command systems, undermine state media channels, and interfere with critical service delivery. These operations typically include both high‑volume DDoS attacks and deeper intrusions targeting energy and aviation infrastructure.

At the same time, hacktivist groups aligned with various sides of the conflict often take advantage of the volatile environment, conducting opportunistic attacks such as account hijackings, website defacements, and mass dissemination of information or propaganda via compromised applications.

In response, opposing cyber actors typically target regional defence systems, infrastructure assets, and industrial environments. As is typical in periods of heightened conflict, these activities often blur the lines between state activity, state‑aligned groups, and independent cyber collectives pursuing ideological goals.

Gulf States: A Surge in Activity

Entities in the GCC states face elevated cyber risk both as direct targets and as potential collateral victims of spill‑over from the broader regional confrontation.

The Gulf’s strategic importance – its advanced digital and energy infrastructure, global economic ties, and hosting of international defence assets – makes it a central area of interest for hostile cyber activity during regional conflict.

According to reports from various authorities in the GCC, the recent scale of attempted intrusions is significant. For example, as of 18 February 2026, UAE authorities were intercepting between 90,000 and 200,000 cyberattacks per day, with more than 70% linked to state-sponsored threat actors.

On 21 February, the UAE Cybersecurity Council announced the successful disruption of coordinated attacks described as “terrorist in nature”, involving attempted ransomware deployment, network infiltration, and extensive phishing campaigns targeting national platforms.

These patterns reflect a long‑standing trend: in times of regional tension, Gulf states often experience a surge in activity from sophisticated actors aiming to disrupt energy supplies, defence systems and government networks, compromise sensitive data, or undermine regional stability.

What are the implications for GCC entities?

The cumulative effect of these developments is that organisations across the Middle East now face a materially elevated cyber‑risk profile. Industries with the greatest exposure include energy and oil infrastructure, aviation, financial services, defence, telecommunications, and IT service providers. Organisations without direct links to the conflict or only indirect connections to the Middle East may be affected through collateral targeting, opportunistic exploitation, or supply‑chain vulnerabilities.

To mitigate these risks, GCC organisations should undertake comprehensive exposure assessments, evaluating direct threats as well as indirect or spill‑over impacts. Enhanced governance, robust detection and response mechanisms, and well‑tested incident‑response and business‑continuity plans are essential. Organisations should consider undertaking rapid assessments of third‑party and supply-chain dependencies, resilience testing across critical functions, and conducting tabletop exercises that replicate state‑linked attack scenarios.

Insurance Implications

From a cyber insurance standpoint, organisations and insurers in the GCC should anticipate far greater focus on exclusion clauses, which commonly exclude losses arising from “war” or “hostile or warlike action” by a government or sovereign actor.

With the heightened risk of cyber-attacks at present, insureds should look closely at their policies to determine whether they have sufficient cyber cover for state-linked incidents, and where there is doubt, they should seek to include greater clarity. 

Insurers, for their part, should consider aggregation risk (given the sheer volume of cyber-attacks and potential for correlated claims across multiple policyholders), clarify exclusion wording, and ensure that the exclusions align with the distinct realities of digital conflict.

Conclusion

Cyber operations have become a defining feature of geopolitical tension in the Middle East, operating alongside and often amplifying physical conflict. For organisations in the Gulf region, this environment demands heightened vigilance, accelerated defensive measures, more stringent compliance measures, and recognition that cyber resilience has become inseparable from broader business continuity and national security.

In the event of a cyber incident, the NRF team is available to assist on our 24/7 365 hotline. Please contact us via databreachresponse@nortonrosefulbright.com or +44 20 7444 5452 / +971 4 369 6362.