Earlier this month, the UAE’s head of cybersecurity, Mohamed Al Kuwaiti, disclosed to the Arab Media Summit that every missile and drone attack on the country’s ports, energy facilities and refineries since the beginning of the war in Iran had been accompanied by a cyberattack against the same target. He also revealed that the average number of digital assaults had tripled since 28 February, reaching between 600,000 and 800,000 a day.
From Saudi Arabia signing a cybersecurity cooperation agreement with Pakistan to regional leaders looking for ways to combat the increasing threat posed by the US-Iran war and the growing role of AI in cyberattacks, governments are confronting a rapidly changing cyber-threat landscape.
Alex Malouf, founder of Narrative Shapers, a communications and PR advisory, points to two significant realities. “First, there are far more threats out there today, partly because of geopolitics and partly due to how IT has become core to our lives, personally and in the workplace. The second truth is that AI is making cybersecurity much more complex.”
That threat is not confined to governments and energy companies. “Attacks are coming from everywhere, and the attacks are impacting both critical infrastructure and even SMEs and citizens,” says Abdullah AlJaber, a Saudi cybersecurity expert. These threats – “all-encompassing, from every part of the globe” – reflect a continuing increase in cyber activity.
For the UAE, Saudi Arabia and the wider region, that threat is particularly acute when it comes to operational technology (OT) systems that monitor and control physical infrastructure, such as power plants and electricity grids, water treatment systems, oil and gas facilities, ports and pipelines, transport systems, and factories and industrial plants.
The US-Iran war has highlighted how vulnerabilities in interconnected networks can undermine critical infrastructure resilience. “These systems are supposed to be isolated, but they have a connection to the internet,” says Lee Rossey, chief technology officer and cofounder of SimSpace, a US-based cybersecurity company. “So, picture an attacker coming from the outside, getting into this OT network, discovering, pivoting around, getting into the domain controller, stealing credentials for a workstation, coming back into the engineering workstation, and then manipulating the protocol that affected the power generation.”
The war in the Gulf has brought these realities home.
Earlier this year, Iranian hackers gained access to security cameras overlooking sites in Israel. These cameras were used to monitor targets, track the movement of Israeli troops and assess damage from missile strikes, showing how cyber operations can reach into OT networks and support military activity. Similar attacks attempted to compromise internet-connected cameras in the UAE, Qatar, Bahrain and Kuwait.
Similarly, in July, US cybersecurity officials reported that Iranian-affiliated cyber actors had exploited programmable logic controllers (industrial computers used to control physical processes) to disrupt critical infrastructure across the country. “The assumption that manufacturing and all these other systems are completely isolated and not connected to IT is breaking down every day,” says Rossey. “Now the question is: how do the defence and the response look at the whole network – the cameras, the power plants, the other systems?”
Regional governments are increasingly sharing intelligence and preparing jointly for any potential attacks, with a growing focus on how countries such as Saudi Arabia and the UAE can coordinate their responses. Rossey says a number of companies are also investing in making improvements to their cybersecurity because the war has demonstrated that these threats are not hypothetical.
“Something that needs to be worked out is how do they share information in an effective manner, how do they work together more and how do they work together to understand the threat? They’re also struggling with AI. How do I use it? Where do I use it? What does it mean? How do I trust it? So they know that this wave is coming, but that’s not unique to the region.”
While the conflict in the Middle East has underscored the growing importance of cyberspace as a new frontier for attacks, it is only the latest in a series of conflicts and geopolitical tensions to demonstrate this reality. The Russia-Ukraine war, Israel’s invasion and occupation of southern Lebanon, US-China tensions and heightened UK and EU frictions with Russia have all been accompanied by cyber activity, as governments and other actors seek to gain access to networks, gather intelligence and prepare for potential conflict.
“I think we are in a state of mini-war, where people have been getting into each other’s networks, messing around – doing all that – but it’s more from a preparation, reconnaissance, understanding perspective,” says Rossey. “Let me understand a network. Let me figure it all out. The question is, really, when do I do something destructive or malicious about it? That’s when you start moving into that threshold, and that is when you are at war.”
In July, OpenAI disclosed that models being tested in an internal cybersecurity evaluation had circumvented controls designed to isolate them from the internet and launched an autonomous cyberattack on Hugging Face, a collaborative online platform and community hub for machine learning and AI.
The incident offers a glimpse into a potential future dominated by AI-enabled attacks targeting critical infrastructure companies and governments, believes Rossey.
“Once you start having smart pieces of software that can get into a network, find stuff, craft exploits based on the vulnerabilities they find and move through the network, you don’t have a human in the loop navigating, poking around,” he says. “It’s an autonomous worm that is discovering and moving. And the key about these is that they can move fast. They can overwhelm the defences, and the timeline is really shrunk. A lot of traditional attacks can take weeks to months to get into your network. But as the software starts getting more advanced, there’s less time to discover the network, figure out what’s going on and respond.”
When will attackers start using these self-propagating worms to get into a network and overwhelm it? That’s the million-dollar question. “At some point we’re going to be there,” states Rossey. “In my mind, there’ll be little mini-wars going on under the network, with autonomous offensive and defensive attacks happening at the same time,” he adds. Cyber warfare in an increasingly AI-centric world is something that governments across the world will have to get used to, and safeguard against.
But, as AlJaber says, the US-Iran war “may move the needle, but the flow of threats will not change.”
“At the end of the day, if the power plant is still running, if the bank is still moving money, if the hospital is still operating, I almost don’t care that there are all these agentic offensive and defensive attacks happening under the hood,” Rossey says.
