As tensions escalate across the Middle East, the most visible signs of conflict dominate headlines: missile interceptions, airspace closures, disrupted flights. But another layer of activity has been unfolding at the same time, one that is harder to track and rarely seen in real time – cyberattacks.
HE Dr Mohamed Al Kuwaiti, head of cybersecurity for the UAE government, tells WIRED Middle East that cyberattacks targeting the UAE have doubled in recent weeks, reflecting how closely digital infrastructure is tied to geopolitical events.
The country is now recording around 530,000 cyber incidents a day, up from roughly 270,000 before the latest escalation, Al Kuwaiti says.
These incidents include attempted intrusions, blocked threats, distributed denial-of-service (DDoS) attacks and automated scanning. For cybersecurity teams, this is less about isolated attacks and more about continuous pressure – automated systems probing for vulnerabilities across networks that underpin the country’s economy.
That activity is concentrated in sectors that sit at the core of the UAE’s economic infrastructure. Al Kuwaiti points to finance, government and energy as the primary targets, describing them as “the three major sectors” experiencing the highest level of activity.
The UAE’s financial system connects regional and international capital flows, its energy sector feeds into global supply chains, and its government platforms support services that are deeply embedded in everyday life. Disruption in any of these areas would extend far beyond a single system.
That exposure is no longer theoretical. In recent weeks, parts of that infrastructure have already been hit.
Iranian drone strikes have targeted both digital and physical assets in the UAE, including Amazon Web Services (AWS) data centres and key energy facilities. The attacks on cloud infrastructure briefly disrupted services, affecting platforms that rely on those systems to operate. Drone strikes on Fujairah – one of the UAE’s most critical oil export hubs – have also caused fires and forced the suspension of some oil-loading operations.
Timing is also part of the pattern. Access often comes before escalation. Attackers move into systems early, stay inside and wait. “They try to actually penetrate and stay there until that zero hour attack happens,” Al Kuwaiti says.
.jpg)
One of the most visible examples is Handala, a hacker collective that has become closely associated with Iran-linked cyber-activity. As previously reported by WIRED, the group has moved beyond symbolic hacktivism into operations that target organisations connected to Israel and the US, in some cases aiming to disrupt systems rather than simply access data.
One of the group’s most widely reported operations involved an attack on US medical technology company Stryker, affecting systems across multiple regions. Instead of focusing on data theft or financial gain, the attack interfered with operations – marking a shift towards disruption.
Al Kuwaiti says similar methods have already been observed in the UAE, where attackers attempted to move through systems using the same model, adding that the country also witnessed cyberattacks following the events of 7 October 2023, as Iran-linked groups – active against the UAE for years – tend to intensify operations during periods of geopolitical conflict.
When asked what concerns him most about the way AI is being used in cyberattacks, Al Kuwaiti points to how much of the process can now operate independently, describing it as “scary”.
Referring to activity linked to groups such as Handala, he describes a shift towards fully automated attacks, where AI is used not just to gain access, but to carry out the entire operation.
Everything can be automated, from the initial phishing email to exploiting vulnerabilities, moving across systems and scanning entire networks, running end to end.
Al Kuwaiti says this type of attack has already been attempted in the UAE, with AI automating the entire chain – allowing attackers to infiltrate systems, move across networks and remain in place until what he describes as a “zero hour” moment, when systems can be wiped or taken offline.
“There is no one commander, or a hacker, who does this. It is all AI,” he says. He warns that these types of attacks could extend beyond the digital realm if they target critical infrastructure, with the potential to result in “loss of lives”.
In the UAE, the threat is not hypothetical. Al Kuwaiti points to incidents where attackers were able to move through systems and position themselves across networks before being stopped. In some cases, ransomware activity already began to take shape; however, he adds that they “were able to contain [them] in one place and take over.”
The difference between disruption and containment, he says, often comes down to speed. Once attackers gain access, the window to respond is narrow, particularly when parts of the process are automated.
While government systems have largely remained resilient, supported by coordination across entities and real-time monitoring, the private sector presents a more varied picture.
At the same time, individuals have become a key part of the attack surface. During recent flight disruptions across the region, passengers were left searching for updates, bookings and alternative routes. Scammers impersonated airlines and travel services, sending messages offering urgent solutions – often asking for payment or personal information under time pressure.
In some cases, attackers mimicked real announcements around delays and cancellations, using familiar branding and timing to make the messages appear legitimate.
These attacks rely on urgency, fear and familiarity, encouraging people to act quickly before verifying what they are seeing. As Al Kuwaiti puts it, these tactics lead people to act “without maybe really thinking twice.”
The way these attacks move – across systems, companies and individuals – has also exposed a gap at a global level.
He argues that the current legal landscape lacks clear rules, calling for what he describes as a “cyber Geneva Convention” to define how states and actors operate in the digital domain. “There is no dictation or responsibility of using X countries to attack Y country, and this is what we’ve seen here,” Al Kuwaiti says of the legal grey area surrounding nation-state cyberattacks.
In practice, that means an attack can originate in one country, pass through another and target a third, without clear frameworks for responsibility or response.
In the absence of that structure, countries rely on coordination and internal measures. In the UAE, that includes collaboration across federal and local entities, partnerships with international organisations and a growing focus on awareness.
Al Kuwaiti says the country is in constant coordination with international partners, including the US, sharing attack data under the White House-backed Counter Ransomware Initiative, which he says includes more than 60 nations. The aim is to understand how attacks move – across regions, infrastructure and actors.
For now, the systems are holding. Attacks are being detected, contained and in some cases, stopped before they escalate. But the activity itself is not slowing down. It is becoming more automated, more distributed and harder to trace.
What is unfolding is not a separate layer of conflict, but an extension of it – one that runs through cloud infrastructure, energy systems, companies and individuals at the same time. And increasingly, it is being shaped by systems that no longer require direct human control.
