AI-Driven Ransomware Threatens Middle East Infrastructure

Introduction

As of March 2026, the Middle East has witnessed a notable escalation in cyber threats, particularly from ransomware groups leveraging artificial intelligence (AI) to enhance their operations. This trend poses significant risks to critical infrastructure and underscores the evolving nature of cyber warfare in the region.

Emergence of AI-Enhanced Ransomware Groups

The BQT.Lock cyberattack group, also known as BaqiyatLock, emerged in mid-2025. Operating from the Middle East and led by Karim Fayad, BQT.Lock functions as a ransomware-as-a-service (RaaS) platform, providing tools to other attackers. The group blends financial extortion with ideological motives linked to Hezbollah and Iranian state-linked cyber activities. BQT.Lock employs sophisticated techniques, including hybrid AES-256/RSA-4096 encryption, process hollowing via File Explorer, and the creation of backdoor accounts like "BQTLockAdmin." Additionally, it disables defenses through API calls and boot manipulation. The malware also creates log files, such as bqt_log.txt, which record what actions were taken, aiding in post-attack analysis. (en.wikipedia.org)

Integration of AI in Cyber Operations

The integration of AI into cyber operations is not limited to malicious actors. U.S. Central Command (CENTCOM) and the Israeli Defense Forces (IDF) have operationalized AI across the Middle East, sharing AI-enabled systems to support mutual security interests. Both entities have integrated AI across intelligence, targeting, command-and-control (C2), and unmanned systems, making it a primary testbed for operational AI at scale. (autonomyglobal.co)

Impact on Critical Infrastructure

The convergence of AI and cyber threats has led to more sophisticated attacks on critical infrastructure. For instance, AI-enhanced fraud is reported to be 4.5 times more profitable than traditional methods, with agentic AI systems autonomously planning and executing complete fraud campaigns from reconnaissance to ransom demands. (weforum.org) This trend indicates a shift towards more complex and damaging cyberattacks in the region.

Conclusion

The Middle East is at a critical juncture in the evolution of cyber threats. The integration of AI into ransomware operations by groups like BQT.Lock signifies a new era of cyber warfare, characterized by increased sophistication and potential impact. Simultaneously, the use of AI by state actors in military operations highlights the dual-use nature of this technology. It is imperative for organizations and governments in the region to enhance their cyber resilience, invest in advanced detection and response capabilities, and foster international cooperation to mitigate the risks associated with AI-driven cyber threats.

Highlights:

• Cyber impact of conflict in the Middle East, and other cybersecurity news | World Economic Forum, Published on Monday, March 16
• AI and quantum readiness reshape cyber resilience in the Middle East
• Why the Middle East needs hybrid, human-led cyber security in the age of AI | Computer Weekly, Published on Sunday, December 21