Ransomware Threats to Middle East Critical Infrastructure Escalate Amid Regional Conflicts

Executive Summary

In early 2026, the Middle East has witnessed a significant surge in ransomware attacks targeting critical infrastructure sectors, including power grids, water systems, industrial control systems (ICS), healthcare, and the financial sector. These attacks are primarily attributed to ransomware groups such as BQT.Lock and Qilin, which have exploited regional geopolitical tensions to advance their operations.

Key Threat Actors

• BQT.Lock: Emerging in mid-2025, BQT.Lock operates from the Middle East under the leadership of Karim Fayad. The group utilizes a Ransomware-as-a-Service (RaaS) model, providing ransomware tools to other attackers. Their operations blend financial extortion with ideological motives linked to Hezbollah and Iranian state-affiliated cyber activities. (en.wikipedia.org)

• Qilin: Active since 2025, Qilin has targeted various sectors, including healthcare and manufacturing. Notably, in June 2025, Qilin claimed responsibility for a data breach on the healthcare organization Covenant Health, impacting over 478,000 individuals. (en.wikipedia.org)

Recent Attacks and Impact

• Saudi Arabia: In late November 2025, the Clop ransomware group targeted multiple Saudi-based entities across diversified commercial verticals within a narrow timeframe, suggesting coordinated intrusion efforts. (cyfirma.com)

• United Arab Emirates (UAE): Between February 28 and March 2, 2026, a coordinated wave of 149 hacktivist-driven Distributed Denial-of-Service (DDoS) attacks targeted 110 organizations across 16 countries, with a significant concentration in the UAE. These attacks disrupted critical infrastructure, including government and financial sectors. (rescana.com)

Exploitation of Geopolitical Tensions

The escalation of regional conflicts has provided ransomware groups with opportunities to exploit vulnerabilities in critical infrastructure. For instance, the ongoing war involving Iran has severely disrupted global oil and gas infrastructure, with Iranian drone strikes leading to the closure of the Strait of Hormuz, a vital route for approximately 20% of the world’s oil and liquefied natural gas. (apnews.com)

Recommendations

To mitigate the escalating threat of ransomware attacks on critical infrastructure, it is imperative for organizations in the Middle East to implement robust cybersecurity measures, including regular system updates, employee training on phishing attacks, and the development of comprehensive incident response plans. Collaboration with international cybersecurity agencies and adherence to global best practices are essential to enhance resilience against these evolving threats.

Highlights:

• Iran war puts at risk key pipelines, terminals and refineries that supply the world with oil and gas, Published on Monday, March 09
• Iranian strikes on Amazon data centers highlight industry's vulnerability to physical disasters, Published on Tuesday, March 03
• U.S. braces for cyberspace retaliation from Iran, Published on Tuesday, March 03