State-Sponsored Cyber Operations in the Middle East: A Critical Threat Assessment

Executive Summary

As of March 2026, the Middle East continues to be a focal point for state-sponsored cyber operations, with nation-state actors leveraging cyber capabilities to advance geopolitical objectives. These activities encompass cyber espionage, infrastructure disruption, and information warfare, posing a critical threat to regional stability and international security.

Key Threat Actors and Operations

1. Iranian Cyber Operations

   • APT34 (OilRig): An Iranian state-sponsored group active since at least 2014, APT34 has intensified operations targeting critical infrastructure in the Middle East. In September 2024, the group launched a multi-stage intrusion campaign against Iraqi government entities, deploying novel malware families such as Veaty and Spearal. These tools utilized custom DNS tunneling and email-based command-and-control communications, reflecting the group's evolving tradecraft. (trellix.com)

   • APT33 (Elfin): This Iranian group has been linked to cyber espionage campaigns targeting sectors including government, energy, and telecommunications. APT33 employs spear-phishing tactics with malicious attachments, often luring victims with job opportunities or geopolitical topics, and has been known to exploit zero-day vulnerabilities in IT products. (waterisac.org)

2. Israeli Cyber Operations

   • Predatory Sparrow: A pro-Israel hacker group with possible links to the Israeli government, Predatory Sparrow has claimed responsibility for multiple cyberattacks targeting Iran. Notably, in June 2025, the group attacked Iran's state-owned Bank Sepah, disrupting banking services and claiming to have destroyed data belonging to the bank. The group also claimed responsibility for an attack on the Iranian cryptocurrency exchange Nobitex, stealing $90 million in crypto assets and destroying the funds by sending them to inaccessible cryptocurrency addresses. (en.wikipedia.org)

Regional Impact and Vulnerabilities

The UAE has reported that 71.4% of cyber threats targeting the country are state-sponsored, with the majority originating from Asia and Europe. These attacks have primarily targeted government administration, financial services, and banking sectors. The UAE's head of cybersecurity, Dr. Mohamed Al Kuwaiti, highlighted the use of artificial intelligence technologies by attackers to develop offensive tools, including attempts to infiltrate networks, deploy ransomware, and conduct systematic phishing campaigns. (thenationalnews.com)

In early March 2026, Iran launched hundreds of drones and missiles targeting neighboring countries, including the UAE, Bahrain, Kuwait, Qatar, Jordan, and Cyprus. These attacks exposed significant vulnerabilities in Gulf air defense systems, which struggled to intercept low-cost Iranian drones. The strikes damaged infrastructure, energy sites, and diplomatic missions, underscoring the need for enhanced regional cybersecurity and defense capabilities. (lemonde.fr)

Conclusion

State-sponsored cyber operations in the Middle East present a critical and evolving threat landscape. Nation-state actors are increasingly leveraging cyber capabilities to achieve strategic objectives, targeting critical infrastructure and information systems. The complexity and sophistication of these operations necessitate a coordinated and proactive response from regional and international stakeholders to mitigate risks and enhance cybersecurity resilience.

Highlights:

• United Arab Emirates briefly closes airspace as Israel strikes Lebanon and Tehran, Published on Sunday, March 15
• Iran's neighbors, under drone attacks, confront their vulnerability, Published on Wednesday, March 04