UAE claims it stopped ‘terrorist’ ransomware attack

The United Arab Emirates said it stopped a ransomware attack this weekend that allegedly targeted the country’s digital infrastructure.

The country’s Cyber Security Council published a statement on Saturday that said they “successfully thwarted organized cyberattacks of a terrorist nature that targeted the country’s digital infrastructure and vital sectors in an attempt to destabilize the nation and disrupt essential services.”

“The Council indicated that the attacks included attempts to infiltrate networks, deploy ransomware, and conduct systematic phishing campaigns targeting national platforms,” the council said. It did not respond to requests for comment.

“The attacks also involved the exploitation of artificial intelligence technologies to develop sophisticated offensive tools, reflecting a qualitative shift in the methods employed by terrorist groups and their ability to harness modern technologies to carry out digital attacks.”

The incident takes place amid heightened tensions in the region as Iran and the U.S. work on a nuclear weapons deal under threat of military airstrikes by President Donald Trump. 

The U.S. Treasury Department and the UAE’s Cyber Security Council signed a deal in 2023 outlining increased cyber cooperation and, since then, the country has faced an array of attacks by actors allegedly based in Iran. 

The FBI and U.S. Defense Department said in 2024 that the government of Iran coordinated with ransomware gangs to launch attacks on several countries including the UAE. 

Last year, researchers attributed a malware campaign targeting the UAE’s aviation, satellite communications and transportation sectors to hackers possibly affiliated with Iran’s Islamic Revolutionary Guard Corps (IRGC). 

Google-owned Mandiant previously said suspected Iranian hackers targeted the aerospace, aviation and defense industries in the UAE. 

In a note last week, head of the UAE’s Cyber Security Council Mohamed Hamad Al Kuwaiti claimed more than 70% of the threat actors targeting the country are state-sponsored groups.

Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

No previous article

No new articles

Jonathan Greig

Jonathan Greig

is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.

 

Total
0
Shares
Previous Post

North Korean state hackers seen using Medusa ransomware in attacks on US, Middle East

Next Post

Crypto platform Step Finance shutting down after $40 million theft

Related Posts

ClickFix Attacks Expand Using Fake CAPTCHAs, Microsoft Scripts, and Trusted Web Services

Cybersecurity researchers have disclosed details of a new campaign that combines ClickFix-style fake CAPTCHAs with a signed Microsoft Application Virtualization (App-V) script to distribute an information stealer called Amatera. "Instead of launching PowerShell directly, the attacker uses this script to control how execution begins and to avoid more common, easily recognized execution paths,"
Read More

Hackers Hijack Blender 3D Assets to Deploy StealC V2 Data-Stealing Malware

Cybersecurity researchers have disclosed details of a new campaign that has leveraged Blender Foundation files to deliver an information stealer known as StealC V2. "This ongoing operation, active for at least six months, involves implanting malicious .blend files on platforms like CGTrader," Morphisec researcher Shmuel Uzan said in a report shared with The Hacker News. "Users unknowingly
Read More