UAE claims it stopped ‘terrorist’ ransomware attack

The United Arab Emirates said it stopped a ransomware attack this weekend that allegedly targeted the country’s digital infrastructure.

The country’s Cyber Security Council published a statement on Saturday that said they “successfully thwarted organized cyberattacks of a terrorist nature that targeted the country’s digital infrastructure and vital sectors in an attempt to destabilize the nation and disrupt essential services.”

“The Council indicated that the attacks included attempts to infiltrate networks, deploy ransomware, and conduct systematic phishing campaigns targeting national platforms,” the council said. It did not respond to requests for comment.

“The attacks also involved the exploitation of artificial intelligence technologies to develop sophisticated offensive tools, reflecting a qualitative shift in the methods employed by terrorist groups and their ability to harness modern technologies to carry out digital attacks.”

The incident takes place amid heightened tensions in the region as Iran and the U.S. work on a nuclear weapons deal under threat of military airstrikes by President Donald Trump. 

The U.S. Treasury Department and the UAE’s Cyber Security Council signed a deal in 2023 outlining increased cyber cooperation and, since then, the country has faced an array of attacks by actors allegedly based in Iran. 

The FBI and U.S. Defense Department said in 2024 that the government of Iran coordinated with ransomware gangs to launch attacks on several countries including the UAE. 

Last year, researchers attributed a malware campaign targeting the UAE’s aviation, satellite communications and transportation sectors to hackers possibly affiliated with Iran’s Islamic Revolutionary Guard Corps (IRGC). 

Google-owned Mandiant previously said suspected Iranian hackers targeted the aerospace, aviation and defense industries in the UAE. 

In a note last week, head of the UAE’s Cyber Security Council Mohamed Hamad Al Kuwaiti claimed more than 70% of the threat actors targeting the country are state-sponsored groups.

Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

No previous article

No new articles

Jonathan Greig

Jonathan Greig

is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.

 

Total
0
Shares
Previous Post

North Korean state hackers seen using Medusa ransomware in attacks on US, Middle East

Related Posts

“Getting to Yes”: An Anti-Sales Guide for MSPs

Most MSPs and MSSPs know how to deliver effective security. The challenge is helping prospects understand why it matters in business terms. Too often, sales conversations stall because prospects are overwhelmed, skeptical, or tired of fear-based messaging. That’s why we created ”Getting to Yes”: An Anti-Sales Guide for MSPs. This guide helps service providers transform resistance into trust and
Read More

NANOREMOTE Malware Uses Google Drive API for Hidden Control on Windows Systems

Cybersecurity researchers have disclosed details of a new fully-featured Windows backdoor called NANOREMOTE that uses the Google Drive API for command-and-control (C2) purposes. According to a report from Elastic Security Labs, the malware shares code similarities with another implant codenamed FINALDRAFT (aka Squidoor) that employs Microsoft Graph API for C2. FINALDRAFT is attributed to a
Read More

MuddyWater Deploys UDPGangster Backdoor in Targeted Turkey-Israel-Azerbaijan Campaign

The Iranian hacking group known as MuddyWater has been observed leveraging a new backdoor dubbed UDPGangster that uses the User Datagram Protocol (UDP) for command-and-control (C2) purposes. The cyber espionage activity targeted users in Turkey, Israel, and Azerbaijan, according to a report from Fortinet FortiGuard Labs. "This malware enables remote control of compromised systems by allowing
Read More