An analysis of the UAE’s cybersecurity threat landscape in the first half of 2025 by Alain Penel, Vice President – Middle East, Turkey and CIS, Fortinet, reveals a highly coordinated wave of attacks followed by a period of tactical preparation, highlighting the growing sophistication of threat actors.
This report provides a strategic analysis of the cybersecurity threat landscape within the United Arab Emirates (UAE) for the first half of 2025. The data reveals a half year defined by two distinct phases: an intense, consolidated ‘blitz’ campaign in the first quarter, followed by a period of tactical regrouping and methodical preparation for a new wave of attacks in the second quarter.
Q1 ‘blitz’ campaign
The first quarter, particularly February, was marked by an aggressive, multi-faceted assault. Attackers simultaneously executed their peak campaigns for Ransomware deployment (500 incidents) which was in line with the regional average, brute force credential harvesting (28.7M detections) which was higher than the regional average and botnet recruitment (2.0M detections) which was observed to be lower than the regional average.
This indicates a highly coordinated, all-out effort to inflict damage and build resources at the same time.
SMB as the critical vulnerability
SMB remains a globally targeted protocol, also significantly observed in UAE campaigns, underscoring its importance in attackers’ playbooks for gaining deep network access.
Q2 strategic regrouping and preparation
The second quarter began with a tactical lull in April as attackers appeared to organise the assets acquired in Q1. This was followed by a ramp-up in May, where renewed brute force and botnet activity was used to enable a massive reconnaissance scanning campaign (1.8 billion events). The quarter concluded with a final wave of exploitation in June to pre-position tools for a future attack.
High operational maturity
The ability to execute a synchronised, multi-pronged attack in Q1 and then seamlessly transition to a methodical preparation phase in Q2 demonstrates a high level of attacker maturity and strategic planning.
This analysis concludes that organisations face a sophisticated adversary capable of executing intense, concentrated attacks and then patiently preparing for the next one.
Strategic implications for UAE organisations
The two-phase nature of the H1 2025 threat landscape has critical implications:
- Attackers can launch concentrated, multi-vector assaults – The February blitz demonstrates that adversaries can attack on multiple fronts at once (impact, credential theft, infrastructure growth), placing extreme pressure on security operations centres (SOCs).
- A ‘quiet’ period is deceptive – The lull in April was not a sign of retreat, but a tactical pause. Organisations must use these periods to patch, harden defences and maintain vigilance; the quiet period is part of the strategy for attackers.
- Stolen credentials and botnets fuel future attacks- The Q2 activity shows a clear link between the assets acquired in Q1 and their use in subsequent, more targeted reconnaissance phases.
Recommendations and mitigation strategies:
To defend against this persistent, multi-phase threat, organisations must adopt a continuous and layered security approach.
- Harden core network services – Implement a rigorous patch management programme to immediately address critical vulnerabilities, especially in protocols like SMB. Employ network segmentation to contain threats and prevent the rapid lateral movement seen in the Q1 campaign.
- Defend against credential theft – Mandate Multi-Factor Authentication (MFA) across all services. This is the single most effective defence against the brute-force tactics central to the attackers’ Q1 strategy. Enforce strong password policies and implement account lockout mechanisms.
- Build ransomware resilience – Validate your data backup and recovery strategy, ensuring you have tested, offline and immutable backups. Deploy and tune Endpoint Detection and Response (EDR) solutions to detect the behavioural precursors to ransomware before it can execute.
- Enhance threat visibility and response automation – The multi-vector attacks observed highlight the challenge of detecting a coordinated campaign across siloed security tools. Implementing a robust Security Operations (SecOps) platform is essential for centralised visibility and rapid response.
Deploy a Security Information and Event Management (SIEM) solution to aggregate logs and events from all networks, server and endpoints sources. This provides the correlation needed to identify the faint signals of a complex attack pattern, such as the simultaneous brute force, botnet and exploit activities seen in the February blitz.
Complement the SIEM with a Security Orchestration, Automation and Response (SOAR) platform. SOAR can automate routine incident response playbooks, enabling security teams to contain threats at machine speed – a critical capability when facing the rapid breach-to-impact cycles demonstrated by threat actors.
Conclusion
The first half of 2025 was defined by the tactical maturity of adversaries targeting the UAE. The ‘blitz’ campaign in February, which combined a ransomware attack with massive credential harvesting and botnet recruitment, demonstrates a new level of coordinated aggression. The subsequent pivot to a methodical preparation campaign in Q2 shows a relentless adversary that does not rest.
Organisations must recognise this ability to execute intense, consolidated campaigns and build a defence-in-depth security posture capable of withstanding these complex, multi-faceted attacks.
