Dr. Emad Fahmy, systems engineering manager, Middle East at NETSCOUT/Image: Supplied
The Middle East has become a proving ground for some of the world’s most complex and persistent cyber campaigns. With its critical role in global trade, energy production, and rapid digital transformation, the region is facing escalating waves of AI-driven, multi-vector DDoS attacks that threaten national strategies across telecom, energy, finance, and education. In this Q&A, Dr. Emad Fahmy, systems engineering manager, Middle East at NETSCOUT, unpacks why adversaries are targeting Saudi Arabia and the UAE, how new attack models are evolving, and what governments and businesses must do to strengthen resilience before the next wave.
Why the region has become the testing ground for some of the world’s most intense cyber campaigns
The Middle East sits at the intersection of critical global trade, energy production, and digital expansion. These attributes make it an attractive option for adversaries wanting to test new DDoS techniques, including AI-driven attacks and multi-vector campaigns. In the first half of 2025, the EMEA saw over 3.2 million DDoS attacks—more than any other globally tracked region.
What these strikes mean for national strategies in telecom, energy, finance, and education
Sectors like telecom, energy, and financial services are central to national stability. Disruption as a result of DDoS attacks presents both operational risks and strategic vulnerabilities. National strategies must prioritise DDoS mitigation as a core function of digital defense. This must include early detection capabilities, automated response and increased collaboration between government and critical infrastructure operators.
Read: Three cyber safety tips for executives working while travelling
How governments and businesses can strengthen resilience before the next wave
Improving resilience starts with visibility. Organisations must leverage hybrid mitigation models – on-premise and cloud-based – that are powered by real-time threat intelligence and automated orchestration. Governments can accelerate readiness by enforcing sector-wide coordination, ensuring service providers have the telemetry and tooling needed to reduce time-to-mitigate at scale.
On KSA:
Tell us a bit about the scale and implications of the record-breaking attacks
Saudi Arabia observed more than 270,000 DDoS attacks in H1 2025 – the highest frequency in the region. A single campaign peaked at 1 Tbps and leveraged 24 vectors in a single strike. These attacks didn’t just test the perimeter—they probed for vulnerabilities across satellite telecom, energy delivery, and cloud services. The implications are significant for national digital transformation efforts.
How AI-driven botnets and DDoS-for-hire services are reshaping regional cyber threats
The rise of DDoS-for-hire platforms, combined with AI-enhanced automation, has lowered the barrier to launching sophisticated attacks. Botnets can now adapt mid-attack, shift vectors, and sustain pressure longer than ever before. For defenders, this means traditional, manual responses are no longer sufficient. The threat landscape is accelerating—and attackers are innovating rapidly.
Why Saudi Arabia has become a central focus for hostile actors in 2025
As Saudi Arabia leads regional digital innovation across smart cities, e-government and advanced telecom. This has made it a prime target for adversaries aiming to disrupt economic progress. The combination of high-value infrastructure and global visibility makes the Kingdom a strategic focus for both politically and financially motivated actors.
On UAE:
How are new tactics are redefining cyber conflict in the region
Threat actors are shifting from short, high-volume bursts to long-duration, adaptive campaigns. In the UAE, we recorded an average attack duration of 27.34 minutes, with some extending beyond three hours. This reflects a growing trend: attackers are using time and complexity – not just brute force – to degrade services and evade defenses.
Why AI-driven botnets are making the UAE a prime target
From fintech to cloud infrastructure, the UAE’s rapid digital adoption makes it a high-value target. AI-driven botnets enable adversaries to identify and exploit weak points dynamically. These systems operate at machine speed, combining attack types in real time. As a result, the UAE faces a higher frequency of complex, targeted strikes.
What prolonged attacks mean for the country’s financial networks and innovation hubs
Extended DDoS events introduce significant risks to uptime, customer trust and transaction integrity. The UAE’s financial sector, which is reliant on uninterrupted digital services, faces increased exposure as attacks move from seconds to hours. Innovation hubs must architect systems to absorb, mitigate and learn from long-duration, multi-vector assaults in real time.
The regional implications of attackers choosing patience over speed
This shift toward sustained disruption signals a maturing threat model. Adversaries are adopting “slow burn” tactics that exhaust mitigation layers, delay detection, and create long-term pressure on service providers. For the region, this underscores the need for proactive mitigation strategies that anticipate dwell time, not just bandwidth surges.
