416 Attacks a Minute: The GCC Threat Picture and What Regulators Now Expect

Week of 7 September 2026 | Compiled by Team Paringa

State-sponsored pressure on Gulf critical infrastructure is now sustained rather than episodic, and regulators in both the UAE and Saudi Arabia have responded by widening mandatory controls to organisations that previously sat outside scope.

What Happened This Week

🔴 Three critical-infrastructure campaigns against the UAE in one year, and 71.4 percent of threats are state-sponsored

The UAE Cybersecurity Council confirmed on 10 August that national teams detected and contained a coordinated, multi-vector campaign against the aviation, energy and education sectors. The attackers combined attempts to breach digital systems and infrastructure, efforts to compromise accounts and operational data, targeted phishing designed to use employees as the entry route, and exploitation of users as a foothold into operational environments. Containment and protection measures ran simultaneously with detection, and the Council states attackers did not reach their objectives.

The significant detail is the sequence, not the incident. This was the third publicly disclosed critical-infrastructure campaign against the UAE in 2026, following earlier operations against the financial sector. Three disclosed campaigns across finance, aviation, energy and education inside eight months is a sustained strategic pressure programme, not opportunistic crime. The Cybersecurity Council's own assessment supports that reading: 71.4 percent of cyber threats targeting the UAE are classified as state-sponsored.

The volume figures give the operational context. The UAE now absorbs roughly 600,000 attacks per day, about 25,000 per hour and more than 416 per minute, up from a baseline of around 200,000 daily and peaking between 500,000 and 700,000 during heightened regional tension in Q1. Since January the country has recorded 128 confirmed cyber threat incidents including ransomware, government breaches and data leaks, handled under a unified national response protocol. Government administration and financial services and banking are the most targeted sectors. Earlier reporting during the Iran conflict period put the country at 350 threat groups and 320 individual hackers under active tracking.

For CISOs in the region the operational implication is specific. The August campaign used phishing and user compromise as the primary entry vector into operational environments, not a novel exploit. That means identity is still the perimeter for state-sponsored intrusions against Gulf critical infrastructure, and the control that fails is almost always credential-based access to an OT-adjacent system.

Sources: Khaleej Times, Gulf News, Gulf News, Zawya

Three campaigns in eight months against four different sectors means the targeting is national, not sectoral, and every UAE operator of scale should assume it is in scope. The defensive priority is not more detection content, it is closing the identity path from phished employee to operational system. Phishing-resistant authentication on OT-adjacent accounts, hard segmentation between corporate and operational domains, and a tested containment playbook are the three things that would have mattered in August. Boards asking "are we a target" are asking the wrong question. Ask instead how long it takes to contain a valid credential in the wrong hands.

🟡 Saudi's NCA extends mandatory controls to every private-sector entity and starts unannounced inspections

The National Cybersecurity Authority's Cybersecurity Controls for Non-Critical National Infrastructure Private Sector Entities, NCNICC-1:2025, was released in January 2026 and sets a minimum cybersecurity baseline for private-sector entities operating in the Kingdom. The framework is tiered: large entities carry a substantially broader control set, SMEs a narrower but still mandatory set of technical and operational requirements.

The significance is scope, not content. NCNICC-1:2025 extends the NCA's mandatory reach to effectively every private-sector company operating in Saudi Arabia regardless of Critical National Infrastructure designation. Organisations that spent years correctly concluding they sat outside ECC-1 and CSCC-1 now sit inside a baseline. The NCA has paired this with harder supervision, conducting unannounced regulatory inspections and requiring Class A organisations to undergo regular independent security audits.

For international firms with Saudi operations, this converts cybersecurity from a group-policy question into a local-entity obligation with local evidence requirements. A global control framework satisfies very little of NCNICC-1 without a Kingdom-specific mapping and locally held artefacts.

Sources: Baker McKenzie, NCA

Unannounced inspection changes the economics of compliance. A framework that can be assembled in three weeks for a scheduled audit is worthless against an inspector who arrives on Tuesday. The commercially relevant point for anyone selling into Saudi: NCNICC-1 has just created a large population of mid-market organisations with a mandatory baseline and no internal capability to meet it, and no history of buying managed security. That is a genuine addressable market rather than a regulatory talking point.

🟡 Cyberespionage and supply chain move to the front of the GCC threat picture

Kaspersky's GReAT team is tracking more than 20 APT groups actively targeting organisations across the Middle East, Turkey and Africa in 2026. Over the past year spyware attacks in the Middle East rose 11 percent, password stealer attacks 12 percent, and users targeted by mobile spyware surged 65 percent. Mobile spyware growth at that rate against a region where executives conduct significant business on personal devices is an unmanaged exposure for most Gulf organisations.

Supply chain has become the dominant structural risk. Group-IB's 2026 analysis puts supply chain attacks at the top of the global threat list, with five GCC organisations, mainly in IT services and industrial sectors, identified as supply chain victims. Ransomware activity in the GCC remains concentrated, with more than 100 reported incidents, hitting real estate hardest at 39, followed by financial services at 25, manufacturing at 23, and government and healthcare at 21 each.

The AI dimension runs through all of it. Help AG's regional reporting notes attackers using AI to automate reconnaissance, scale phishing, accelerate exploitation chains and refine credential attacks with more speed and precision. GCC firms are responding by shifting spend from prevention tooling toward resilience and digital sovereignty.

Sources: Intelligent CISO, Intelligent CISO, Gulf News, Khaleej Times

Real estate leading GCC ransomware at 39 incidents is the detail worth acting on. It is a sector with large data estates, weak security maturity, heavy third-party dependency, and in the Gulf, direct exposure to sovereign wealth and government-linked portfolios. Nobody is selling into it properly. The supply chain finding matters more for how you defend than what you buy: five GCC victims concentrated in IT services means your MSP is a likelier route in than your firewall is a weak point. Ask for your providers' own attestations, not just their SLAs.

What GCC Security Leaders Are Dealing With

The dominant reality is that Gulf critical infrastructure is under persistent state-linked pressure that no longer tracks the news cycle. Three disclosed UAE campaigns in eight months, 71.4 percent of threats assessed as state-sponsored, and 20-plus APT groups active regionally describe a standing condition rather than a crisis. Security leaders who built their operating model around surge response during periods of tension are running the wrong model.

The second shift is regulatory scope expansion in both directions. Saudi's NCNICC-1 pulled every private-sector entity into a mandatory baseline. The UAE's national response protocol is consolidating incident handling. Both moves push obligations toward organisations that have historically bought security reactively. Combined with attacker use of AI to scale phishing and credential attacks, and supply chain compromise through IT service providers, the practical exposure for most GCC organisations now sits in two places they do not control: their identity layer and their vendors.

Three Things Worth Watching Next Week

1. A fourth UAE critical-infrastructure disclosure - Three campaigns across finance, aviation, energy and education establish a cadence. Watch telecoms and healthcare as the untouched high-value sectors.

2. First NCNICC-1 enforcement outcome in Saudi - Unannounced inspections started in 2026 but no public sanction has landed. The first one will define the market's urgency, particularly for SMEs.

3. GCC ransomware sector mix in Q3 reporting - Real estate at 39 incidents leads the current count. If that holds through Q3, it becomes the clearest under-served security market in the region.

Questions? hello@paringa.ai

Paringa runs managed security for GCC organisations that have to prove control, not just claim it, spanning identity, detection and regulatory evidence in one wrapper. Where the obligation is NCA, CBUAE or Cybersecurity Council, we build the artefacts that survive an unannounced inspection. | 7 September 2026 | © Paringa Ltd