MEA Threat Landscape Report 2025

Key Insights from MEA’s Cyber Threat Landscape

Top Targeted Sectors:
Public Administration (18%) and Finance (10.32%) lead as the most targeted industries, underscoring attackers’ focus on sensitive government and financial data. Information Services (10.25%) follows closely, driven by the demand for data-rich platforms.

Dark Web Activity:
Selling (50.75%) and sharing (36.95%) dominate the MEA dark web ecosystem. Most activity revolves around monetizing stolen data, credentials, and network access, revealing a thriving underground cyber economy.

Ransomware Trends:
Pakistan faces the highest ransomware activity (37.7%), followed by Saudi Arabia (19.67%) and the UAE (14.75%). Emerging groups like FunkSec (11.2%) and RansomHub (9.7%) are leading attacks, with smaller operators making up over 70% of total activity—indicating a fragmented threat landscape.

Phishing Campaigns:
Public Administration (16.6%), Finance (15.98%), and National Security (13.2%) are the most targeted sectors. The UAE (26.3%) and Pakistan (25.57%) account for over half of regional phishing incidents. Notably, 84% of phishing sites now use HTTPS, making detection more challenging.

Dark Web Case Studies:
SOCRadar detected the sale of admin access to an Egyptian e-commerce site, a leaked student database from an educational service, and a 259GB database linked to Israeli shopping malls—demonstrating how diverse sectors are being exploited.

Why This Report Matters

The MEA region remains a hotbed for cybercrime driven by geopolitical tension, economic opportunity, and growing digital transformation. From ransomware and phishing to dark web data sales, organizations must stay vigilant against a variety of threats impacting both public and private sectors.

SOCRadar’s report empowers organizations with:

• Early intelligence on regional ransomware, phishing, and dark web trends.
• Insights into emerging threat actors and underground activities.
• Strategic recommendations to enhance resilience across industries.

Take Action Now

Protect your organization with SOCRadar’s advanced threat intelligence solutions:

• Dark Web Monitoring: Detect leaked credentials and data before cybercriminals act.
• Ransomware Intelligence: Track ransomware activity and emerging threat groups.
• Phishing Detection & Response: Identify and block sophisticated phishing campaigns in real time.