- Organisations in the United Arab Emirates have become significantly more resilient to cyber attacks
- New research suggests that although threats remain widespread, fewer are succeeding in executing malware
- A report by the cybersecurity company Acronis found that the number of cases in which malware ran on systems declined
Organisations in the United Arab Emirates have become significantly more resilient to cyber attacks, with new research suggesting that although threats remain widespread, fewer are succeeding in executing malware.
A report by the cybersecurity company Acronis found that while phishing links and malicious campaigns continued to reach users across the UAE throughout 2025, the number of cases in which malware actually ran on systems declined steadily after an early spike in the year.
The findings, drawn from Acronis’ global threat analysis for the second half of 2025, show that malware activity in the UAE was concentrated in the early months of the year, peaking around March before falling consistently through the summer. The pattern suggests short-lived, campaign-driven attacks rather than persistent background infections.
Researchers said the early surges mirrored business-themed phishing and malware delivery campaigns commonly seen across the Gulf, which use familiar lures such as invoices, payment requests and logistics updates.
Once the campaigns were disrupted or lost credibility, their effectiveness declined rapidly.
At the same time, exposure to malicious URLs across the UAE remained consistently high throughout the year.
Phishing links and harmful websites continued to circulate widely, but increasingly failed to result in malware running on endpoints – an indication that threats were being stopped earlier in the attack lifecycle.
Email continued to dominate globally as the main delivery channel for cybercrime.
In the second half of 2025, email-based attacks increased by 36 per cent compared with the first half of the year.
Phishing accounted for 83 per cent of all email threats in the second half of the year, up from 77 per cent in the first half.
Malware-based email attacks remained comparatively low, while business email compromise and other social engineering activity stabilised, suggesting continued investment by criminals in fraud schemes that exploit human trust rather than system vulnerabilities.
The research also pointed to a widening divide between email and workplace collaboration platforms as attack channels.
While email threats focus on reach and volume, collaboration tools are increasingly being used for more advanced and targeted attacks, indicating that threat actors are tailoring their methods to specific environments.
The report also highlights the rapid expansion of AI-assisted cybercrime during 2025.
Criminal groups are increasingly using artificial intelligence to scale attacks, automate reconnaissance and refine extortion tactics.
Social engineering scams also evolved, with some ‘virtual kidnapping’ schemes using AI-generated images as convincing proof of life to pressure victims into paying.
Ransomware activity during the year became increasingly concentrated among a small number of high-volume operators.
Although nearly 100 ransomware brands were active globally, among the top ten groups, just three accounted for more than half of all disclosed victims.
Manufacturing and technology organisations remained the most frequently targeted sectors. Healthcare, financial services and construction also continued to feature prominently among disclosed victims.
“As cyber threats evolve at an accelerated pace, 2025 has shown that attackers are not only scaling traditional methods like phishing and ransomware, but are leveraging AI to act faster, more efficiently, and at greater scale,” said Gerald Beuchelt, CISO at Acronis. “Attackers are increasingly integrating AI into their operations, so the cybersecurity landscape is entering a new era. This shift requires organisations to anticipate threats, automate defences, and build resilient systems capable of withstanding both traditional and AI-driven attacks.”
