New research from Acronis shows that while cyber threats remain highly active across the UAE, organisations are becoming markedly better at stopping attacks before they escalate. Despite continued exposure to phishing links and malicious campaigns throughout 2025, malware execution in the UAE declined steadily after early-year spikes, pointing to stronger defences and faster disruption of attack chains.
The findings, drawn from Acronis’ latest global threat analysis for the second half of 2025, reveal that malware activity in the UAE was concentrated in the first months of the year, peaking around March before dropping consistently through the summer. This uneven pattern suggests short-lived, campaign-driven attacks rather than persistent background infections.
These early surges closely matched business-themed phishing and malware delivery campaigns commonly seen in the Gulf, using familiar lures such as invoices, payment requests and logistics updates. Once those campaigns were disrupted or lost credibility, their effectiveness fell away quickly.
At the same time, exposure to malicious URLs across the UAE remained consistently high throughout the year. Phishing links and harmful websites continued to reach users, but increasingly failed to result in malware running on endpoints. This is a clear sign that threats were being stopped earlier in the attack lifecycle.
Email remains the front door for attackers
Globally, email continued to dominate as the most effective delivery channel for cybercrime. In H2 2025, email attacks increased by 36% compared to the first half of the year, reinforcing email’s role as the primary entry point for large-scale attacks.
Phishing accounted for 83% of all email threats in H2, up from 77% in H1, reflecting attackers’ growing reliance on impersonation, social manipulation and business-context deception rather than technically complex payloads. Malware-based email attacks remained relatively low, while business email compromise and social engineering activity stabilised, pointing to sustained investment in fraud that targets human trust rather than system vulnerabilities.
The research also highlights a growing divergence between email and collaboration platforms. While email threats prioritise reach and volume, collaboration tools are increasingly used for more advanced, targeted attacks, demonstrating how threat actors tailor their techniques to different environments.
AI accelerates scale and sophistication
2025 also saw a dramatic rise in AI-assisted cybercrime. Threat actors leveraged AI to scale attacks, automate reconnaissance, and optimise extortion strategies. For example, GLOBAL GROUP used AI-driven systems to manage ransomware negotiations efficiently across multiple victims, while GTG-2002 employed AI-assisted reconnaissance and data exfiltration to maximise impact. Even social-engineering attacks evolved: virtual kidnapping scams used AI to generate convincing “proof of life” images, deceiving victims and amplifying psychological pressure. These innovations highlight a new era of cybercrime, where speed, sophistication, and scale challenge traditional defences.
Ransomware: Fewer groups, bigger impact
Ransomware activity in 2025 was increasingly concentrated among a small number of high-volume operators. Although nearly one hundred ransomware brands were active, among the top ten, just three groups accounted for more than half of all disclosed victims, highlighting the dominance of mature ransomware-as-a-service ecosystems with proven tooling and monetisation models.
Manufacturing and technology organisations remained the most frequently targeted sectors, reflecting high operational pressure, complex IT and OT environments, and broad supplier connectivity. Healthcare, financial services and construction also continued to feature prominently among disclosed victims.
“As cyber threats evolve at an accelerated pace, 2025 has shown that attackers are not only scaling traditional methods like phishing and ransomware, but are leveraging AI to act faster, more efficiently, and at greater scale,” said Gerald Beuchelt, CISO at Acronis. “Attackers are increasingly integrating AI into their operations, so the cybersecurity landscape is entering a new era. This shift requires organisations to anticipate threats, automate defences, and build resilient systems capable of withstanding both traditional and AI-driven attacks.”
Discussion about this post