Sophisticated cyberattacks are surging across the Middle East, catalyzed by the Iran war and advances in AI that are making even the most elaborate hacking operations far easier.

That spike is especially prominent in industries that operate heavy and highly technical machinery, such as drilling for oil and gas; refining; power generation and transmission; and airports. Cybersecurity defenders describe these hacks as targeting “operational technology,” or OT, to distinguish them from IT hacks, which typically target far more commonly understood systems built by Microsoft, Google, and other software giants.

WHY IT MATTERS: OT hacks are typically far more dangerous than cyberattacks targeting IT systems — with consequences ranging from USD bns in business losses if an oil drilling operation is knocked offline to widespread chaos and even lost lives if a whole city loses power.

“The target value is higher in OT. You aren’t just causing an email outage or demanding a ransom. In some cases, you’re risking human life,” Patrick Miller (LinkedIn), CEO of Ampyx Cyber, a US firm that specializes in OT cyber defense, tells EnterpriseAM.

Historically, OT hacks have also been far harder to pull off than IT hacks, but AI is making it easier for hackers to gain expertise in once-obscure technology systems and to study an organization’s online activity, making it easier to con employees into letting an attacker in. “They’re studying this infrastructure in a very specific way. They’re trying to see what kind of security layers are associated with this critical infrastructure, who’s managing them, how they can surveil these people, how they can create an attack path,” Prayukth KV (LinkedIn), co-founder of the Abu Dhabi-based cyber firm Shieldworkz, tells EnterpriseAM.

BY THE NUMBERS:

• Shieldworkz detected an average of 14 OT hacks targeting Middle Eastern firms each month during 2025, up from just one per month in 2018, according to the firm’s annual threat assessment for the region.
• About half of those attacks targeted transportation systems, while a quarter targeted oil and gas refineries. The UAE, Israel, Saudi Arabia and Kuwait were among the most targeted countries in the region, Shieldworkz found.

It’s gotten worse since the US-Israel war on Iran broke out. OT cyberattacks targeting the Middle East rose 5.3% during the first half of 2026, which includes the first four months of the conflict in the Gulf, Prayukth tells EnterpriseAM. That includes a spike in ransomware attacks targeting OT systems, he says.

Other cyber firms see the same trend: “After the war started, we experienced numerous OT incident response cases linked to Iranian teams,” Robert M. Lee (LinkedIn), CEO of the cybersecurity firm Dragos, which specializes in protecting OT and investigating OT hacks, tells us. “Geopolitical conflict manifests first with OT [cyberattacks] and unfortunately there’s plenty these days to go around.”

None of the OT attacks in the Middle East is known to have produced catastrophic consequences — yet. In most cases, hackers breached OT networks but didn’t successfully disrupt operations. But each one should be seen as a warning shot, Prayukth says. “It’s a matter of speculation as to when [a major disruption] would potentially happen, but we are seeing signs of it already,” he adds, noting multiple significant OT intrusions in other parts of the world during the past year.

Warning shots: Those include a December attack on renewable energy systems in Poland, which threatened to disrupt power to up to 500k people in the middle of winter and an attack this summer that targeted water supplies in at least seven US states. The United Kingdom and the European Union publicly blamed and sanctioned Russia for the Poland attack. The Polish incident didn’t interrupt power generation, but prevented operators from controlling or monitoring those systems; investigators suspect Iran is responsible for the US water hacks.

The big picture: A 2025 Threat Roundup Report from the California-based cybersecurity firm Forescout found an 84% increase in worldwide cyberattacks using OT-specific protocols.

Real-world consequences: Going further back, there have been a handful of OT cyberattacks that had substantial real-world consequences, including a 2015 attack on the Ukrainian power grid that caused blackouts — attributed by the US government to Russia — and the 2010 Stuxnet attack, which crippled Iran’s nuclear program at the time, widely believed to have been launched jointly by US and Israeli intelligence agencies.

Historically, OT hacks have mostly been committed by the militaries and intelligence agencies of nation states looking to punish their geopolitical adversaries — but cybercriminals are increasingly getting into the mix. That’s partly because AI has made it easier for criminals to gain expertise in OT systems and to do extensive surveillance work. (In addition to OT technology systems being unfamiliar to most hackers, OT systems are supposed to be segregated from the internet, so hackers have to worm their way in, usually by hacking into the organization’s IT systems and finding erroneous connection points to OT networks.)

“What AI brings to the table is democratizing the access to this capability,” Samuel Linares (LinkedIn), the global OT cybersecurity lead for Accenture, tells EnterpriseAM.

It’s also because hackers have grown far more sophisticated about figuring out ways to make money from OT hacks, including by locking up the related systems that ensure the safety and operations of operational technology and holding them for ransom. “We have seen firsthand adversaries who didn’t know about OT, [but] were told by AI models to target OT and how,” Dragos’s Lee says. (Accenture closed in September its acquisition of a majority stake in Dragos.)

While there are some criminal groups targeting OT systems in the Middle East, nation states remain the biggest threat, Shieldworkz’s Prayukth says. About one-third of attributed OT hacks in the Middle East in 2025 were driven by “geopolitical motivation,” the company found, “reflecting the region’s role at the epicentre of active interstate conflicts.”

Shieldworkz described Iran as highly active in the region, but the company also observed hacking by Russian and Chinese groups, some of which conduct criminal hacking while also working on behalf of their governments. “It’s a lot of pressure tactics at the end of the day,” Prayukth says. “It’s about trying to tell governments that we can attack your critical infrastructure, we can hold your data and operations to ransom, and that can impact thousands or mns of people.”

WANT TO GO DEEPER? Cybersecurity took center stage at our EnterpriseAM Egypt Forum.