CRIL Flags Growing Threat of Middle East Cyber Attacks and Hacktivist Campaigns

Keypoints

• State-backed groups, hacktivists, and cybercriminals are targeting government, energy, finance, and communications systems across the Middle East.
• CRIL recorded a sharper phase of hybrid operations starting February 28, 2026, combining military strikes with cyberattacks to disrupt connectivity and services.
• Iran-linked threat actors such as Charming Kitten, APT33, MuddyWater, OilRig, and Pioneer Kitten are linked to espionage and infrastructure-targeting campaigns.
• Over 70 hacktivist groups launched campaigns and thousands of crisis-related domains and malicious apps have been used for social engineering and malware distribution.
• Critical infrastructure and maritime navigation (notably near the Strait of Hormuz) face heightened risk, prompting recommendations for MFA, patching, continuous monitoring, and threat intelligence collaboration.