Ransomware in the UAE in 2026: how attacks get in and what to do in the first hour

What the public numbers say

The most useful UAE source is the State of the UAE Cybersecurity Report 2025, published by the UAE Cyber Security Council with CPX in February 2025. As reported by Gulf News, it found:

• 58% growth in the number of ransomware groups operating in the UAE.
• More than 223,800 assets hosted in the UAE potentially exposed to cyberattacks.
• Half of critical vulnerabilities left unaddressed for over five years.

The last point matters most for a normal company. Ransomware crews do not need new techniques when old holes stay open. The Council's own site is csc.gov.ae, and the Emirates News Agency (WAM) carries its announcements.

We have not included figures we could not trace to a published source. You will see other numbers quoted online, often without a link to the report behind them.

How attacks get in

The Sophos State of Ransomware 2025 survey asked 3,400 IT and security leaders in 17 countries, all hit by ransomware in the past year, what the root cause was:

• Exploited vulnerability: 32%. The most common cause for the third year running.
• Compromised credentials: 23%.
• Malicious email: 19%, and phishing: 18%.

Translated into what an attacker actually touches in a UAE office:

1. Credential phishing

A fake Microsoft 365 sign-in page, sent as a voicemail notice, a shared invoice or a courier update. The user types their password, the attacker logs in. Without MFA that is the whole attack. With basic MFA, attackers now use pages that relay the MFA prompt too, so phishing-resistant methods (number matching, passkeys) and blocking legacy sign-in matter. The email security guide covers the related invoice-fraud pattern.

2. Unpatched VPN or firewall

Firewalls and VPN gateways sit on the internet by design, and their vulnerabilities are published and scanned for within days. A device that is a few patches behind, or past its vendor's support date, is the single most common way in. Treat edge-device patches as urgent, measured in days, not the monthly cycle used for laptops.

3. Remote desktop (RDP) open to the internet

Remote desktop published directly to the internet, often set up "temporarily" for a supplier or a remote worker years ago. It is found by automated scanning and attacked with stolen or guessed passwords. Put remote access behind a VPN or a gateway with MFA, and close the port.

The first hour

If screens show a ransom note or files suddenly will not open, these steps follow the response checklist in the CISA #StopRansomware Guide:

1. Isolate, do not power off. Unplug network cables or turn off Wi-Fi on affected machines. If many are affected, disconnect at the switch. Only switch a machine off if you cannot isolate it, because memory may hold evidence and sometimes keys.
2. Protect the backups. Disconnect backup servers and storage from the network and change their admin passwords from a clean device. Attackers go after backups early.
3. Coordinate by phone. Assume email and Teams are being watched. Use mobile phones or a messaging group set up outside company systems.
4. Close the door they used. Disable VPN and remote access accounts until you know which one was used, and reset admin and email passwords from a clean machine.
5. Call your IT provider or incident responder, and your cyber insurer if you have one. Many policies require you to use their panel and to call before spending money.
6. Report it to the UAE Cyber Security Council and the police, and to your sector regulator if you have one.
7. Write things down: times, machines, the ransom note (photograph it), who did what. You will need it for the insurer, the regulator and the recovery.

What happens after the first hour, including recovery order and communications, is in our ransomware recovery planning guide.

Prevention checklist

Most attacks are stopped by doing ordinary things on every device and account, not by buying one more product:

• MFA on every email account, VPN and remote access, and every admin account. No exceptions for the CEO.
• Legacy sign-in methods blocked in Microsoft 365.
• Firewall, VPN and other internet-facing devices patched within days of a critical fix, and replaced when out of vendor support.
• No remote desktop open to the internet. Check with an external scan, not from memory.
• EDR (endpoint detection and response) on every laptop and server, watched by someone who acts on alerts.
• Separate admin accounts, used only for admin work.
• At least one backup copy that is offline or immutable, with different credentials from production, restored in a test this year. Use the backup restore test checklist.
• Phishing awareness training, with a simple way to report a suspicious email.
• A one-page incident plan with phone numbers on paper, rehearsed once a year.

Our free cyber-readiness score checks these in ten questions. If you would rather have someone look, Missan has 22+ years of IT and security work in the UAE, and 5,000+ clients served since 2004. Ask for a ransomware readiness review below.

Related Missan services

• Managed cybersecurity and MDR
• Backup, disaster recovery and cloud
• Free cyber-readiness score
• Emergency IT support

Frequently asked questions

Is ransomware a real risk for UAE companies, or only for big targets?

It is a real risk at every size. The UAE Cyber Security Council and CPX State of the UAE Cybersecurity Report 2025 reported 58% growth in the number of ransomware groups operating in the UAE. Attackers mostly scan for weak points, such as an unpatched VPN or a reused password, rather than choosing companies by name.

How do ransomware attacks usually get in?

In the Sophos State of Ransomware 2025 survey of 3,400 organisations, the most common root cause was an exploited vulnerability (32%), followed by compromised credentials (23%), malicious email (19%) and phishing (18%). In practice that means unpatched firewalls and VPNs, remote desktop exposed to the internet, and stolen passwords without MFA.

What should we do in the first hour of a ransomware attack?

Disconnect affected machines from the network, but do not switch them off unless you cannot isolate them, because memory can hold evidence. Use phone calls rather than company email to coordinate. Protect your backups by cutting their network access. Call your IT provider or incident responder, and report the incident to the UAE authorities. These steps follow the CISA #StopRansomware response checklist.

Should we pay the ransom?

Authorities advise against it. Paying does not guarantee you get working data back, and it marks you as a company that pays. The decision also has legal and insurance angles, so involve your lawyers and insurer before anyone talks to the attackers. The reliable way out is a clean, tested backup.

Where do we report a ransomware attack in the UAE?

Report it to the UAE Cyber Security Council and to the police. Regulated businesses such as banks, insurers and healthcare providers usually also have to notify their own regulator within a set time, and the UAE data protection law may require notifying affected people if personal data was exposed. Check your sector rules and your cyber insurance policy now, before you need them.

Does cyber insurance cover ransomware?

Many policies do, but insurers now ask detailed questions first: MFA on email and remote access, EDR on every device, offline or immutable backups, and a tested incident plan. A wrong answer on the form can void the claim. Our guide to cyber insurance questionnaires covers the usual questions.

This guide is general information for planning, not legal or tax advice. Regulations and deadlines change; confirm the current position with the official source linked in the text and with your own advisers. Last reviewed 25/10/2026.