Experts from Kaspersky’s Global Research and Analysis Team (GReAT) shared their latest findings on cyber espionage threats across the Middle East, Türkiye, and Africa (META) region at the Cyber Security Weekend – META event. While most categories of cyber threats declined over the past year, cyber espionage activity in the region continued to rise unabated. Over this period, spyware attacks in Türkiye rose by 20 percent, while password stealer attacks showed a relatively stable picture within the regional threat landscape.
The cyber espionage ecosystem across the META region continues to be shaped by geopolitical tensions, regional conflicts, and ideological motivations. Intelligence-gathering activity is becoming increasingly critical for both Advanced Persistent Threat (APT) groups and cybercriminals, with organizations and individuals facing more frequent attacks aimed at seizing sensitive information and maintaining long-term access to compromised systems.
Looking at threats targeting organizations, entities in the Middle East were among the regions that saw the most pronounced rise in espionage-focused threats over the past year. In Türkiye, spyware detections rose by 32 percent, password-stealer attacks by 3 percent, and backdoor detections by 17 percent. Such malware is widely used to infiltrate corporate networks, seize sensitive information, maintain persistent access to systems, and carry out subsequent stages of targeted attacks.
As geopolitical developments continue to be one of the primary drivers of APT attacks, these groups remain among the most significant cyber risks facing businesses and public institutions in the region. Seeking to increase their persistence and evade detection, APT actors are continuously refreshing their toolkits by developing increasingly sophisticated malware capable of maintaining long-term access and gathering valuable intelligence. As of 2026, Kaspersky GReAT is tracking more than 20 APT groups actively targeting organizations across the META region.
Recent research by Kaspersky GReAT revealed that the MuddyWater APT group targeted organizations in the Middle East during the Gulf conflict with previously unseen malware chains. The campaign made use of custom-built loaders, injectors, previously unknown Remote Access Trojans (RATs), credential stealers, and a modular data exfiltration infrastructure. The findings illustrate how quickly the group can develop new tools in order to seize sensitive information and evade detection.
This surge in espionage activity is not limited to organizations, and is also targeting individual users. Attacks carried out using password-stealing software rose by 12 percent across the region over the past year. In Türkiye, spyware attacks targeting ordinary users grew by 10 percent over the same period. Data obtained through such attacks can be used to hijack accounts, orchestrate follow-up attacks, carry out extortion, or sell the data to third parties on black-market platforms.
Another rapidly growing trend is mobile cyber espionage. As smartphones increasingly become devices that store personal communications, corporate information, authentication data, and financial information, they are turning into extremely valuable targets for attackers.
Dmitry Galov, Head of Kaspersky’s Russia and CIS Global Research and Analysis Team (GReAT), commented: “Smartphones have become one of the most valuable sources of intelligence for cyber espionage actors. While Android devices remain the primary target of mobile spyware, we’re also observing a rise in reports of sophisticated campaigns targeting iOS, as seen in Operation Triangulation and, more recently, the Coruna attacks. These findings show that advanced mobile threats continue to evolve across both major platforms, and that mobile security has become an indispensable part of cyber resilience for both organizations and individuals.”
As cyber espionage threats continue to evolve, Kaspersky recommends that organizations adopt a layered cybersecurity approach that combines continuous vulnerability management, timely patching, employee awareness training, threat intelligence, and advanced security solutions such as Kaspersky Next. This approach helps detect sophisticated targeted attacks while protecting organizations against long-term system breaches.
