Surge in Middle East Cyber Espionage Amid Ongoing Conflict

• •Cyber espionage targeting Middle Eastern governments surged within 72 hours of conflict onset.
• •Multiple state-aligned actors, including those linked to China and Belarus, are involved.
• •Hijacked government email accounts are being used to lend credibility to cyber operations.

Following the outbreak of fighting involving Iran, there has been a significant increase in cyber espionage activities targeting governments and diplomatic missions across the Middle East. Research from Proofpoint indicates that multiple state-aligned actors, including those linked to China, Belarus, and Pakistan, have initiated targeted campaigns within 24 to 72 hours of the conflict's start. Attack methods include the use of hijacked government email accounts, which complicate detection and incident response. Notably, a previously Belarus-aligned group has shifted focus from European targets to Middle Eastern governments, indicating changing intelligence priorities. Iran-linked groups, while active, have maintained existing operations rather than escalating dramatically. The research highlights the challenge of distinguishing between compromised internal communications and external impersonation due to the use of legitimate government infrastructure. Overall, the situation remains fluid as new actors emerge and existing groups adapt their strategies.