Egypt

This page covers cyber threats to Egypt. It brings together Egyptian government pages, the OECD, news reports from Al Jazeera and the Washington Post, and Brandefense research. Egypt is a market where official sources publish few attack figures, so the page leans on named incidents and on what each source says.

Threat groups that official sources link to Egypt

The official sources we opened do not name Egypt as a target of any group that has a profile in our threat group library, so we list none here. Groups that Brandefense research links to Egypt are in the research section below, with our own wording.

Incidents on record

These are the major incidents only, the ones with national impact and wide coverage. Smaller events, and claims that no official or major news source confirmed, are left out.

How attackers target Egypt: Brandefense research

State-linked espionage: our MENA APT post says SideWinder was linked to a 2024 espionage campaign on ports and maritime facilities in countries important to India, including Egypt, using phishing e-mails to staff of port authorities and logistics firms. The WIRTE profile (also in a second post) lists government agencies, military entities and diplomats in the Palestinian Authority, Jordan, Egypt and Saudi Arabia as targets. The Equation Group post lists Egypt among countries that were targeted but less heavily than others.

Fraud and data sales: the Smishing Triad post says the group sends text message phishing that impersonates Egypt Post, among other postal and bank brands, and has affiliates in Egypt. A reported WhatsApp data sale listed 45 million user records of Egyptian citizens among its 84 countries.

How Brandefense helps

In plain words, Cyber Threat Intelligence is how a security team learns which groups and malware are aimed at its country and sector. Dark Web Monitoring is how it learns that staff or customer logins or records are for sale, and Phishing Monitoring is how it finds fake sites and messages that copy its brand, such as the postal lures described above.

Law and national strategy

The Ministry of Communications and Information Technology (MCIT) says the Supreme Cybersecurity Council is the highest national authority for cybersecurity and sets national policy. The State Information Service says the council was formed by a prime minister’s decree in December 2014. It says a May 2017 directive bound all government bodies and state-owned enterprises to the council’s protocols for critical information infrastructure.

MCIT says the first national strategy ran from 2017 to 2021 and the current one, for 2023 to 2027, is in force. The State Information Service lists five pillars: governance, public awareness, stronger defenses through upgraded incident response centers, research in cryptography and threat detection, and international cooperation. It adds that guidelines on violations and penalties under the cybersecurity law were published in the Official Gazette in 2025, and that compliance guidelines for private entities outside critical infrastructure were issued the same year. MCIT says Egypt signed the UN Convention against Cybercrime.

How incident response is organized

EG-CERT was set up by the National Telecom Regulatory Authority in April 2009. It says it gives around-the-clock support to protect critical information infrastructure. MCIT calls it the national technical authority and the executive arm of the council. It leads incident response, threat monitoring, digital forensics and vulnerability management. The national regulator also says EG-CERT gives early warning of malware and large attacks on Egypt’s telecom infrastructure. EG-CERT takes incident reports at incident@egcert.eg and on 15315.

Sectors and rating

MCIT lists a perfect score and a Tier 1 ranking in the ITU Global Cybersecurity Index 2024, and EG-CERT says the same score put Egypt among the top 12 countries. These are Egyptian government statements, and we have not checked them against the ITU publication.

Personal data

Law No. 151 of 2020 on personal data protection was passed by the President in July 2020. MCIT says it requires data collectors and processors to hold the licenses, permits and approvals they need, and makes it a crime to process data in ways the data owner did not authorize. The Cairo Governorate portal says it applies to Egyptians inside the country and abroad. MCIT said a personal data protection center was to be established to run the licensing.

The Egyptian government pages we opened give no attack counts. The incidents on this page come from major news reports, an OECD report, and figures for Egypt will come from Brandefense Atlas.