Saudi Arabia

This page covers cyber threats to Saudi Arabia. It brings together official Saudi texts, advisories from the US government, MITRE ATT&CK, and Brandefense research.

Threat groups that official sources link to Saudi Arabia

Each group below has a profile in our threat group library. Attribution is stated as given by the named body.

APT33: MITRE ATT&CK describes APT33 as a suspected Iranian group that has targeted organizations across multiple industries in the United States, Saudi Arabia, and South Korea, with a particular interest in the aviation and energy sectors.

MuddyWater: MITRE ATT&CK says MuddyWater has targeted telecommunications, local government, finance, defense, and oil and natural gas organizations in the Middle East, and names the UAE and Saudi Arabia in particular.

Lazarus Group: a joint advisory from the FBI, CISA and the US Treasury (AA21-048A, last revised 15 April 2021) lists Saudi Arabia among the countries where AppleJeus malware was used since January 2020, in sectors including energy, finance, government, industry, technology and telecommunications. These agencies attribute Lazarus Group to North Korean state-sponsored actors.

MITRE ATT&CK also describes groups that do not yet have a profile here. It says CopyKittens, an Iranian espionage group, has targeted countries including Saudi Arabia. It says HEXANE has targeted oil and gas, telecommunications, aviation and internet service provider organizations, with victims in Saudi Arabia among other countries, and that BITTER has targeted government, energy and engineering organizations in Pakistan, China, Bangladesh and Saudi Arabia.

Incidents on record

The incidents listed below are the major ones that officials or major media reported widely. Small incidents are not listed, and where sources differ the incident page says so.

How attackers target Saudi Arabia: Brandefense research

Our own research mentions Saudi Arabia in many posts. In summary, as our posts report:

State-linked espionage: the APT33 profile says the group has targeted aviation, energy and other sectors, mainly in the United States, Saudi Arabia and South Korea. The MENA groups overview says APT33 activity has been aimed at energy, aviation and defense industries, primarily in Saudi Arabia. The APT33 2025 forecast says one aim is to gather strategic information on rival countries, especially Saudi Arabia, and another APT33 profile links the Shamoon malware to the 2016 attacks on Saudi energy infrastructure.

The MuddyWater profile says the group runs regional influence operations against organizations in Israel, Saudi Arabia and Western countries, and the BugSleep analysis says investigations suggest MuddyWater may target Turkey, Azerbaijan, Jordan, Saudi Arabia and Israel. The BellaCiao analysis says Charming Kitten has been linked to attacks including one on the Saudi government. Two WIRTE posts (one, two) say it has targeted government agencies, military entities and diplomats in the Palestinian Authority, Jordan, Egypt and Saudi Arabia.

The Lazarus profile and our APT groups review list Saudi Arabia among countries where Lazarus tools were seen. The Bitter APT report refers to actors known for espionage against China, Pakistan and Saudi Arabia. The Mythic Leopard profile describes espionage against Indian diplomats and military personnel in some embassies in Saudi Arabia, and the El Machete profile says the group targeted government, energy and finance in several countries, Saudi Arabia among them, by 2022.

Stealers and ransomware: the Strela Stealer analysis says the malware, which steals e-mail login details, targets only Germany, Spain, Basque Country, Saudi Arabia and Poland. The AvosLocker research summary lists Saudi Arabia among its targeted countries.

Data for sale: a reported WhatsApp data sale listed 29 million user records of Saudi Arabian citizens. Our initial access broker article uses a dark web listing offering Saudi Arabia network and admin credentials as an example.

How Brandefense helps

In plain words, Cyber Threat Intelligence is how a security team learns which groups and malware are aimed at its country and sector, for example the Iran-linked groups named above in the energy and aviation sectors. Dark Web Monitoring is how it learns that staff or customer logins or network access are for sale, and Phishing Monitoring is how it finds fake sites that copy its brand.

Law and national strategy

The National Cybersecurity Authority (NCA) was established under Royal Order 55775 dated 23 August 2017. Its statute was issued by Royal Order 6801 dated 31 October 2017 and amended in 2021. It has financial and administrative independence and reports to the King. Its Legal Powers, which cover identifying cybersecurity violations and the legal procedures for them, were issued by Royal Decree M/117 dated 22 December 2024.

The NCA publishes controls for several areas: Essential Cybersecurity Controls (the page now shows ECC 2-2024), Cloud, Data (DCC-1:2022) and Operational Technology (OTCC-1:2022). The operational technology controls set minimum requirements to protect industrial control systems. The National Cybersecurity Strategy has six strategic goals and an action plan with three tracks.

How incident response is organized

The NCA website lists Saudi CERT services, publishes security alerts with a severity level and date, and has a page to report an incident. We could not open a separate English page describing the structure of Saudi CERT, so we do not describe it further.

Personal data

According to the national data governance platform run by SDAIA, the Personal Data Protection Law was issued on 16 September 2021. The platform offers online services including a personal data leak notification and a personal data complaint form.

The Saudi government pages we opened give no attack counts and name no threat groups for Saudi Arabia. The groups and incidents on this page come from US government advisories, MITRE ATT&CK, official statements and news reports. Figures for Saudi Arabia will come from Brandefense Atlas.