BAHRAIN experienced a significant reprieve from cyber onslaughts in the second quarter of 2026, even as the wider Middle East and North Africa (Mena) region was battered by a massive surge in distributed denial-of-service (DDoS) attacks driven by ongoing geopolitical tensions.
According to a regional threat landscape report by cybersecurity firm StormWall, Bahrain’s share of regional DDoS incidents dropped sharply from 19 per cent in the first quarter of the year to just six per cent in the second quarter.
Security experts, however, caution against local complacency as overall cyber threat activity across the region reaches unprecedented levels.
Across the Mena region, DDoS attacks surged by 288pc year-on-year during the second quarter, following a record 574pc spike in the first quarter.
In total, StormWall mitigated more than 85,000 individual attacks in the Middle East between April 1 and June 30. The sharp rise in regional activity was largely driven by politically motivated hacktivists, who accounted for 83pc of all attacks, while commercial extortion and sabotage made up just 17pc.
Cybersecurity analysts noted that as political turbulence in the Middle East continues, that conflict is increasingly spilling over into cyberspace in the form of record-breaking attack volumes intended to disrupt services and cause public outages.
While Bahrain saw its regional share fall, neighbouring Gulf countries and regional actors bore the main impact of these digital strikes.
The UAE remained the most targeted nation in the region for the second consecutive quarter, absorbing 27pc of all regional attacks with a
268pc year-on-year increase.
UAE authorities reported roughly 600,000 attack attempts per day by April, which is nearly triple pre-war levels, targeting government portals, airports, and banking systems.
Saudi Arabia ranked as the second most attacked country at 19pc, experiencing a 214pc year-on-year growth. Iran entered the regional target rankings in third place with a 14pc share and a 312pc year-on-year attack growth - the highest growth rate recorded in the region.
Israel saw its share of attacks rise from seven per cent to 12pc, reflecting a 306pc year-on-year increase. Qatar accounted for 10pc of regional attacks, down from 14pc in the previous quarter, while Kuwait’s share dropped from 12pc to eight per cent.
Jordan’s share remained unchanged at three per cent. Cybersecurity experts highlighted major changes in attack tactics across the region during the second quarter. Deviating from global trends where cyber attacks are becoming shorter, the average duration of DDoS attacks in Mena expanded fivefold, rising from 30 minutes to 150 minutes, with the longest single attack repelled lasting nine consecutive days.
The average size of botnets used in attacks tripled year-on-year from 12,000 to 36,000 compromised devices, making standard IP geo-blocking strategies ineffective against geographically dispersed traffic. Attackers also relied heavily on multi-vector campaigns, which grew 148 per cent year-on-year due to the rising popularity of low-cost DDoS-for-hire platforms.
Furthermore, preliminary probing attacks grew 122pc year-on-year as threat actors routinely tested target defences with low-volume traffic to identify weak points before launching large-scale strikes.
Critical public infrastructure and service providers bore the primary brunt of these cyber campaigns across the region. The government sector was the most targeted vertical for the second quarter in a row, capturing 28pc of all attacks and recording a 316pc year-on-year increase, driven mainly by TCP-flood attack vectors.
Telecommunications was the second most targeted sector at 21pc of attacks, growing 203pc year-on-year as hackers targeted Gulf carriers with UDP-based amplification floods to cause visible disruptions.
The finance sector placed third, accounting for 18pc of attacks and growing 148pc year-on-year, with heavy targeting of mobile banking endpoints and transaction APIs making it the most application-layer-heavy vertical.
Transportation attacks nearly tripled to a 14pc regional share - up from five per cent in Q1 - growing 118pc year-on-year as maritime and aviation infrastructure came under strike.
Manufacturing accounted for nine per cent of attacks with an 84pc growth, the oil sector saw its share fall to four per cent despite a 61pc growth, while healthcare at three per cent share with a 32pc growth and education at two per cent share with a 19pc growth remained marginal targets.
“In most cases, StormWall did not receive ransom demands. Instead, the attackers’ primary objective appeared to be service disruption and sending a message, which likely explains the unusually long duration of these attacks,” said Ramil Khantimirov, founder and chief executive officer of StormWall. “We recommend that all organisations operating across the Mena region implement modern DDoS protection against all types of contemporary DDoS attacks,” he added.
Despite the drop in attack volume directed at the kingdom during the second quarter, local cybersecurity teams are urged to remain alert.
Threat specialists caution that with botnet capacities tripling and multi-vector strategies becoming standard practice, organisations across all sectors in Bahrain must maintain comprehensive defence systems to protect critical infrastructure against sudden surges in cyber disruption.
avinash@gdnmedia.bh
&uuid=(email))