DDoS Attacks Report for Q3 2024: Middle East and Africa (MENA)

DDoS attacks surged by 238% in the Middle East and Africa in Q3 2024, as botnets more than quadrupled in size and hackers intensified attacks against Israel. This report looks into what’s driving this increase, which industries are being hit hardest, and the countries facing the most attacks.

Welcome to the Q3 2024 DDoS Threat Report for the MENA region. This report highlights DDoS attacks targeting StormWall’s clients in the Middle East and Africa during the third quarter of 2024, as observed through our advanced traffic filtering network.

StormWall’s global filtration network, which includes key points of presence in the UAE and has a peak capacity exceeding 4500 Gbit/s, protects thousands of businesses in MENA—from multinational corporations to local SMEs. This infrastructure enables us to provide valuable insights about the state of DDoS threats across the MENA region.

Q3 2024 Main Trends

First, let’s look at the trends that defined the DDoS threat landscape in the MENA region during the third quarter of 2024.

• The third quarter of 2024 saw a sharp rise in DDoS attacks across the MENA region, with a 238% year-over-year increase compared to Q3 2023. 
• The financial sector remained the primary target, accounting for 42% of attacks. This was followed by the entertainment industry, which made up 21%.
• Attacks on financial institutions increased by 284%, while those on entertainment organizations rose by 237%, continuing trends first observed in Q2 2024.
• Some of the most powerful attacks occurred in the UAE, with peak volumes reaching 1.5 Tbit/s. This underlines the increasing technical capacity of attackers operating in the region.
• Hyper-volumetric network-layer DDoS attacks surged in the MENA region during Q3, with a 400% increase over the previous quarter. Rare just a few months ago, these attacks are now a common threat.
• The size of botnets used in DDoS attacks also expanded significantly. On average, botnets in Q3 2024 consisted of 28,000 devices, compared to 7,000 devices a year earlier.
• Geographically, the UAE and Saudi Arabia experienced the highest volume of attacks, accounting for 31% and 16% of the total, respectively. These countries continue to face persistent threats due to their digital and economic prominence.
• To explore how these trends are shaping the DDoS threat landscape in MENA—read on.

To explore how these trends are shaping the DDoS threat landscape in MENA—read on.

Banks and Entertainment under Fire

In Q2 2024, StormWall observed a shift in DDoS attack targets. Politically motivated hackers became less active, while financially driven attackers stepped up their efforts. This trend has only intensified in Q3. Here’s how the numbers stack up.

In Q3, attacks on the financial sector rose to 42% from 38% in Q2, representing a quarterly increase of 10.5%, but the annual increase is much greater at 284%. Meanwhile, the entertainment sector saw its share of attacks more than double, jumping from 10% to 21%—a 110% jump QoQ. But the year-on-year growth was even more pronounced—237%.

In contrast, the government sector accounted for just 10% of attacks in Q3. To put it another way, hacktivism in the MENA region has become 70% less prevalent since the start of the year. However, looking at the bigger picture, attacks are growing across all sectors. Compared to Q3 last year, attacks on government targets have actually increased by 162%.

The infrastructure behind these attacks has also advanced significantly. Botnets used in Q3 were four times larger than those seen a year ago, directly contributing to the rise in attack intensity. A notable example is the 1.5 Tbit/s attack recorded in the UAE this quarter, showcasing how attackers are exploiting this expanded capacity.

The growing size of botnets has driven a 400% quarter-over-quarter rise in hyper-volumetric DDoS attacks, now among the most prevalent threats in the MENA region.

The impact is clear: resources once reserved for nation-state actors are now within reach of for-profit hackers. The availability of larger botnets has lowered the bar for executing high-impact attacks, allowing these groups to target critical infrastructure with alarming efficiency.

Impact of Geopolitics on DDoS Attack Distribution

Geopolitics no longer dominate the DDoS landscape in MENA as they did earlier this year, but they remain a factor. Attacks on government services, for example, grew 162% in Q3, making them the third fastest-growing target.

Saudi Arabia saw the most activity, accounting for 16% of all attacks in Q3, up from 14% in Q2. Its economic prominence and the launch of the “Global Alliance for the Implementation of the Two-State Solution,” aimed at creating a Palestinian state, have made it a target for hacktivists opposing the initiative.

This led to a surge in hacktivism. Hacktivists use cyberattacks, particularly DDoS attacks, to grab headlines and draw attention to their causes. Unlike traditional hacking, DDoS attacks don’t require advanced technical skills, making them a favored tactic for less experienced actors.

As hacktivist attacks in Saudi Arabia rose 80% quarter-over-quarter. Pro-Palestinian groups responded with counterattacks on financial and entertainment sectors in other GCC states, including a six-day DDoS assault on a UAE bank. 

A similar story unfolded in Israel, which faced a sharp rise in DDoS activity, accounting for 14% of MENA’s attack traffic in Q3, more than double its 6% share in the previous quarter. The increase coincided with escalating tensions in Gaza. As the conflict spilled over regional borders, it triggered a wave of hacktivist activity. Most attacks—60%—targeted news and media outlets, while 30% were aimed at the financial and fintech sectors.

Attack Share by Industry

The table below shows the impact of the above trends on the distribution of DDoS attacks by sector:

The industries with the highest year-over-year growth in DDoS attacks in the third quarter of 2024 are shown here:

Let’s take a closer look at how attacks on various sectors have shifted from the previous quarter to the current one:

• Financial and payment services solidified their position as the most targeted sector, increasing the share of attacks from 38% in Q2 to 42% in Q3. 
• Entertainment saw significant growth as well, rising from 10% in Q2 to 21% in Q3.
• Government services dropped further in ranking, accounting for 10% of attacks in Q3 compared to 16% in Q2. 
• Retail, which was the second most targeted sector in Q2, fell to 6% in Q3, growing only 86% year-over-year. 
• Similarly, Oil and Gas saw modest activity, accounting for 5% of attacks in Q3, with a year-over-year increase of 72%.
• Manufacturing reappeared on the list in Q3, accounting for 4% of attacks, after not being targeted in Q2.
• Meanwhile, Logistics dropped slightly to 3%, and attacks on this sector grew 36% year-over-year.

• Retail, which was the second most targeted sector in Q2, fell to 6% in Q3, growing only 86% year-over-year. 
• Manufacturing reappeared on the list in Q3, accounting for 4% of attacks, after not being targeted in Q2.
• Meanwhile, Logistics dropped slightly to 3%, and attacks on this sector grew 36% year-over-year.

Here is a closer look at the top 3 target verticals:

1. Financial and payment services

Attacks on financial and payment services dominated the MENA region, making up 42% of all DDoS attacks. This category also experienced unprecedented year-over-year growth, with a staggering 284% increase—the highest ever recorded by StormWall in any region.

Over 60% of attacks targeting banking services were carried out by extortionists, with nearly half of affected clients reporting ransom demands. Attackers relied on the duration of their assaults as leverage—more than 80% of these attacks lasted over four hours, aiming to maximize financial damage. However, all services protected by StormWall remained online without any downtime. Around 20% of attacks in this sector were linked to hacktivism, with politically motivated groups focusing on banking and financial institutions in countries involved in the Gaza conflict, particularly Israel.

The most powerful attack recorded in this category targeted a UAE-based bank, hitting 1.5 Tbps with a botnet of over 30,000 devices. 

2. Entertainment

DDoS attacks on MENA’s entertainment and gaming industries continued to climb in Q3 2024, accounting for 21% of all attacks in the region—a 237% increase year-over-year. In gaming, DDoS tactics are often used by players and groups to gain a competitive edge in tournaments and matches or to disrupt live streams of these events. As with the financial sector, ransom demands were the most frequent motive, appearing in nearly 40% of cases.

Cybercriminals also targeted concerts and live shows by attacking e-commerce platforms that sell tickets. These attacks sought to disrupt ticket sales by overwhelming the platforms, preventing fans from completing their purchases.

3. Government

DDoS attacks on government services in MENA surged by 162% year-over-year, making up 10% of all recorded incidents. A significant part—nearly 60%—targeted nations directly linked to the Israel-Palestine conflict, including Israel, Palestine, Iran, and Saudi Arabia. Meanwhile, other MENA countries faced a different threat landscape, with profit-driven hackers focusing on wealthier economies.

Hacktivist attacks during this period originated from a wide range of sources. Malicious traffic was traced back to countries like Sudan, Indonesia, China, and parts of Europe.

DDoS Attacks in MENA: Breakdown by Country

Let’s explore how DDoS attacks were distributed across the MENA region in Q3 2024:

Looking at attack distribution by country, in Q3, the UAE remained the most targeted country in MENA, with its share of DDoS attacks rising from 27% to 31%. This reflects its position as a hub for critical infrastructure and high-value targets, particularly in finance and entertainment, making it a prime focus for cybercriminals.

Saudi Arabia also saw an increase, climbing from 14% to 16%, with attackers primarily targeting the energy sector due to its influence in global oil markets. The most significant shift was in Israel, where attacks more than doubled, jumping from 6% to 14% amid the escalation of the Gaza conflict. Palestine also experienced an increase, with its share rising from 3% to 6%.

Conclusion

The MENA region’s DDoS threat landscape is evolving at an unprecedented pace. The sharp rise in attack volumes, increasingly sophisticated tactics, and expanding botnet sizes underscore the need for robust defenses. Financial institutions, entertainment platforms, and government services remain top targets, with geopolitical tensions further fueling the threat.

StormWall will continue to monitor these trends and provide updates to help organizations stay ahead of emerging threats.