Cybersecurity threats across the Middle East, Türkiye and Africa are becoming more sophisticated and harder to detect, according to findings by Kaspersky at its annual Cyber Security Weekend for the META region last year.

The company’s Global Research and Analysis Team warned that organisations are still facing a rapidly evolving threat landscape shaped by ransomware, advanced persistent threats (APTs), supply chain vulnerabilities, mobile exploits and the growing use of artificial intelligence.

Researchers said they are currently tracking 25 active APT groups operating in the region, including SideWinder, Origami Elephant and MuddyWater.

These groups are increasingly deploying advanced techniques, particularly targeting mobile devices and using methods designed to evade detection.

Türkiye and Kenya recorded the highest proportion of users affected by web-based incidents, at 26.1 per cent and 20.1 per cent, respectively.

They were followed by Qatar (17.8 per cent), Nigeria (17.5 per cent) and South Africa (17.5 per cent).

Kaspersky said ransomware remains a dominant threat across the Middle East, driven by rapid digital transformation and expanding attack surfaces. In Africa, the threat has historically been lower due to slower digitisation and fewer high-value targets.

Still, experts warn this is changing as economies modernise, particularly in sectors such as finance, manufacturing and government.

A major concern is the growing use of artificial intelligence in cybercrime. Analysts highlighted the emergence of the FunkSec group, which has used AI-assisted tools to develop ransomware code and scale operations.

Unlike traditional groups demanding large payouts, FunkSec has adopted a high-volume, low-cost model, signalling a shift in how ransomware campaigns are conducted.

Experts also pointed to increasingly unconventional attack methods. In one case, the Akira ransomware group was able to exploit a webcam to bypass detection systems and gain access to internal networks. Such tactics reflect a broader trend of targeting overlooked entry points, including Internet of Things (IoT) devices, smart appliances and misconfigured workplace hardware.

The rise of large language models on underground forums is further lowering the barrier to entry for cybercriminals. These tools allow attackers with limited technical expertise to generate malicious code, automate phishing campaigns and carry out social engineering attacks at scale.

Sergey Lozhkin, Head of META and APAC regions in Kaspersky’s research team, said ransomware continues to evolve rapidly, with attackers adopting techniques once limited to highly advanced threat actors.

He warned that organisations must strengthen their defences by addressing weak points across increasingly interconnected systems.

Security specialists are urging businesses to adopt a layered approach to cybersecurity.

This includes keeping systems up to date, monitoring network traffic for suspicious activity, maintaining secure offline backups, and investing in threat intelligence and staff training.

At the same time, regional initiatives are reinforcing resilience. In Sharjah, authorities have this year expanded cybersecurity awareness, training programmes and partnerships aimed at strengthening digital and infrastructure security.

Officials say such efforts reflect a broader push across the region to improve preparedness against emerging cyber threats.