Gaza war pushes Israel-UAE ransomware cooperation back behind closed doors

In mid-February, the head of the UAE Cyber Security Council implausibly claimed that all ransomware attempts in the state in 2024 were ‘successfully thwarted’ with the help of private sector partners – despite a reported 32% increase in such incidents that year. Perhaps unsurprisingly, he made this claim at a conference sponsored by said partners to publicise their latest threat intelligence, including on a malicious actor jarringly dubbed ‘Crafty Camel’.

However, the national origin of some of those private sector partners was conspicuously absent from this announcement. As well as the usual roll-call of cybersecurity companies from the US, UK, and Europe, the UAE cybersecurity sector features a range of Israeli companies offering both offensive and defensive products and services.

Israel-UAE cybersecurity cooperation has been fundamentally reshaped by Israel’s war in Gaza, one of many far wider changes in regional geopolitics. Due to the reputational risks of public cooperation, their cybersecurity relationship has returned to the quiet, back-room deals favoured by both countries before their landmark normalization five years ago.

Israel-UAE digital recognition

In 2020, the UAE played a leading role championing the Abraham Accords, a normalization agreement between Israel and several Arab states (also including Bahrain, Morocco, and Sudan). The Accords are but one step in a Israel-UAE security partnership decades in the making. 

As I argue in a recent article with Bassant Hassib, cybersecurity cooperation, along with cloud infrastructure and subsea cables, played a key role in Israel-UAE normalisation through ‘digital recognition’: the way digital technologies both pave the way for and make necessary changes in wider diplomatic relations. 

Perhaps the most notorious aspect of Israel-UAE cybersecurity cooperation is the sale of Pegasus spyware, built by Israeli company NSO Group and reportedly used by UAE royals to target domestic civil society and their families abroad. 

Other aspects of Israel-UAE cybersecurity cooperation are more defence-oriented. Etisalat, the company reportedly targeted by Lockbit, began receiving threat intelligence support from Israeli company Cyberint in 2023. 

A year after Israel announced its intention to build a ‘Cyber Dome’ at a 2022 ‘Cyber Week’ event, the head of the UAE Cyber Security Council, Mohamed Al Kuwaiti, said that Israel is ‘helping us to build a cyber Iron Dome or improve the existing one’. However, the Cyber Dome was still under development in October 2023, a week after the Hamas attacks.

Abraham Accords in limbo

Since the start of the Gaza war, all Arab states have faced domestic backlash for insufficiently supporting the Palestinian cause. This deficient support should be no surprise, however, given those states’ leaders’ intense dislike of Hamas and other Palestinian organizations.

The UAE in particular has experienced unusually open public criticism of its Israel policy, as well as incidents of antisemitism, including the murder of a well-known rabbi. Despite this difficult position, the UAE has sought to maintain levels of normalisation established by the Abraham Accords. It is the only Arab state not to recall its ambassador to Israel, and it has continued direct flights to Israel throughout the war.  

The Israel-UAE trade relationship has also suffered. As Israel’s GDP contracted over 20% during the war, the UAE’s commercial ties were described as a ‘lifeline’. Even so, investments and joint ventures in sectors as diverse as energy and meat production have been put on hold or discontinued. In the words of one businessman, ‘it’s still happening, [but] it’s happening less.’ 

However, as the current ceasefire hangs precariously in the balance, there are signs of a return to the pre-7 October status quo: in January 2025, the UAE state-owned defence company Edge bought a minority stake in an Israeli company that specialises in anti-drone protection.

Ransomware – a shared threat

The UAE’s recently released annual national cybersecurity report notes that – like many other countries – ransomware is one of the UAE’s top cyber threats, with 19 ransomware groups named as active in the UAE in 2024 (up from 12 the previous year). 

The UAE has also recently held its annual ‘Cyber Wargaming’ exercise. The wargame, now in its fourth iteration, focuses on protecting banking and financial services, with the original scenario in 2021 devised as a nation-state sponsored ransomware attack. 

So far, this specific scenario has not occurred in the UAE – at least according to public information. The highest profile reported incident is a disputed compromise of UAE-headquartered regional telecoms giant Etisalat (now e&) by the notorious Lockbit ransomware group, days before an international law enforcement operation disrupted the group in February 2024.

State-sponsored ransomware operations have similarly been a longstanding high priority issue for Israel. Iran-linked groups have conducted ransomware operations targeting the country at least since 2020, sometimes leaking data simply to cause disruption rather than collect payment. 

Understanding this overlap in targeting intentions is a perennial issue for Iran cyber threat analysts. Israeli cybersecurity companies have described apparent ransomware operations as ‘masking destructive influence” from Iran. 

However, more recent Iran-linked activity seems to fit more to the standard ransomware ‘playbook’. A US advisory in August 2024 highlighted Iranian state-sponsored actors acting as initial access brokers and collaborators with major ransomware groups, without disclosing the groups’ nationality or location.

Crystal Ball and the CRI

The UAE and Israel’s joint approach to ransomware threats shows how their process of digital recognition has come under significant pressure since the Gaza war. One key element of Israel-UAE cybersecurity cooperation is Crystal Ball, a threat intelligence sharing platform developed by Microsoft, Israeli company Rafael Advanced Defense Systems, and UAE cybersecurity company CPX (co-author of the annual cybersecurity report above). 

Crystal Ball was first announced in June 2023 by Al Kuwaiti during Cyber Week in Tel Aviv, in a well-publicised keynote address alongside the Director General of the Israel National Cyber Directorate. In his remarks, Al Kuwaiti mentioned that the platform had already helped the two countries defend against an unspecified distributed denial of service (DDOS) attack.

In May 2024, Crystal Ball was subsumed into the Counter Ransomware Initiative (CRI), an international multistakeholder group including over 60 countries, with both the UAE and Israel as members. Crystal Ball was then promoted at the CRI annual conference in October 2024, and demonstrated to over 14 countries at a UAE cybersecurity event in November 2024. 

Publicity surrounding the incorporation of Crystal Ball into the CRI, in the midst of the Gaza war, was noticeably different in the UAE and Israel and in stark contrast to the original 2023 announcement. 

The UAE state news agency did not mention Israel in its May 2024 press release or its otherwise extensive coverage of the November 2024 demonstration. In contrast, the Israeli Tazpit News Agency led with Israel-UAE cooperation for the May 2024 incorporation, and the Israeli government gushingly praised the UAE in its account of Crystal Ball’s ‘maiden voyage’ in November.

A diplomatic retreat

This inconsistency around Crystal Ball is well explained by the wider diplomatic awkwardness between the two countries since the Gaza war began. Israel is keen to present an image of normality, with international conferences and new technology initiatives unaffected by the horrendous events in Gaza. The UAE takes a different approach: promoting its own contributions to countering ransomware while omitting Israel’s contributions.

This evolution in cooperation styles illustrates the concept of digital recognition that Hassib and I put forward in our article. We describe three main ways in which digital technologies, including cybersecurity, contribute to diplomatic relations: through lubrication, where they facilitate new contacts between politicians and tech leaders; through homogenisation, where they force states to confront similar technological challenges in the same way; and through integration, where technological infrastructure itself operates as a key link between states.

The development of Crystal Ball involves all three of these mechanisms. First, it initially lubricated diplomatic relations by giving Emirati and Israeli leaders a clear point of cooperation to demonstrate their increasing closeness. 

Ransomware then offered a relatively homogenised policy menu for states to combat this new digital threat, with better information sharing at the centre of all recommendations – including those proposed by the CRI. This homogenisation meant that Crystal Ball could easily be extended – at least in demonstration form – beyond the UAE and Israel to the other CRI members. 

Third, as the Gaza war has made the relationship publicly unpalatable, the UAE and Israel continue to be linked by the Crystal Ball platform and its underlying infrastructure, even though their public narratives around it have diverged. 

Although states may seek a diplomatic retreat from their prior technological commitments, the concept of digital recognition suggests that this is not always an easy or simple step.

Digital technologies not only tie adversaries and allies together in what some scholars have called ‘weaponised interdependence’; they can actively contribute to the development of new diplomatic relationships, harder to unmake than they are to establish.

Funding for the research presented in this article was provided to Virtual Routes by UK Research and Innovation (UKRI), as a member of the consortium for the Horizon Europe project Reigniting Multilateralism Through Technology (REMIT). REMIT research is conducted under the umbrella of the European Union’s Horizon Europe research and innovation program, grant agreement No 101094228. UKRI’s support to the project does not necessarily represent an endorsement of its findings. The views expressed in this article are those of the author.

Photo: Mark Neyman/Government Press Office of Israel. Israeli President Isaac Herzog and UAE Ambassador to Israel Mohamed Al Khaja at the opening of the UAE Embassy in Tel Aviv in 2021.