The United States has emerged as the world’s most targeted country for cyberattacks, according to Microsoft Annual Cyber Defense Report. The report highlights the growing scale and sophistication of global cyber threats, with the United States accounting for the largest share of cyber activity observed during the reporting period.
According to the report, the United States accounted for approximately 25.5% of global cyber activity, making it the most targeted country worldwide. Israel ranked second with 7.6%, followed by Ukraine at 4.8% and Taiwan at 3.9%. The figures underline how geopolitical tensions, military conflicts and strategic interests are increasingly influencing the global cyber threat landscape.
Israel’s position is particularly significant, as the country not only ranked second globally among the most targeted nations but also emerged as the most targeted country in the Middle East and Africa region. The concentration of cyber activity against Israel reflects the wider impact of ongoing regional conflicts and heightened tensions involving state and non-state actors.
Microsoft also highlighted the growing role of artificial intelligence (AI) in cyber operations. While AI is increasingly being used to strengthen cybersecurity defenses, threat actors are also exploiting the technology to make attacks faster, more sophisticated and more difficult to detect. According to the report, AI is being incorporated into large-scale phishing campaigns and other malicious activities, including attacks involving increasingly autonomous AI agents.
Among the major state-linked cyber threats, Iran remains a significant actor. Microsoft’s findings indicate that between July 2025 and June 2026, Iranian cyber activity was primarily focused on Israel, followed by the United States. The targeting patterns were linked to heightened geopolitical tensions and military escalations involving countries in and around the Strait of Hormuz, an important strategic waterway for global energy supplies.
The objectives behind these cyber campaigns extended beyond conventional financial cybercrime. Microsoft identified espionage, intelligence gathering, support for kinetic military operations, foreign influence and data destruction among the major motivations behind sophisticated attacks.
Ransomware and other forms of destructive malware also continued to pose a serious threat. In addition to targeting government and corporate data, attackers increasingly focused on critical infrastructure and operational technology. The energy, telecommunications and manufacturing sectors were among the areas facing significant attention from cyber campaigners.
The findings demonstrate that cyberattacks are increasingly becoming an extension of geopolitical conflicts. As governments, businesses and critical infrastructure become more digitally connected, cyber operations can potentially disrupt essential services without requiring traditional physical attacks.
Microsoft’s report therefore underscores the need for stronger cybersecurity preparedness, improved threat intelligence and greater cooperation between governments and private-sector organizations. At the same time, the rapid development of AI means that cybersecurity strategies will need to evolve continuously to address increasingly automated and sophisticated threats.
Join our LinkedIn group Information Security Community!
