CYBERTHREATS

n the twelfth anniversary of

Project Galileo, Cloudflare has released its annual report, Defending the Front Line: Insights from a Year of Protecting Civil Society, highlighting the growing cybersecurity threats facing vulnerable organisations around the world.

Ercan Aydin The findings reveal a rapidly expanding attack surface driven by geopolitical

tensions, elections, civic unrest and increasingly sophisticated cybercrime targeting organisations that often operate with limited resources.

The report found that civil society organisations in every region and sector experienced cyberattacks during the reporting period, underscoring the growing digital risks facing groups that play a critical role in supporting democracy, accountability and public welfare.

Key findings

• Distributed-Denial-of-Service( DDoS) attacks were the most common cyberthreat against civil society organisations protected under Project Galileo, accounting for 81.7 % of all malicious traffic. Their defining feature was duration. While most DDoS attacks Cloudflare mitigated for its customers were over within minutes, nearly every one of the largest attacks against civil society lasted longer, with some spanning into days and weeks. The Iraq-based digital rights organisation Tech4Peace experienced an eight-daylong DDoS attack that featured 2.6 billion malicious traffic requests.

• On average, Cloudflare blocked a malicious request probing a media organisation every seven seconds. In general, civil society organisations faced attempts to exploit security vulnerabilities in websites at a rate more than seven times higher than other Cloudflare customers. Media organisations, including journalists, were the most frequently targeted, receiving 40.5 % of attacks, despite making up only 22.7 % of the underlying population.

• Journalists operating in exile faced a rate of malicious traffic that was nearly four times higher than journalism organisations overall. Attacks were concentrated against a few targets. In December 2025, elTOQUE, a Cuban media outlet operating in exile, faced a DDoS attack that the organisation believes was an intentional effort to limit access to a tracker comparing the Cuban peso with foreign currencies.

• Nearly 10 % of all emails Cloudflare processed for civil society included potential phishing material. Compared to other Cloudflare customers, civil society faced a higher concentration of malicious emails intended to gain unauthorised access. Traditional authentication protocols alone left civil society organisations exposed. Nearly one in three emails that contained malicious content bypassed standard authentication methods but were identified by more sophisticated phishing detection tools provided by Cloudflare.

• Cloudflare identified 183 Internet disruptions across its global network, 85 of which public reporting has attributed to government action. The restrictions coincided with periods of elections, protests and student exams. In countries like Iran and Uganda, civil society organisations reported that shutdowns disrupted their ability to reach affected communities, document abuses and share independent information.

“ The Middle East and Africa region continues to experience rapid Digital Transformation, but that progress also brings increased exposure to cyberthreats,” said Ercan Aydin, AVP, Middle East, Türkiye and Africa at Cloudflare.“ Organisations supporting independent journalism, digital rights, humanitarian initiatives and public-interest causes are increasingly operating in complex threat environments. The findings from this year’ s Project Galileo report reinforce the importance of ensuring these organisations have access to enterprisegrade cybersecurity protections, enabling them to continue serving communities, safeguarding information and supporting social and economic development across the region.”

WWW. INTELLIGENTCISO. COM 29