Connect with us

Financial News

Ransomware is Indiscriminatory – Prepare for Everything to Fail

Published

on

Rick Vanover

Ransomware attacks continue to grow in frequency. As well as being more common, ransomware is also getting more potent. As per Veeam’s 2023 Ransomware Trends Report, 21% of companies paid the ransom but could not recover their data. The threat landscape is as volatile as it has ever been. There are more attacks taking place. They are more diverse. And they can have grave consequences for the companies they affect.

On the other hand, rather than tremble with fear at the awesome power of the cyber-attacks waiting to be deployed against them, organizations must focus on what they can control – their defence. Protecting your business against cyber-attacks requires following some fundamental and consistent principles – no matter what is thrown at you.

The ransomware wild west

There is a lawless and brutal feeling about businesses’ current cyber landscape. It is difficult for governments to hold cyber criminals to account, and companies are often keen to minimize public attention towards an incident that has compromised them. This contributes to a situation where almost all the focus is on the victim (the business) rather than the criminal (the attacker).

Furthermore, ransomware – and most contemporary cybercrime – is almost indiscriminatory for those who suffer. The fact is that every business is a target. Yes, hacktivist organisations such as Anonymous use organised cyber-attacks to exercise social justice and call out businesses or governments they view as immoral, unlawful, or dangerous. But even the most philanthropic and virtuous companies can find themselves begging a cybercriminal gang to restore their data and systems while a hefty ransom is demanded.

You often see a comparison made between cyber-attacks and fishing. Hence, the term ‘phishing’ refers to using an email or text as bait to trick a victim into ‘biting’ – in this case, clicking on the link and unwittingly downloading malware onto their device. With ransomware especially, we are now seeing industrial-scale attacks being carried out, which are more analogous to trawler fishing. This isn’t one guy with a rod casting out to get a bite off one or two fish. It’s AI-infused algorithms programmed to target everyone and everything – playing a blind numbers game to catch whatever it can.

This indiscriminate nature is compounded by cyber-attacks being generally difficult to contain. For example, cyber warfare between nation-states threatens every organisation – not just those deemed to be in the firing line. We saw this with the NotPetya attack in 2017 – an attack on a specific utility company – which impacted multiple unrelated organisations through an entirely organic chaos spread. Attack types also continue to evolve. For example, the LokiLocker attack was one of the first reported ransomware strains to include a disk wiper functionality. This means organisations are not only held to ransom by having services suspended and threats of data extortion. Now, they are being threatened with losing vast swathes of data entirely if they do not pay up.

Consistent principles of defence

There is some good news for businesses. No matter how scalable, spreadable, or malicious an attack is, these various evolutions can be viewed as attackers simply using bigger guns and more of them. The fundamental principles of preparing your defences against even the most sophisticated and powerful ransomware stay relatively the same.

First, practice impeccable digital hygiene. All employees must be trained to identify suspicious content and be warned of the impact that malpractice using work devices can have. For all the might at the hands of cybercriminals, in many ways, their biggest weapons are unsuspecting employees who give them the keys to the back door of an enterprise network. Given the scattergun approach now adopted by many cyber-attacks, criminals are not necessarily targeting your organisation specifically. But you’ll become a victim if you prove to be an easy hit.

With that said, all businesses must prepare for their defences to fail – no matter how robust you might think they are. Concepts such as zero trust and deploying techniques such as two-factor authentication can be useful for restricting an attacker’s access to data by taking over one individual’s workstation. Ultimately, the best way to protect data is to ensure that it has been securely backed up and fully recoverable before an incident occurs. Follow the 3-2-1-1-0 backup rule, which states there should always be at least three copies of data on at least two different types of media, at least one off-site and one immutable or offline, with zero unverified backups or errors.

While the headlines and constant discussion around cybersecurity and ransomware can be daunting, it’s important to remember that the fundamental actions required to protect data remain the same. Data Protection and Ransomware Recovery strategies ensure businesses can protect all data from cyber-attacks, server outages, accidental loss, and deletion across physical, virtual, cloud, SaaS, and Kubernetes environments. Investing in a data protection strategy and taking advantage of a solution that enables continuous backup and Disaster Recovery (DR) can give businesses peace of mind that should the worst happen, they never need to pay the ransom.

Continue Reading

Financial

UAE ATTRACTS $40BN IN FDI AMID GLOBAL UNCERTAINTY, NEW REPORT SUPPORTED BY QASHIO REVEALS

Published

on

As geopolitical tensions, de-globalisation, and economic uncertainty reshape global capital flows, the United Arab Emirates (UAE) is consolidating its position as one of the world’s most trusted and resilient financial gateways, according to a new report by Emerging Markets Intelligence & Research (EMIR), supported by Qashio.

The report, ‘Mapping the UAE’s Role as a Global Financial Gateway’, highlights how the UAE is attracting high levels of foreign direct investment and financial activity at a time when capital is retreating from many traditional markets.

Foreign direct investment into the UAE doubled to $40 billion (between 2019 and 2024), reaching record levels even as global FDI stagnated. In 2024, FDI accounted for 40% of the UAE’s gross capital formation, compared to just 4.3% across developed economies, underscoring the country’s growing role as a destination for long-term, trust-led capital.

The scale of activity is accelerating rapidly. The UAE recorded 1,362 FDI projects in 2024, representing a 350% increase since 2020, while assets under management in the Dubai International Financial Centre (DIFC) reached $700 billion, growing 58% year-on-year.

According to the report, the UAE’s ability to benefit from global realignment is closely linked to its neutrality, regulatory clarity, and institutional agility.

“The UAE is actually benefiting from the de-globalisation and the geopolitical reorientation of major power blocks. It doesn’t have adversaries, so is able to build economic ties with everyone. The speed with which the government has been able to adapt to and anticipate the new situation is remarkable,” the report notes.

Beyond capital inflows, the research also points to the UAE’s expanding role as a transaction and payments hub, supported by modern financial infrastructure, strong compliance frameworks, and growing confidence among global businesses managing cross-border activity from the region.

From Qashio’s perspective, the UAE’s rise as a financial gateway reinforces the importance of secure, transparent, and compliant financial operations for businesses operating in an increasingly complex global environment.

“As capital flows become more fragmented and regulated, trust and control are no longer optional — they are foundational,” said Armin Moradi, Founder and CEO of Qashio. “Businesses operating from the UAE need full visibility over spending, strong compliance with Central Bank guidance, and the ability to act on financial insights in real time. This report reflects why the UAE has earned global confidence — and how organisations can operate responsibly within that ecosystem.”

The findings position the UAE not only as a safe destination for capital, but as a jurisdiction capable of supporting long-term growth across finance, trade, technology, and digital assets — at a time when global businesses are reassessing where and how they deploy resources.

To learn more about how the UAE is consolidating its role as a trusted global financial gateway and what this means for businesses navigating today’s fragmented capital landscape download the full report here.

Continue Reading

Financial

GCC TRANSFER PRICING TIGHTENS IN 2026 AS ENFORCEMENT MATURES

Published

on

Executive from Dhruva Consultants standing in a modern office corridor, wearing a dark business suit and red tie, with glass meeting rooms and workspaces in the background.

Dhruva, a tax advisory firm with deep expertise across the Middle East, and global markets, stated that the Gulf Cooperation Council (GCC) is at a clear inflection point in its fiscal evolution. Transfer pricing is moving beyond first-wave rulemaking into an enforcement-led environment where it is increasingly treated as a core element of corporate governance.

Drawing on the UAE Year in Review 2025 report recently launched by Dhruva, the region is moving past inaugural filing seasons and confronting the limits of reactive, post-facto compliance. “The past year has been transformative, representing not merely technical adjustments but a strategic recalibration of the region’s economic architecture,” said Nimish Goel, Leader, Middle East at Dhruva. In this environment, the behavioral reality of a business must align with its legal documentation, as tax authorities raise expectations around demonstrable economic substance.

A central theme in this scrutiny is Key Management Personnel (KMP). Where decision-making occurs, who exercises control, and how governance is evidenced are becoming determinative factors in how profits are attributed and defended. Inconsistencies across HR contracts, organization charts, board minutes, operational reality, and transfer pricing files are increasingly treated as a credibility gap, not a documentation error.

This recalibration is being accelerated by a shift in audit approach. Tax authorities across the GCC are moving from form-based reviews to more sophisticated, data-led scrutiny. Kapil Bhatnagar, Partner at Dhruva, stated that, “A key focus is the ‘invisible backbone’ of many regional groups, common-control and related-party transactions that sit at the heart of multilayered conglomerate structures. Informal arrangements historically treated as low-risk are increasingly being evaluated through an arm’s length lens, including interest-free shareholder loans, uncharged centralized services, legacy intercompany balances, and balance-sheet support. For forward-looking organisations, transfer pricing is no longer a compliance obligation but a strategic enabler.”

In parallel, the UAE has signaled stricter arm’s length expectations for Qualifying Free Zone Persons, with transfer pricing increasingly functioning as the mechanism through which substance is demonstrated under the Corporate Tax regime.

The stakes are further elevated by Pillar Two global minimum tax developments. Effective 2025, most GCC jurisdictions, including the UAE, Qatar, and Bahrain, either implemented or were in the final stages of implementing Domestic Minimum Top-up Taxes (DMTT). Under these rules, intercompany pricing can no longer be treated purely as a compliance variable, since it can materially influence a group’s effective tax rate and potential top-up exposure.

“In response, leading groups are shifting toward operational transfer pricing, embedding pricing policies into ERP workflows to improve year-round accuracy, data integrity, and audit readiness. This is increasingly relevant as audits begin to rely more heavily on data analytics, ERP trails, and transaction-level evidence, with deeper linkage expected between transfer pricing documentation, financial statements, tax returns, and support evidence,” added Kapil.

At the same time, demand is rising for certainty and dispute-prevention mechanisms, including Advance Pricing Agreements (APAs) and Mutual Agreement Procedures (MAPs), particularly for complex cross-border arrangements where predictability is commercially valuable. The UAE has already established a formal framework for clarifications and directives including APAs, confirmed unilateral APA applications from Q4 2025, and introduced a schedule of APA fees effective from January 1, 2026.

As the region moves into its next phase of maturity, Kapil concluded, “The message is clear, the era of fixing and filing is over. The era of governance, digitization, and transparency has begun.”

Continue Reading

Financial

UAE MOVES TOWARDS A MORE COMPLIANCE-FOCUSED TAX LANDSCAPE WITH RECENT VAT REFORMS: DHRUVA

Published

on

Person wearing a dark gray business suit with a white dress shirt and a textured purple tie, standing against a plain gray background

Dhruva, a premier tax advisory firm with deep expertise across the Middle East, India, and Asia, stated that the UAE’s latest amendments to the VAT Law and the Tax Procedures Law, issued by the Federal Tax Authority (FTA) which are effective from 1 January 2026, represent a significant shift toward a more structured, and risk-focused tax environment. These amendments are expected to reinforce responsible compliance behaviors and reduce administrative friction for UAE businesses.

Dhruva noted that one of the most practical and welcoming changes is that it eliminates the requirement for taxpayers to self-issue tax invoices for imports subject to the reverse charge mechanism, which provides a lot of ease to businesses. Post series of amendments and clarifications issued by the FTA in 2025 in relation to self-issuance of tax invoices for imports, while a general exception was granted for such requirement for import of services, the same were required in case of import of goods for record-keeping purposes.  This often-added administrative complexity without impacting the actual tax liability or input tax entitlement. Under the updated rules, taxable businesses have removed the obligation entirely, and hence, businesses will only need to maintain standard supporting documentation, such as invoices, contracts, and transaction records.

However, the firm highlighted that while some administrative burdens are being eased, compliance expectations are tightening elsewhere.  One of the amendments gives the FTA authority to deny input tax recovery in cases linked to tax evasion – where a taxpayer knew or, critically, should have known, that a supply or its broader supply chain was connected to tax evasion.  The law clarifies that taxpayers will be deemed to have been aware if they fail to verify the validity and integrity of the supply in accordance with procedures to be issued by the FTA.

Dhruva explained that historically, the responsibility to account for VAT rested primarily with the supplier, and recipients focused mainly on validating the tax invoice and meeting standard input-tax recovery conditions. In practice, however, the FTA has often linked a recipient’s input-tax eligibility to the supplier’s discharge of output VAT, denying recovery where gaps existed. The latest amendment now formally embeds this position in law, imposing additional due-diligence obligations on the recipient.

Ujjwal Pawra, Partner at Dhruva Consultants, commented, “This is a significant change. It is a clear message that the right to input tax recovery comes with the responsibility to validate the integrity of one’s suppliers and supply chain. Businesses must now demonstrate that they exercised practical, documented, and consistent due diligence. Clean invoices alone are no longer enough; what matters is a clean process.”

While the procedures and conditions are awaited, Dhruva advised that companies reassess onboarding procedures, supplier-vetting protocols, and documentation trails to ensure they align with the FTA’s expected standards. 

Another material operational change is the introduction of a defined timeframe to act on credit balances. Under the amended framework, businesses will generally have up to five years from the end of the relevant tax period to request a refund of a credit balance or use that balance to settle tax liabilities, with targeted flexibility in specified cases where credits arise late in the cycle.

Transitional relief is also available for certain older credits around the changeover, which can help businesses address legacy positions in an orderly way. Dhruva said these changes reduce the risk of credits remaining unresolved on the balance sheet, improve cash flow planning, and encourage clearer internal ownership of refund positions.

Ujjwal further added, “The UAE has introduced a more robust operating framework for credit balances and refunds in line with international best practices. The message is simple: know your credits, map the deadlines, and file claims that are clear, complete, consistent, and easy to validate.”

Dhruva advised UAE businesses to act now with a finance-led approach. This starts with building a central credit-balance register by tax type and tax period, assigning an accountable owner, and tracking action dates so credits are either utilised or claimed in time. Businesses should also treat refund submissions as audit-ready files by preparing reconciliations, supporting documents, and a concise explanation of how the credit arose and why the amount is correct before submitting, rather than rebuilding the file after queries begin. In parallel, companies should prioritise older credit positions to assess whether they fall within the transitional relief window and avoid last-minute filings.

The firm also advised businesses to monitor any binding directions issued by the FTA and align their tax positions, documentation, and system settings accordingly to minimize interpretational differences and strengthen consistency over time.

Continue Reading

Trending

Copyright © 2023 | The Integrator