(Beirut) – Civilians in Gulf Cooperation Council (GCC) countries are at grave risk from ongoing Iranian strikes in response to US and Israeli military attacks on Iran, Human Rights Watch said today. Many of the Iranian attacks have struck civilian residential buildings, hotels, civilian airports, and embassies, and have unlawfully targeted civilian objects such as financial centers.
Since February 28, 2026, Israel and the United States have carried out thousands of attacks across Iran. Iranian forces responded with waves of drone and missile attacks against Gulf states, striking in Bahrain, Kuwait, Oman, Saudi Arabia, and the United Arab Emirates (UAE). Since February 28, Iran has launched thousands of drones and missiles against GCC countries, with the largest number striking the UAE.
As of March 16, the attacks resulted in at least 11 civilian deaths and at least 268 injuries, with the majority of victims migrant workers, according to GCC government sources. Of those killed, at least 10 are foreign nationals. Some deaths were caused by falling debris.
“Civilians, particularly migrant workers, across Gulf states are being threatened, killed, and injured by Iranian drones and missiles,” said Joey Shea, senior Saudi Arabia and UAE researcher at Human Rights Watch. “Rather than pretending to apologize, Iran’s authorities should immediately take all possible measures to protect civilians across the Gulf.”
Human Rights Watch investigated an Iranian attack on Fairmont The Palm Hotel and Dubai International Financial Centre (DIFC) in the UAE and reviewed information related to attacks on Zayed International Airport, Dubai International Airport, Kuwait International Airport, residential buildings and Crowne Plaza Hotel in Bahrain, the US consulate in Dubai, and the US Embassy in Riyadh. Researchers also reviewed information related to attacks on other civilian areas in the UAE. Researchers were unable to confirm whether there were military targets present in any of the attacks.
The Iranian government has alleged that it is targeting sites where US personnel have relocated from nearby bases. However, Ebrahim Jabbari, a general with Iran’s Islamic Revolutionary Guard Corps (IRGC), suggested that Iran will target civilian objects, saying that Iran “will hit all economic centers in the region,” AFPreported.
On March 8, Iranian President Masoud Pezeshkian apologized for Iran’s attacks on Gulf states, saying “there will be no further attacks or missile launches toward neighboring countries.” But attacks continued. A spokesman from Iran’s Khatam al-Anbiya Central Headquarters said on March 8 that “every point that serves as the origin of aggression against Iran is a legitimate target.” On March 14, a media outlet affiliated with the IRGC stated that American “companies will be the legitimate targets for Iran’s Armed Forces,” listing a number of US management consulting and investment firms.
Human Rights Watch verified videos posted to social media taken during and in the immediate aftermath of the attacks. Some were initially geolocated by GeoConfirmed, a volunteer-driven visual verification platform. These videos show attacks on and damage to residential buildings, hotels, airports, embassies, ports, and energy facilities in Bahrain, Kuwait, Qatar, Saudi Arabia, and the UAE. Human Rights Watch spoke with 16 people including witnesses, journalists, tourists, and residents of the cities attacked, and family members of three migrant workers killed in Bahrain and the UAE.
Human Rights Watch wrote to authorities in Iran, as well as Bahrain, Kuwait, Oman, Saudi Arabia, and the UAE, on March 10, 2026. Bahrain, Kuwait, Saudi Arabia, and the UAE had not responded at the time of publication. Authorities in Oman acknowledged receipt but requested additional time. Iranian authorities responded, writing that, “While the Islamic Republic of Iran firmly rejects the unfounded claims of certain regional countries that Iran has attacked them… Iran once again emphasizes that its defensive operations—targeting United States military bases and facilities in the region—are in no way directed against the sovereignty or territorial integrity of any regional country.”
Iranian attacks have hit densely populated civilian areas such as popular tourist sites, particularly in the UAE. On February 28, an Iranian Shahed-238 one-way attack drone struck the forecourt area in front of Fairmont The Palm hotel in the luxury Palm Jumeirah area of Dubai. Local authorities said four people were injured. The Shahed-238 drones reportedly have multiple variants, all of which are guided, either by global navigation satellite systems (GNSS), radar homing, or electro-optical sensors, and are known to be equipped with features to allow them to overcome jamming to improve accuracy. While the exact accuracy of the Shahed-238 is not known, nor is the extent or efficacy of any countermeasures deployed by the UAE, its targeting systems allow it to be reliably directed at large objects and infrastructure.
People interviewed said that US military personnel are not known to stay at the Fairmont The Palm. Human Rights Watch could not confirm that there were no military personnel staying at the hotel at the time of the attack on February 28, but was able to confirm the civilian nature of the 391-room luxury hotel.
A guest said he was sitting down for dinner in a hotel restaurant when he “heard what sounded like a jet engine approaching… It was very quick and very loud. The explosion was utterly terrifying.”
Another witness saw the drone “go straight past us and hit the Fairmont.” The woman was leaving a nearby beach with friends when she heard a whistling sound from the drone before it hit the building. “You obviously think you’re a goner,” she said. After running to the beach, they “looked back and saw the Fairmont was up in smoke.”
Two videos geolocated by Human Rights Watch capture the moment of the strike. In the first, a person on a roof of a nearby building films in the direction of the hotel. The drone can be seen for a few frames descending rapidly at a near perpendicular angle before detonating. A second video, filmed northwest of the hotel, follows the drone as it makes impact and a large ball of flames engulfs the courtyard.
A third video filmed from inside the hotel in the immediate aftermath shows at least four vehicles on fire. Two other videos filmed from inside the hotel after the strike show damage to the northern side of the parking lot and burned vehicles, consistent with the detonation of high explosives.
Iranian drone attacks have also targetedfinancial districts in the UAE, particularly Dubai International Financial Centre (DIFC) and surrounding areas, in at least three separate incidents since March 12. On March 14, the IRGC said, “we warn the American regime to evacuate all American industries in the region.” A media outlet affiliated with the IRGC stated that “these companies will be the legitimate targets for Iran’s Armed Forces” and shared a graphic identifying US companies in the region. The graphic lists a number of US firms and their regional addresses, including KKR, a US private equity and investment company, Boston Consulting Group, a US management and consulting firm, and Bain & Company, a US management consulting firm. The graphic lists the firms’ Dubai office addresses, all of which are located within the DIFC district. DIFC is one of Dubai’s special economic zones and is an important financial hub for companies operating in the Middle East. The district is a densely populated civilian area of Dubai.
On March 14, an Iranian drone apparently struck ICD Brookfield Place, a luxury office and retail building in DIFC, containing restaurants, gyms, salons, and grocery stores. Researchers geolocated a video uploaded to Telegram the same night showing smoke emitting from the ICD Brookfield Place building. On March 13, AFP reported that “explosions rattled buildings in Dubai and a large cloud of smoke hung over a central area of the financial hub.”
Iranian forces, using drones, also appeared to strike residential buildings throughout Dubai. In the early hours of March 12, an Iranian drone struck a residential building in the Creek Harbour neighborhood, causing a fire, according to Dubai authorities and local and internationalmedia.One video geolocated by Human Rights Watch and uploaded to X on March 12 shows smoke billowing from an upper floor. A photograph published by the Dubai Media Office shows damage to the same floor.
In a March 3 media briefing, the UAE’s defense ministry said UAE authorities had intercepted hundreds of Iranian Shahed-136 one-way attack drones, as well as dozens of Shahed-107 and Shahed-238 drones. UAE authorities have intercepted the overwhelming majority of attacks, with an interception rate of more than 90 percent, according to government figures.
Iranian forces have also apparently attacked several large residential buildings and hotels in Bahrain, including Era View residential building on February 28, Crowne Plaza Hotel on March 1, and Millennium Tower on March 10, based on researchers’ verification of videos and review of information published online, and interviews with four people.
The attack on Millenium Tower killed a 29-year-old Bahraini woman and injured eight people, according to Bahrain’s Ministry of Interior. A Bahrain-based newspaper, Gulf Digital News, wrote that the woman was killed by falling debris from the attack, which a person with second-hand information who spoke to Human Rights Watch also said.
Human Rights Watch verified two videos uploaded to Telegram showing an Iranian Shahed-136 one-way attack drone striking the Era View residential building as well as videos that show the aftermath of the attacks and damage to the two other buildings. Similar to the Shahed-238, the Shahed-136 drone is a guided weapon system, primarily through the use of GNSS.
The US State Department said that two US Defense Department employees had been injured in the Crowne Plaza Hotel in Manama, Bahrain’s capital, the Washington Post reported. People interviewed said that US government and military personnel often stayed in some of the attacked buildings in Bahrain, including the Crowne Plaza, but that the US military placed limits on how many military personnel could stay in any building at a given time. Researchers could not confirm whether there may have been military targets in the hotel or in two residential buildings hit in Bahrain, but confirmed civilian use of the buildings. All are in densely populated civilian areas of Manama.
Iranian attacks have struck at least three international airports in the GCC. Abu Dhabi airport authorities reported that a drone struck Zayed International Airport on February 28, resulting in the death of Diwas Shrestha, a Nepali security guard, and seven people injured. Iranian authorities have repeatedly struck Dubai International Airport. On February 28, the Dubai airport authority reported that a concourse at Dubai International Airport had been damaged in an apparent Iranian drone attack. Four staff members were injured, Dubai authorities said. Researchers geolocated a video uploaded to X on March 7 capturing the moment a drone struck in the immediate vicinity of the airport, causing a temporary suspension of flights. Another drone attack on Dubai International Airport on March 16 caused Dubai’s Civil Aviation Authority to temporarily suspend flights. Dubai authorities said a drone damaged one of the fuel tanks in the vicinity of Dubai International Airport causing a fire that was later extinguished. Two videos geolocated by researchers show a large plume of smoke rising from the direction of the airport’s fuel storage tanks. An Iranian drone strike struck the Kuwait International Airport on February 28, resulting in injuries to four Bangladeshis.
Human Rights Watch could not confirm whether these three airports, which are used for civilian purposes, were also being used for any military purposes or if there were military targets in the airport at the time of the attack.
The Kuwait airport has previously been used by the US military, but Human Rights Watch is not aware of any publicly available evidence indicating that Dubai International Airport and Zayed International Airport have been used for any recent transport of arms or troops. The cost to civilians of damage and disruption to these airports is high: Dubai International Airport is the world’s busiest airport, according to OAG, a leading provider of airport data, and has been a key site of repatriation flights for civilians fleeing the conflict.
Iranian attacks have also repeatedly targeted what appear to be US diplomatic premises throughout the Gulf. On March 3, an Iranian drone attack struck the US consulate in Dubai, causing a fire. One video uploaded to X, filmed from across the street, captures the sound of a drone moments before a loud explosion. The camera then pans toward the consulate, where smoke and fire are visible.
Also on March 3, two Iranian drones struck the US embassy in Riyadh, causing a fire and minor damage, said Saudi Arabia’s Defense Ministry. A video shared with Human Rights Watch of the aftermath of the attack shows a fire billowing from the direction of the embassy complex. On March 2, drones struck the US embassy in Kuwait, Agence France-Presse reported. On March 5, the US State Department announced the suspension of operations at the US Embassy Kuwait City.
Migrant workers have been significantly affected by the attacks and the falling debris from air defense systems. On February 28, an Iranian attack killed a Bangladeshi national, Saleh Ahmed, in Ajman in the UAE. Ahmed was collecting water for delivery in the Al Talla neighborhood when apparent debris from an attack struck his water tank truck, piercing the cab and damaging the rear, hitting Ahmed and two others, a Bangladeshi and a Pakistani person, said Ahmed’s son, Mohammad Abdul Haq. Ahmed died and the others were injured.
Iranian forces have also attacked or struck states beyond the GCC, including Azerbaijan, Iraq, Israel, Jordan, Syria, and Turkey since the conflict began.
International humanitarian law requires all parties to the conflict to distinguish between military objectives and civilians and civilian objects and to target only military objectives. Military objectives are limited to “objects which by their nature, location, purpose or use make an effective contribution to military action and whose partial or total destruction, capture or neutralization, in the circumstances ruling at the time, offers a definite military advantage.”
International humanitarian law also requires parties to a conflict to “take all feasible precautions” to avoid or minimize the incidental loss of civilian life. All attacks must respect the principle of proportionality in attack, including considering the likely impact on civilians and civilian objects. Attacks are prohibited if their primary purpose is to spread terror among the civilian population. Serious violations of the laws of war committed with criminal intent, that is deliberately or recklessly, are war crimes.
In contrast to what Iranian authorities have stated, companies having US ownership or ties would not in and of itself make them legitimate military objects.
“Iran’s response appears to be striking civilians and civilian objects and devastating lives and livelihoods across the Gulf,” Shea said.
