apt

OilAlpha

activeAttribution: ModeratePlausible and partly corroborated — some gaps or single-source elements.

APT / State-sponsored

OilAlpha

Attribution

Suspected pro-Houthi threat cluster; infrastructure traced to Yemen's Houthi-controlled Public Telecommunication Corporation (PTC)

Origin

Yemen

First seen

2023

Last active

2024

Motivation

Espionage

Attribution confidence

medium

MENA targeting

Yemen, broader Arabian Peninsula

Sectors

Humanitarian/NGO sector, aid organizations, media

Why it mattersState-sponsored / APT actor, medium confidence, documented targeting Yemen, broader Arabian Peninsula (Humanitarian/NGO sector, aid organizations, media sectors).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

Associated with

Related to

Domestic KittenactorTechnique overlap
Project Raven (DarkMatter)actorTechnique overlap
Arid Viper (APT-C-23 / Desert Falcon)actorTechnique overlap

Uses

Data from Local SystemtechniqueATT&CK mapping
Protected User Data: SMS MessagestechniqueATT&CK mapping
Protected User Data: Contact ListtechniqueATT&CK mapping
Location TrackingtechniqueATT&CK mapping
PhishingtechniqueATT&CK mapping

Coverage robustness · vs this actor

How evasion-resistant our detection coverage is against OilAlpha's techniques — Summiting the Pyramid scores analytics (1 brittle – 5 robust); the actor inherits through its TTPs. This is a detection-engineering metric, not an attribution signal — see Attribution for confidence.

Techniques with a robust rule

Techniques with any detection

0 / 6

Mean robustness (of covered)

—

Useful?