apt

Project Raven (DarkMatter)

dormantAttribution: ModeratePlausible and partly corroborated — some gaps or single-source elements.

APT / State-sponsored

DarkMatterKarma operation

Attribution

United Arab Emirates — assessed government offensive-cyber program run partly by former U.S. intelligence operators (journalism-sourced, no vendor technical report; no MITRE Group ID)

Origin

United Arab Emirates

First seen

2016

Last active

2019

Motivation

Espionage

Attribution confidence

medium

MENA targeting

UAE (rivals & dissidents), Qatar, Iran

Sectors

Journalists, activists, dissidents, rival-state officials

Why it mattersState-sponsored / APT actor, medium confidence, documented targeting UAE (rivals & dissidents), Qatar, Iran (Journalists, activists, dissidents sectors).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

Associated with

Related to

OilAlphaactorTechnique overlap
Domestic KittenactorTechnique overlap
Arid Viper (APT-C-23 / Desert Falcon)actorTechnique overlap

Uses

Location TrackingtechniqueATT&CK mapping
Protected User Data: Contact ListtechniqueATT&CK mapping
Data from Local SystemtechniqueATT&CK mapping
Protected User Data: SMS MessagestechniqueATT&CK mapping

Coverage robustness · vs this actor

How evasion-resistant our detection coverage is against Project Raven (DarkMatter)'s techniques — Summiting the Pyramid scores analytics (1 brittle – 5 robust); the actor inherits through its TTPs. This is a detection-engineering metric, not an attribution signal — see Attribution for confidence.

Techniques with a robust rule

Techniques with any detection

0 / 4

Mean robustness (of covered)

—

Useful?