- Category
- State · Attributed to a state or working for one.
- Origin
- Yemen(high confidence)
- Motivation
- Information theft and espionage
- Seen
- 2022
- Sources
- 6 sources carry it
- Identifier
- GINC-APT-0319 · oilalpha
YemenWhat it is
OilAlpha has almost exclusively relied on infrastructure associated with the Public Telecommunication Corporation (PTC), a Yemeni government-owned enterprise reported to be under the direct control of the Houthi authorities. OilAlpha used encrypted chat messengers like WhatsApp to launch social engineering attacks against its targets. It has also used URL link shorteners. Per victimology assessment, it appears a majority of the targeted entities were Arabic-language speakers and operated Android devices.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Recorded Future
- TAG-41, TAG-62
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Tools
The tools and malware families the sources tie to it.
- Androrat
- Arabian-Attacker RAT
- DroidJack
- SpyMax
- SpyNote RAT
- njRAT
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de