Loading threat actor…
Al-Shabaab is a Somalia-based militant Islamist organization and al-Qaeda’s strongest affiliate in East Africa. Its principal operational focus is Somalia, where it remains a major threat to the Federal Government of Somalia and the Somali National Army, while it has also conducted cross-border attacks in Kenya. Notable attacks attributed to the group include the 2013 Westgate Mall attack in Nairobi and attacks on civilians in Kenya’s Mandera County in 2014. Al-Shabaab maintains substantial revenue generation through a sophisticated taxation and extortion apparatus, estimated to produce roughly $100 million annually. It is larger and more entrenched in Somalia than Daesh-Somalia, with which it has fought as a rival organization. The group has reportedly developed an innovation capability to pursue drone use against Somali government forces and has been associated with cooperation involving the Houthis, including movement of trainees and weapons materiel between Yemen and Somalia. Its activities are principally terrorist in nature and combine insurgent violence, cross-border operations, coercive revenue collection, and attacks against civilian and government targets.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An Islamist terrorist group responsible for high-casualty attacks in East Africa, including the Westgate Mall attack in Kenya.
Militant group in Somalia discussed as collaborating with the Houthis, exchanging trainees and weapons materiel, and developing drone capabilities against Somali government forces. It is also described as part of the broader VEO threat environment in Africa and as having lost ground recently under partner operations supported by the U.S.
A major East African al-Qaeda affiliate and entrenched threat in Somalia, sustained by a sophisticated taxation and extortion system and engaged in rivalry with Daesh-Somalia.
Jihadist movement in Somalia that is the target of U.S. airstrikes launched from Djibouti.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.