Loading threat actor…
Al-Qaeda in the Arabian Peninsula (AQAP) is the Yemen-based branch of al-Qaeda and one of the organization’s most prominent regional affiliates. It is commonly referred to as AQAP and has been associated with propaganda operations such as Inspire, produced through al-Malahem Media Foundation. AQAP has played both an operational and ideological role within the broader global jihadist movement, including public alignment with al-Qaeda in disputes with the Islamic State. AQAP has conducted insurgent and terrorist activity in Saudi Arabia, including a low-scale insurgency during 2003–2006 that killed roughly 300 people. Reporting also places AQAP figures among al-Qaeda ideologues who publicly denounced Islamic State encroachment into the Caucasus and supported the al-Qaeda-aligned Islamic Emirate of the Caucasus, reflecting AQAP’s role in transnational movement politics beyond the Arabian Peninsula. AQAP is also notable for its media and radicalization apparatus. Inspire magazine, associated with Anwar al-Awlaki and Samir Khan, promoted individual jihad and included operational guidance intended to encourage self-directed attacks. Its messaging used grievance narratives, martyrdom themes, and gendered propaganda to mobilize supporters, especially men, toward violence while portraying women as supporters, symbols of communal victimization, and instruments for shaming inaction. High-confidence information in the available material supports AQAP as a jihadist terrorist organization rooted in Yemen, active in Saudi Arabia, and integrated into al-Qaeda’s global network. The supplied facts do not directly support a ransomware or cyber-operations profile for this actor.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
Attributed origin per open-source reporting.
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Uses Inspire magazine to encourage and justify individual jihad globally, especially by motivating supporters to conduct attacks and align with its ideological gender order.
Previously conducted a low-scale insurgency in Saudi Arabia, prioritizing attacks on Westerners, Western interests, and Saudi security forces; later reconstituted in Yemen after Saudi counterterrorism pressure.
An al-Qaeda affiliate that publicly opposed ISIS’s expansion into the Caucasus and later called for financial aid and assistance to support the IEC against ISIS.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.