<div dir="ltr">
<div class="gmail-inner-article-top"><h1 class="gmail-">Cracking Sanaa: The US-Israeli cyber war on Yemen</h1><p class="gmail-">To
fill their gaping intel void on Ansarallah, Tel Aviv and Washington
have launched a covert intelligence war on Yemen. But a society steeped
in resistance, coupled with Sanaa\u2019s doctrine of silence, is proving far
harder to breach than expected.</p><div class="gmail-another-name"><p><a href="https://thecradle.co/authors/mawadda-iskandar" style="color:rgb(164,4,4)">Mawadda Iskandar</a></p></div><div class="gmail-another-name" style="margin-top:16px"><p><span style="color:rgb(84,88,94)">JUL 30, 2025 - </span><font size="1"><a href="https://thecradle.co/articles/cracking-sanaa-the-us-israeli-cyber-war-on-yemen">https://thecradle.co/articles/cracking-sanaa-the-us-israeli-cyber-war-on-yemen</a></font></p></div></div><div class="gmail-inner-article-img"><img src="https://thecradle-main.oss-eu-central-1.aliyuncs.com/public/articles/c9dda8f8-6d57-11f0-8087-00163e02c055.webp" alt="" width="467" height="221" style="margin-right: 0px;"><span>Photo Credit: The Cradle</span></div><div class="gmail-inner-article-content"><div class="gmail-row"><div class="gmail-col-md-8 gmail-col-sm-7"><div class="gmail-article-content"><span class="gmail-article-body"><p>In October 2023, Yemen\u2019s Ansarallah-aligned armed forces <a href="https://thecradle.co/articles/yemen-says-attacks-on-israel-will-persist-for-as-long-as-siege-on-gaza-continues">joined the battle</a>
in support of the Palestinian resistance's Al-Aqsa Flood operation, and
against Israel's war on Gaza. Today, nearly two years on, a new
battlefield has surfaced \u2013 far from the waters of the Red Sea or the
skies of occupied Palestine. </p><p>This war does not involve drones or
ballistic missiles. It is a silent, persistent, and digital invasion
aimed at prying open the Sanaa government\u2019s internal cohesion through
espionage, psychological manipulation, and soft-penetration tactics.</p><p><strong>Phone calls from the occupation state </strong></p><p>The
covert war began subtly. Mahmoud, a Yemeni journalist working with a
local broadcaster, received a message from an unfamiliar international
number. But what caught his attention was not just the unfamiliar
digits, but the country listed beneath them: \u201cIsrael.\u201d</p><p>\u201cIt was terrifying,\u201d Mahmoud tells <i>The Cradle</i>.
\u201cThe sender greeted me by my full name, praised my media work, then
invited me to join their team. I immediately deleted the conversation
before they could say more.\u201d</p><p>Mahmoud\u2019s case is not unique. Sami, a
resident of Sanaa, received a different message with the same pattern. A
Facebook account claiming to be a Palestinian doctor invited him to
join an \u201cacademic discussion\u201d with a Yemeni expert. It included names of
well-known Yemenis who supposedly recommended him. Sensing something
off, Sami reached out to those named, yet none of them knew anything
about the event.</p><p>According to corroborated testimonies gathered by <i>The Cradle</i>
from journalists and activists across Yemen, these approaches are part
of a rapidly expanding campaign of Israeli and American
cyber-infiltration and recruitment. </p><p>The covert intel efforts
escalated rapidly after 7 October 2023, when Yemen joined the battle in
direct military support of Gaza, prompting Tel Aviv and Washington to
zero in on Sanaa as a priority intelligence target.</p><p><strong>The intelligence vacuum</strong></p><p>Yemen\u2019s drone and missile strikes rattled <a href="https://thecradle.co/articles/yemen-announces-phase-four-of-maritime-blockade-against-israel">Israeli shipping lanes</a>, and also struck deep inside the occupied state, targeting key military and economic infrastructure, penetrating as far as <a href="https://thecradle.co/articles/multiple-yemeni-attacks-cause-chaos-at-ben-gurion-airport">Ben Gurion Airport</a>. That unanticipated resistance front exposed what Israeli security elites later admitted was a significant <a href="https://www.israelhayom.com/2025/05/22/monster-in-plain-sight-how-israel-missed-the-houthi-threat/">intelligence void</a>.</p><p>\u201cIsrael
has many years of familiarity with those enemies [Iran, Hezbollah, and
Hamas]. There is intelligence and there is the important element of a
ground maneuver, and in Yemen we can\u2019t do that. The scale here is
different,\u201d Eyal Pinko, a former Israeli defense official and senior
research fellow at the Begin-Sadat Center for Strategic Studies \u2013 an
Israeli think tank \u2013 was <a href="https://apnews.com/article/israel-houthis-yemen-gaza-war-1435d3ac2f16e2faed608fdb5a100e71">quoted</a> as saying. </p><p>Until
18 November 2023, neither Mossad nor the military intelligence unit
Aman had prioritized penetration and information gathering activities in
Yemen. But after sustained attacks from Sanaa, internal Israeli
discussions shifted. Calls emerged for \u201cintelligence openness\u201d toward
Yemen to narrow the margin of surprise.</p><p>Former Israeli war
minister Avigdor Lieberman publicly called for establishing intelligence
pathways inside Yemen, including support for <a href="https://en.al-akhbar.com/news/bridging-the-intelligence-gap--us-and--israel--seek-new-eyes?">local proxy forces</a>
to undermine Ansarallah. Likewise, former National Security advisor
Yaakov Amidror admitted Tel Aviv\u2019s security apparatus had fundamentally
misunderstood Yemen and Ansarallah\u2019s strategic calculus.</p><p>The shift
came too late. Sanaa had already disrupted Israel\u2019s deterrence doctrine
and forced a broader, frantic expansion of its intelligence footprint.</p><p><strong>Targeting Yemenis online </strong></p><p>Amid
Israel\u2019s intelligence vacuum on Yemen, Tel Aviv began compensating
through complex infiltration and espionage operations. A security source
tells <i>The Cradle</i> that \u201crecruitment efforts start with seeking
out Yemeni Jews fluent in the Sanaa dialect or other local tongues,
aiming to use them as agents to gather intelligence from inside the
country.\u201d</p><p>In addition, the source highlights another growing
method: mass online advertisements. These appear while browsing social
media and often promise financial rewards \u2013 up to a million dollars \u2013 or
information leading to Ansarallah figures or data linked to \u201cnaval
support operations.\u201d </p><p>Some ads originate from suspicious
Mossad-affiliated pages, but others come from official US pages like the
Department of the Treasury or the US Embassy, under the guise of
\u201cprotecting maritime interests\u201d or ensuring global navigation security.</p><p>\u201cThe
goal,\u201d the security source says, \u201cis to collect intelligence on
specific areas or targets related to the active naval front \u2013 anything
connected to Sanaa\u2019s military strength in the Red Sea arena.\u201d</p><p>He reveals that some <a href="https://thecradle.co/articles/yemen-dismantles-extensive-us-israeli-spy-network">arrested spies</a>
have received advanced intelligence training in European countries and
returned to Yemen under the cover of international organizations, media
outlets, or development agencies. This provided them with broad movement
capabilities that are difficult to monitor under normal circumstances.</p><p>Their
primary tasks included monitoring sensitive military sites, gathering
detailed intelligence on naval forces, and collecting technical and
operational data on missiles and drones. They also carried out sabotage
and assassination operations, transmitted coordinates to facilitate
airstrikes, and used encrypted devices, advanced spyware, and satellite
communication systems that were difficult to trace by traditional means.</p><p>These operations form part of a systematic strategy to <a href="https://thecradle.co/articles-id/25525">infiltrate Yemen</a>
through organizations that outwardly appear to focus on development and
cooperation, but in reality function as espionage and sabotage arms
across economic, agricultural, educational, and security sectors. </p><p>The
networks operate under various covers \u2013 diplomatic, humanitarian,
economic, and academic \u2013 serving the intelligence interests of the CIA
and Mossad.</p><p>In recent years, suspicious activity has surged in the
media sector. Operating under attractive slogans, these efforts mask
more dangerous agendas. Journalists describe repeated targeting
patterns: NGOs and cultural institutions, workshops in closed hotel
venues, surveys asking suspicious questions about political
affiliations, post-session invitations for private follow-ups, and
informal offers to fund directed investigations. </p><p>Some even
received travel invitations or proposals to join international media
projects \u2013 only to later discover they served foreign agendas.</p><p>Most
of these initiatives were funded by US-linked entities, often channeled
through intermediary countries, embassies, or regional cultural arms.
One group, operating under the name \u201cLabs,\u201d was exposed by Yemeni
intelligence for conducting direct espionage operations while posing as a
development media outfit.</p><p><strong>Espionage in broad daylight</strong></p><p>The infiltration techniques uncovered by <i>The Cradle</i>
follow a disturbingly consistent script. Yemenis report receiving
unsolicited messages from foreign numbers \u2013 often marked with Israeli or
European country codes \u2013 offering lucrative jobs in media or NGOs. </p><p>These
messages frequently impersonate academics or professionals, cite
well-known local figures to build trust, and probe for granular
information about sensitive locations, community leaders, and military
infrastructure. </p><p>Abdulrahman, a journalist in Sanaa, recalls
receiving messages from accounts mimicking friends or colleagues on
Facebook. \u201cIt started with private messages from accounts bearing
familiar names \u2013 sometimes with profile photos of friends or colleagues.
But when I checked the accounts, they were new, with barely any posts.\u201d</p><p>One
account asked for sensitive information about a colleague; another
tried to lure him into a political debate before dropping a suspicious
link. \u201cWhat\u2019s worse,\u201d he says, \u201cis that some of these accounts used
identical language \u2013 like they were managed by the same source. And the
use of real names and photos made the deception even harder to detect.\u201d</p><p>Sultan al-Samie, member of Ansarallah\u2019s Political Council, confirms that youth are being targeted en masse. He shares with <i>The Cradle</i>
the story of a young man from Sanaa who admitted to working with Mossad
after the agency exploited his family\u2019s poverty by being offered $250
to install a covert camera app and document his neighborhood \u2013 its
streets, alleys, supervisors, and local officials:</p><blockquote><p>\u201cThe
tasks were divided among groups, each containing around 94 people. With
each assignment, the payments increased \u2013 $300, then $600, and
eventually larger sums for more precise images and footage.\u201d</p></blockquote><p>Samie warns that Mossad has already successfully recruited several young men and women over the past few months.</p><p>In one secret case reviewed by <i>The Cradle</i>,
journalists were asked to provide detailed reports on Sanaa\u2019s
politically sensitive Sabeen Square \u2013 a frequent physical target of
Israeli airstrikes. They were tasked with photographing checkpoints,
documenting building uses, and evaluating telecom infrastructure.</p><p><strong>The data war enters the home</strong></p><p>Beyond
spies and covert photography, a more silent and systemic breach is
unfolding. Abdelhafidh Muajeb, a specialist in psychological warfare,
identifies two dangerous entry points: undocumented African laborers and
the proliferation of unregulated delivery platforms.</p><p>He explains
that many of these workers entered Yemen unofficially and are now
employed in sensitive spaces \u2013 hotels frequented by officials or inside
government buildings \u2013 where they can access critical infrastructure
without scrutiny.</p><p>Equally troubling, Muajeb says, is the unchecked
rise of delivery apps across Yemen\u2019s cities. These platforms, often
lacking clear legal status or known ownership, have embedded themselves
into daily life, collecting detailed personal data: household addresses,
family demographics, consumption patterns, and even meal preferences:</p><blockquote><p>\u201cThese
companies operate under the radar, expanding through digital discounts
and promotions with no oversight from the transport or
telecommunications ministries. The danger lies in the questions no one
is answering: Who collects this data, where is it stored, and whose
hands does it end up in?\u201d</p></blockquote><p>Samie echoes this warning.
He says the intelligence war is shifting to new, more insidious tactics.
Unregulated migrant labor and delivery apps now complement digital
deception operations that recruit Yemenis through fake job ads, European
and American numbers, and social engineering schemes \u2013 all of which
serve hostile intelligence agencies.</p><p><strong>Spy networks dismantled </strong></p><p>According
to Sanaa\u2019s security agencies, between 2015 and March 2024, more than
1,782 spy cells were dismantled and 25,665 individuals arrested for
foreign intelligence collaboration. In January 2025, authorities
revealed the arrest of a spy ring working for <a href="https://thecradle.co/articles/sanaa-thwarts-uk-saudi-spy-plot-to-create-target-bank-in-yemen">British MI6 and Saudi intelligence</a>, aimed at sabotaging Yemen\u2019s support for Gaza. </p><p>Days
earlier, a joint CIA-Mossad cell was captured in Saada, targeting drone
facilities and command centers. The most significant operation came in
May 2024 with the dismantling of \u201cUnit 400,\u201d a US-Israeli spy network
operating on Yemen\u2019s western coast. </p><p>Its mission: penetrate
internal defenses and locate missile launch and command sites. Its
destruction dealt a heavy blow to Washington and Tel Aviv\u2019s airstrike
precision. </p><p><strong>A code of silence </strong></p><p>Yemen now
finds itself in a different kind of war \u2013 one waged through whispers,
apps, NGOs, and fake job ads. Washington and Tel Aviv are attempting to
breach the social fabric and media space of a country that has, until
recently, been written off as a peripheral player. </p><p>But
conventional threats are also accelerating. On 23 July, Israel's Channel
14 reported that the occupation military is preparing what it calls a
\u201cmajor offensive\u201d against Yemen, awaiting a green light from the Israeli
political echelon. According to the <a href="https://thecradle.co/articles/israel-planning-major-offensive-against-yemen-report">report</a>, Tel Aviv's security establishment is \u201cworking around the clock on a major offensive plan\u201d against the Sanaa government. </p><p>Yet,
Yemen continues to shape regional balances \u2013 and the resistance it
inspires is not only military. It is cultural, informational, and rooted
in a society that has proven difficult to map, penetrate, or predict. </p><p>In response to these layered threats, Sanaa's Ministry of Information launched a public awareness campaign titled \u201c<a href="https://observers.france24.com/en/middle-east/20250605-yemen-houthis-campaign-digital-repression-midri">Midri</a>\u201d \u2013 Yemeni slang for \u201cI don't know\u201d \u2013 across platforms like Telegram, X, Facebook, and Instagram. </p><p>The
campaign urges citizens not to disclose sensitive information online.
One dedicated account regularly posts videos warning against phone
tapping, phishing, and the risks of satellite services like Starlink,
which officials claim could be exploited by hostile militaries.</p><p>What
began as a common phrase has since become a cybersecurity doctrine and a
pillar of Yemen\u2019s sovereignty campaign. In a country where ambiguity is
armor and evasion a survival instinct, Midri is no longer a passive
response. </p><p>It is a deliberate act of resistance, shielding Yemen\u2019s
social fabric from hostile encroachment and asserting that its internal
front is neither exposed nor for sale.</p></span></div></div></div></div>
<br></div>