Tuesday, August 4, 2020

Yemen's Multilayered War: The Houthi Rebellion

This article is by

Share this article

Article Contributor(s)

Anant Jani

Article Title

Yemen's Multilayered War: The Houthi Rebellion

Publisher

Global Views 360

Publication Date

August 4, 2020

URL

Houthi rebels protesting the airstrike in Sana

Houthi rebels protesting the airstrike in Sana | Source: Henry Ridgwell (VOA) via Wikimedia

This is the 3rd part of a short explainer article series on the current crisis in Yemen.

To read the 1st part of the series click on the link.

To read the 2nd part of the series click on the link.

After the overthrow of the monarchy in 1968,  Yemen existed as two countries — North Yemen and South Yemen.  These two countries united in 1990, after several years of conflict with one another.

This unity could not remain for long and the North-South divide resurfaced which led to the first civil war of unified Yemen. This civil war was short-lived and ended in 1994 after the decisive victory of the pro-unification governing faction over the Southern saperatist faction.

On the other hand a major dissatisfaction with the central government was simmering in the region dominated by a local branch of Shia Muslims known as Zaidi. They are the decendent of Prophet Muhamma and believe that Muslims should be ruled only by a descendant of Prophet Muhammad whom they call an Imam. They have ruled Yemen for more than 1,000 years which ended in 1962.

Zaidis are a minority sect in Yemen but have much ideological affinity with the Sunni Shafi'i majority. They lived together harmoniously and prayed in the same mosques for hundreds of years.

A new element was also getting added to the dangerous mix of sub-nationalism, intra religious division, and tribal loyalty in Yemen. The Yemeni veterans of Soviet-Afghan war who fought with the mujahideen were battle hardened and well versed in guerilla warfare. They started a low level insurgency and also tried to impose a hardline interpretation of Islamic religious and social practices in Yemen.

In order to counter the socio-economic and political marginalization by the central government as well as the growing influence of Salafism in their northern heartland, the Houthis formed a movement named Ansar Allah. President Saleh however accused them of attempting to overthrow the government and of seeking to revive the rule of the imamate in Yemen.

The Houthi Rebellion (also known as the Shia Insurgency):

The Houthi Movement in its current militant form began in 2004 by Hussein Badreddin al-Houthi, religious, political and military leader, as well as former member of the Yemeni parliament between 1993 and 1997. Though he was killed in the action of very early in his fight with the government forces, his brother who took over the movement leadership made it politically and militarily a formidable force in Yemen.

Zaidis have had historical grievances against the Wahhabi, the dominant Sunni sect in Saudi Arabia, who assisted North Yemen in the First Yemen Civil War. The Zaidi fear they still have too much say in Yemeni politics. They have also fought against the Salafis, whom they accuse of implementing the hardline interpretation of Islamic religious and social practices in Yemen. In order to counter these forces, Houthis destroyed the schools run by them in Saada, Dar al Hadith in Dammaj and its sister school in Kitaf, claiming them to be “feeder schools”, for al-Qaeda.

It was the 2011 Yemeni Uprising (or Intifada), which catapulted Hauthis to the centre of Yemen politics. They sided with the common citizens of the country in demanding the resignation of President Saleh whom they charged with corruption and for being a lackey of Saudi Arabia and the USA. A Nesweek photo-essay reported that Houthis are fighting "for things that all Yemenis crave: government accountability, the end to corruption, regular utilities, fair fuel prices, job opportunities for ordinary Yemenis and the end of Western influence."

Later in 2011, President Saleh resigned, as per the Houthi terms, letting Abd Rabbuh Mansur al-Hadi step in as the President in exchange for immunity from prosecution. However the Houthis pressed on with their power grab which started resentment among other players.

In an ironic act, ex-President Saleh who was overthrown in an Houthi led public uprising, threw his weight behind Houthis in the power struggle. In 2015 he publicly announced his formal alliance with the Houthis, and hoped for ceasefires with the Arab Coalition.

In 2015, Hadi, the President of Yemen was placed under house arrest by the Houthis and forced to resign. He managed to flee to Aden, and rescinded his resignation. He fled to Saudi Arabia, and returned in September with the Arab Coalition at his support. Ever since, he has used Aden as his governing base.

At the same time, Saudi Arabia imposed severe restrictions on import, including air and sea blockades in Yemen, resulting in the shortages of food and medicine. Given the fact that Yemen is dependent on imports for food supply and medicine, it is no surprise that the blockades have led to a famine situation, compounded by an outbreak of cholera since 2016 caused by and worsened due to the air-strike bombed healthcare infrastructure.

After aligning with Houthis for many years, Saleh once again took an about turn in 2017 by publicly ending this alliance and stated his openness to talk with the Saudi-led coalition. Al Jazeera reported this was because the Saudi Prince had decided that Saleh, rather than Hadi, would help to win the war. However, the same year, Saleh was assassinated.

In September 2019, the Houthis claimed responsibility for drone attacks on Saudi Arabia's eastern oil fields of Abqaiq and Khurais, disrupting nearly half the kingdom's oil production.

In January 2020, the Houthi Special Criminal Court found Hadi guilty and sentenced him to death, for “high treason...and looting the country’s treasury”, over other things,

It is important to note that Saudi Arabia and the USA have also seen this war as a Sunni Saudi pitted against a Shi’ite Iran. This has been shown to be inaccurate - both nations likely intending it as an excuse for using extreme military might and sanctions that Saudi has engaged in with the backing of both, the Obama and Trump administration, to use Yemen for strategic purposes.

It is this war, between Saudi-backed Hadi at Aden and the Iran-led Houthis at Sana’a, that has prolonged for 5 years and displaced millions, prompting the UN to call it the worst man-made humanitarian disaster.


To read the 4th part of the series click on the link.

Subscribe to the Global Views 360 mailing list for the weekly updates.

Support us to bring the world closer

To keep our content accessible we don't charge anything from our readers and rely on donations to continue working. Your support is critical in keeping Global Views 360 independent and helps us to present a well-rounded world view on different international issues for you. Every contribution, however big or small, is valuable for us to keep on delivering in future as well.

Support Us

Share this article

Read More

February 4, 2021 5:20 PM

SolarWinds Attack and its implication for U.S. Security: Sabotage or espionage?

SolarWinds, a publicly listed Texas-based company with a value of more than $6 billion, has a very reputed customer list including multiple U.S. government agencies. The company develops softwares for businesses and agencies to help manage and monitor their networks, systems and  IT infrastructure. The company is a service provider to over 425 of the Fortune 500 companies, top 5 U.S. accounting firms, all major U.S. telecom providers, the U.S. treasury, several global universities and educational institutions, the NSA and the White House.

A set of hackers managed to sneak a malicious code into the software update of SolarWinds for a tool called “Orion”. Earlier, in 2020, the hackers had injected malware into the updates of Orion which were released between March and June of 2020. On 5th of Jan, 2021, the Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure security Agency (CISA), the Office of the director of National Intelligence (ODNI) and the National Security Agency (NSA) made an official joint statement stating, "an Advanced Persistent Threat (APT) actor, likely Russian in origin, is responsible for most or all of the recently discovered, ongoing cyber compromises of both government and non-governmental networks". U.S. government agencies like The Pentagon, National institute of Health, FBI, DHS, the Department of Energy and the Department of Veterans affairs were some significant users of Orion. In fact, in August 2020, the Department of Veterans affairs renewed its Orion license in a 2.8-million-dollar order. The Department of Veterans affairs has been heavily involved in COVID-19 relief.

The Orion hack began as early as March 2020. Over 18,000 customers had installed the compromised software which implies that these customers were vulnerable to spy operations throughout 2020. The malware inserted in the updates provided remote access of an organization’s network to the elite hackers. Since the malware was undetected for months, it gave the hackers an opportunity to obtain information from their targets. In fact, the hackers could also monitor emails and other internal communications. FireEye, the cybersecurity company who were the first to discover the breach describes the capability of the malware, from initially lying dormant up to two weeks, to hiding in plain sight by masquerading its investigation as “Orion Activity”. In 2016, Russian Military hackers used a method called “supply chain” to infect companies performing business in Ukraine with a hard-drive wiping virus called NotPetya. This attack is considered to be one of the most damaging cyber-attacks till date. The infiltration tactic used in the current hack is also identified to be similar to the “supply chain” method.

The Orion software framework contained a backdoor that communicated via HTTP to third party servers. Cybersecurity firm, FireEye has been tracking the trojanized version of Orion plug-in as SUNBURST.

FireEye Logo

FireEye described the use of SUNBURST backdoor on one of its blogs published on 13th December 2020. It stated,

“After an initial dormant period of up to two weeks, it retrieves and executes commands, called “Jobs”, that include the ability to transfer files, execute files, profile the system, reboot the machine, and disable system services. The malware masquerades its network traffic as the Orion Improvement Program (OIP) protocol and stores reconnaissance results within legitimate plugin configuration files allowing it to blend in with legitimate SolarWinds activity. The backdoor uses multiple obfuscated blocklists to identify forensic and anti-virus tools running as processes, services, and drivers.”

FireEye described the attack through the SUNBURST backdoor as “highly evasive”. Meanwhile, SolarWinds is facing a class action lawsuit filed by a stakeholder of the IT Infrastructure Management software company in the U.S. District Court for the Western District of Texas on 4th Jan 2021. The lawsuit is filed against SolarWinds’ ex-president, Kevin Thompson and chief financial officer, J. Barton Kalsu on the grounds of violating Federal Securities laws under Securities Exchange Act of 1934. The complaint states that SolarWinds Company failed to disclose that "since mid-2020, Orion monitoring products had a vulnerability that allowed hackers to compromise the server upon which the products ran". The complaint also mentioned that SolarWinds update server had a fairly weak and easily accessible password, ‘solarwinds123’.

Microsoft’s internal security research team found evidence that the same hackers had accessed some internal source code in their company’s systems. Microsoft mentioned that the attempted activities were beyond just the presence of malware SolarWinds code in their environment. Microsoft has “an open source like culture” which allows teams within Microsoft to view the source code. The company acknowledges that it is a threat model but they are downplaying the risk by saying “just viewing the source code should not cause any elevated risk”.

The Russian Hackers have also managed to breach the network of Austin City, Texas. The breach dates back to at-least mid of October 2020. The hackers have seemed to target the U.S. Treasury, Departments of Commerce and Homeland Security, The Pentagon, Cybersecurity firm FireEye, and SolarWinds. The breach of the network of the Austin city is an apparent win for Russian hackers. Theoretically, the compromise could have helped them access sensitive information in accordance with the city governance, elections, city police and by excavating deeper, the hackers can practically burrow inside energy, water and airport networks of the city.

Berserk Bear, the hacking outfit that is currently believed to be behind Austin’s breach appears to have used Austin’s network as grounds to stage larger attacks. Berserk Bear also known as BROMINE inter alia several names is believed to have been responsible for a series of breaches of significant U.S. infrastructures in the past year.

The attacks on SolarWinds, U.S. government and FireEye have been linked to another Russian group called APT29 also popularly known as Cozy Bear. Berserk Bear is allegedly a unit of Russian federal Security Service (FSB). Cozy Bear is known to be affiliated with the Russian Foreign Intelligence Service, or SVR. FSB and SVR are considered to be successors of the Committee of State Security of the Soviet-era which was widely known as the KGB.

The Austin Council seems to have been aware of the breach from October 2020. The FBI and CISA had published an initial advisory warning of “advanced persistent threat actors” (APTs) on October 9th, 2020. The advisory warned the city council of APTs targeting state and local governments. On October 22nd, a follow-up advisory was published in which both agencies accredited the breach to Berserk Bear. CISA published a heat map listing the types of organizations that were breached, scanned or targeted by Berserk Bear. The reputation of Berserk Bear of lurking fit their common pattern of espionage-oriented attacks. Sami Ruohonen, a researcher at Finnish cybersecurity firm F-Secure said that the adversaries have already been in the network for more than a couple of months before someone discovers their existence. Ruohonen also mentioned that this technique is specially preferred by APT groups because, the longer they go unnoticed, the longer they have a remote access to the network. F-Secure, in a report published in 2019, compared Berserk Bear and similar groups to the cyber equivalent of sleeper cells.

The cybersecurity experts have warned Austin city and the U.S that Berserk Bear hackers are not just involved in espionage and sabotage. They can gear up at any moment and create havoc in the United States. These Russian Hackers can cause city blackouts, disturbance in water supply and can even disrupt COVID-19 relief. Vikram Thakur, a technical director at Symantec who has tracked Berserk Bear for years quotes,  “We should be cognizant of the level of information that they have, turning on valves or closing valves, things of that sort — they have the expertise to do it.”

Kevin Thomson, the ex-CEO of SolarWinds | Source: SolarWinds Facebook

SolarWinds replaced their ex-CEO Kevin Thomson with Mr Sudhakar Ramakrishnan. Unlike his predecessor Thomson, who is an accountant by training, Ramakrishnan comes from a security background having led Pulse Secure in the recent past. The new CEO publicly stated that the company will be making 5 critical changes to put security front and center. The company also hired ex-CISA chief Chris Krebs and Facebook’s former security lead, Alex Stamos. Krebs and Stamos work as independent consultants to help the company coordinate its crisis response. Krebs told the Financial Times that it could even take years to uncover the full extent of the hack. On the brighter side, the new CEO mentioned that the company has engaged several cybersecurity experts to assist SolarWinds in its efforts to become more secure.  We can hope that, with better expertise, vision and understanding of threat and vulnerability management, the company is now headed towards a better future.

Read More