StealthMole Traces Uways Qarani’s Claimed Campaign; Ansar Allah Link Remains Unconfirmed
Summary
StealthMole traced Uways Qarani’s six-week activity across forums, a website and Telegram, identifying shared infrastructure and a consistent posting sequence. Its attack claims and asserted Ansar Allah affiliation remain unverified.
Key points
- Uways Qarani claimed infrastructure attacks and data leaks from August to October 2026; the article says these claims are unverified.
- Timestamp comparisons show claims appeared on the group’s website first, then Telegram, then forums.
- Seven claimed leaks linked to files on 146.19.125.57; the report says this is a distribution point, not proof the group owns the server.
- The website, Telegram channel and forum account appeared within about a day of each other, with matching branding and cross-links.
- The Ansar Allah affiliation appears only in Uways Qarani’s own statements; the report found no acknowledgment from Ansar Allah-related outlets.
- The report found stylistic and operational parallels with Handala, but no shared infrastructure, account, domain or file connecting the groups.
- Advance warnings preceded some claims by one hour to 19 days, which the article says may give defenders a monitoring opportunity.
Article Details
- Attack Vectors
- Uways Qarani claimed disruptions to power plants and control of SCADA systems at desalination plants; the article says these claims were supported by videos but could not verify the claimed effects.
- The group claimed data breaches and distributed downloadable files, including files presented as personal data about military and intelligence personnel. The article could not verify whether the data was genuine.
- Uways Qarani used website defacement as claimed proof in its Fu Pao Chemical post; the article describes the proof as a defaced page rather than evidence of data theft.
- The group published advance warnings and claims across its website, Telegram channel, and forum, with the website typically posting first.
- Defensive Notes
- Monitor the Uways website/feed and UWAYS QARANI Telegram channel for advance warnings; the article found claims appearing there before forum posts, with reported lead times ranging from about one hour to 19 days.
- Monitor 146.19.125.57/files/ for new leak-related files. The article says the group’s downloadable leak claims used this server, while cautioning that the server could be rented or borrowed.
- Treat the PSMMC and GIP data claims as unverified, but assess potential exposure of personnel’s personal, health, contact, address, and movement information in case any portion is genuine.
- Consider heightened monitoring around Saudi, Israeli, and Axis of Resistance commemorations, which the article identifies as likely timing for further claims.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | uways[.]to | Publishing site/feed associated with Uways Qarani and used to post claims before they appeared on Telegram and the forum; the association is based on the group’s own links. |
| IPV4 | 146[.]19[.]125[.]57 | Server address used to distribute files associated with Uways Qarani’s claimed leaks; the article says the server may be rented or borrowed and does not establish ownership. |
Threat Actors
HandalaThe article reports that the pro-Palestinian Handala group disclosed details of 50 senior Israeli Air Force officers in March 2026. It notes parallels with Uways Qarani but found no shared infrastructure, accounts, or files linking the groups.Uways QaraniSelf-identified group behind an active Saudi-focused hack-and-leak operation. It claimed infrastructure attacks and releases of personal data, but the article could not verify those claims or its asserted Ansar Allah affiliation.
Products
RaidForumsIt pointed to a Raidforums thread titled "Saudi Arabia's Largest Military Hospital," posted by UWAYS on 28 September 2026.Telegramstarted from the hospital claim and worked backwards through the group's forum activity, website and Telegram channel to answer two questions: how the operation actually works, and how much of its Ansar AllahWordPressUways website turned out to be an Arabic-language WordPress site with a hooded figure in Yemeni colors for a logo, a Telegram button, and two pages of posts.
Countries
FranceFrance Altagem Hacked (21 September 2026)IsraelThe first claimed 43 TB of data taken and wiped from a Taiwanese maker of electronic insulating materials, framed as a blow against suppliers to Israel's Rafael and Elbit.Saudi ArabiaOn 28 September 2026, the anniversary of Hassan Nasrallah's killing, a forum account called UWAYS announced that it had taken over Saudi Arabia's largest military hospital.TaiwanWarning to Taiwan, then Fu Pao Chemical an hour laterYemenThe United States has designated Ansar Allah, Yemen's Houthi movement, a Foreign Terrorist Organization since 5 March 2025, and a Houthi cyber unit leaking data on Saudi military personnel would mark a new front in a