Skip to content
Install MCP

Threat actor

Blue Ocean

Last fetched

Blue Ocean is a threat actor tracked in WhisperGraph's MITRE ATT&CK corpus, observed using 0 techniques.

Description

Blue Ocean is an offensive cyber firm headquartered in Singapore and with offices in Tel Aviv, Israel. The company, founded in 2017 by retired Brigadier General Rami Ben-Ephraim and Lieutenant Colonel Ron Tira, both former high-ranking Israeli Air Force officers, develops spyware for intelligence gathering. It is also involved in training and developing local surveillance expertise in the funding countries. Towards the end of his military service, Ben-Afriam served as a military attaché for the IDF and the Ministry of Defense in several countries in the Asia-Pacific region, including Singapore, Thailand, and New Zealand. Singapore's Ministry of Defense has contracted Blue Ocean to supply a team of researchers, a role previously filled by Israeli spyware developer Candiru, while Sweden has become the firm's primary European client, according to Intelligence Online. The company's CEO, Avi Rosen, was previously the former CEO of Kamira, a cyber company established by NSO founders Shalev Hulio and Omri Lavie. Retired General Giora Eiland, known for his role on the board of private investigation firm Black Cube (whose clients include Harvey Weinstein and Trump), serves on Blue Ocean's board. The company has special security approval, giving it economic immunity. Unlike other Israeli spyware firms facing export controls and U.S. restrictions, it has secured significant investments and operates internationally with less scrutiny.

Techniques by tactic

No ATT&CK techniques are recorded for Blue Ocean in WhisperGraph.

Attributed infrastructure

None published. WhisperGraph carries no ATTRIBUTED_TO edge to Blue Ocean today — this states the absence of a published link, not that Blue Ocean has no infrastructure.

References

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.

Related pages

Pivot from Blue Ocean into its techniques, tactics and any attributed infrastructure.

Queries

Resolves the slug to this actor, merging every duplicate node sharing the same name.


MATCH (a:ACTOR)
WHERE a.name =~ $pattern OR any(x IN a.aliases WHERE x =~ $pattern)
RETURN a.id AS id, a.name AS name, a.aliases AS aliases, a.description AS description,
       a.references AS references, a.campaigns AS campaigns
LIMIT 25
Run yourself →

Techniques this actor uses, grouped by the tactic each one serves.


MATCH (a:ACTOR {name: $name})-[:USES_TECHNIQUE]->(t:ATTACK_PATTERN)
OPTIONAL MATCH (t)-[:USES_TACTIC]->(tac:ATTACK_PATTERN)
RETURN t.id AS techniqueId, t.name AS techniqueName, tac.id AS tacticId, tac.name AS tacticName
LIMIT 1000
Run yourself →

Infrastructure publicly attributed to this actor.


MATCH (n)-[:ATTRIBUTED_TO]->(a:ACTOR {name: $name})
RETURN labels(n)[0] AS kind, n.name AS name
LIMIT 25
Run yourself →

Or query Whisper from your own LLM workflow via the Whisper MCP server.