Skip to content
Install MCP

Threat actor

Carbyne

Last fetched

Carbyne is a threat actor tracked in WhisperGraph's MITRE ATT&CK corpus, observed using 0 techniques.

Description

Carbyne is a company headquartered in New York, with offices in Israel and Mexico. Founded by Amir Elichai, a former security guard for the Israeli consul general, Carbyne has its roots in Israeli intelligence, with ties to Unit 8200, a division known for its expertise in surveillance operations. Unit 8200 has been criticized for its surveillance activities, which include monitoring Palestinian civilians for coercive purposes and conducting surveillance on Palestinian-Americans through an intelligence-sharing arrangement with the NSA. Carbyne’s platform, marketed as an enhancement for emergency response, allows for extensive data collection from mobile devices and IoT sensors without explicit user consent. When a 911 call is made, Carbyne can automatically access the caller's precise location and video feed from their smartphone, effectively turning personal devices into surveillance tools. This capability is expanded through partnerships with major tech companies like Cisco, enabling the collection of data from smart city infrastructure, such as road cameras and streetlamps, often without the public's awareness. The company's advisory board includes notable figures such as former U.S. Secretary of Homeland Security Michael Chertoff and former Israeli Prime Minister Ehud Barak, furthering its deep ties to both the U.S. and Israeli security establishments.

Techniques by tactic

No ATT&CK techniques are recorded for Carbyne in WhisperGraph.

Attributed infrastructure

None published. WhisperGraph carries no ATTRIBUTED_TO edge to Carbyne today — this states the absence of a published link, not that Carbyne has no infrastructure.

References

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.

Related pages

Pivot from Carbyne into its techniques, tactics and any attributed infrastructure.

Queries

Resolves the slug to this actor, merging every duplicate node sharing the same name.


MATCH (a:ACTOR)
WHERE a.name =~ $pattern OR any(x IN a.aliases WHERE x =~ $pattern)
RETURN a.id AS id, a.name AS name, a.aliases AS aliases, a.description AS description,
       a.references AS references, a.campaigns AS campaigns
LIMIT 25
Run yourself →

Techniques this actor uses, grouped by the tactic each one serves.


MATCH (a:ACTOR {name: $name})-[:USES_TECHNIQUE]->(t:ATTACK_PATTERN)
OPTIONAL MATCH (t)-[:USES_TACTIC]->(tac:ATTACK_PATTERN)
RETURN t.id AS techniqueId, t.name AS techniqueName, tac.id AS tacticId, tac.name AS tacticName
LIMIT 1000
Run yourself →

Infrastructure publicly attributed to this actor.


MATCH (n)-[:ATTRIBUTED_TO]->(a:ACTOR {name: $name})
RETURN labels(n)[0] AS kind, n.name AS name
LIMIT 25
Run yourself →

Or query Whisper from your own LLM workflow via the Whisper MCP server.