Threat actor
Circinus
Last fetched
Circinus is a threat actor tracked in WhisperGraph's MITRE ATT&CK corpus, observed using 0 techniques.
Description
Circinus is a defense and intelligence contractor that provided social media monitoring and intelligence for the UAE. Acquired by U.S Republican fundraiser Elliott Broidy from former US Army intelligence officer Alan Stone in 2014, Circinus operated a $200 million contract with the UAE's armed forces. It also maintains contracts with the US Army Intelligence and Security Command (INSCOM) and US Special Operations Command (USSOCOM). Circinus has marketed surveillance and data-mining tools to various government agencies, including in Cyprus, Tunisia, Romania, and the UAE, with pitch documents touting capabilities like identity resolution and social media geolocation. Former Circinus executives, including ex-CIA officers, have capitalized on the company's connections to establish new surveillance and intelligence ventures. Keith Noble, a former Circinus director, now runs BlackCloud International, which markets OSINT tools to governments, including contracts in the UAE and Eastern Europe. Similarly, Nick Williams, another former executive, has launched WMi General Trading in Abu Dhabi.
Techniques by tactic
No ATT&CK techniques are recorded for Circinus in WhisperGraph.
Attributed infrastructure
None published. WhisperGraph carries no ATTRIBUTED_TO edge to Circinus today — this states the absence of a published link, not that Circinus has no infrastructure.
References
- https://theintercept.com/2018/06/22/broidy-circinus-spying-tunisia-romania-uae/
- https://www.nytimes.com/2018/03/25/us/politics/elliott-broidy-trump-access-circinus-lobbying.html
- https://www.engadget.com/2018-06-25-contractor-hoped-to-sell-social-media-surveillance.html
- https://www.intelligenceonline.com/international-dealmaking/2022/03/03/ex-circinus-executives-forge-new-careers-in-abu-dhabi,109737611-art
© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.
Related pages
Pivot from Circinus into its techniques, tactics and any attributed infrastructure.
Queries
Resolves the slug to this actor, merging every duplicate node sharing the same name.
MATCH (a:ACTOR)
WHERE a.name =~ $pattern OR any(x IN a.aliases WHERE x =~ $pattern)
RETURN a.id AS id, a.name AS name, a.aliases AS aliases, a.description AS description,
a.references AS references, a.campaigns AS campaigns
LIMIT 25Techniques this actor uses, grouped by the tactic each one serves.
MATCH (a:ACTOR {name: $name})-[:USES_TECHNIQUE]->(t:ATTACK_PATTERN)
OPTIONAL MATCH (t)-[:USES_TACTIC]->(tac:ATTACK_PATTERN)
RETURN t.id AS techniqueId, t.name AS techniqueName, tac.id AS tacticId, tac.name AS tacticName
LIMIT 1000Infrastructure publicly attributed to this actor.
MATCH (n)-[:ATTRIBUTED_TO]->(a:ACTOR {name: $name})
RETURN labels(n)[0] AS kind, n.name AS name
LIMIT 25Or query Whisper from your own LLM workflow via the Whisper MCP server.