Skip to content
Install MCP

Threat actor

First WAP

Last fetched

First WAP is a threat actor tracked in WhisperGraph's MITRE ATT&CK corpus, observed using 0 techniques.

Description

First WAP is a surveillance technology company headquartered in Jakarta, Indonesia. It was founded by former Siemens engineer Josef Fuchs in the early 2000s. The company's primary product, Altamides, is a phone-tracking software that exploits vulnerabilities in the global telecom network's SS7 protocol to pinpoint any person's location worldwide. Over time, First WAP has expanded Altamides' capabilities beyond location tracking to include intercepting SMS messages, listening to phone calls, and breaching encrypted messaging apps like WhatsApp. First WAP's surveillance technology has been used across more than 160 countries, tracking over 14,000 unique phone numbers. The company marketed its products to authoritarian governments and made them accessible to corporate actors through a network of middlemen. Specific clients included governments in Morocco and Algeria during the Arab Spring, marketed through the British firm KCS Group. Victims of the surveillance ranged from high-profile political figures and journalists to ordinary citizens like teachers and therapists.

Techniques by tactic

No ATT&CK techniques are recorded for First WAP in WhisperGraph.

Attributed infrastructure

None published. WhisperGraph carries no ATTRIBUTED_TO edge to First WAP today — this states the absence of a published link, not that First WAP has no infrastructure.

References

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.

Related pages

Pivot from First WAP into its techniques, tactics and any attributed infrastructure.

Queries

Resolves the slug to this actor, merging every duplicate node sharing the same name.


MATCH (a:ACTOR)
WHERE a.name =~ $pattern OR any(x IN a.aliases WHERE x =~ $pattern)
RETURN a.id AS id, a.name AS name, a.aliases AS aliases, a.description AS description,
       a.references AS references, a.campaigns AS campaigns
LIMIT 25
Run yourself →

Techniques this actor uses, grouped by the tactic each one serves.


MATCH (a:ACTOR {name: $name})-[:USES_TECHNIQUE]->(t:ATTACK_PATTERN)
OPTIONAL MATCH (t)-[:USES_TACTIC]->(tac:ATTACK_PATTERN)
RETURN t.id AS techniqueId, t.name AS techniqueName, tac.id AS tacticId, tac.name AS tacticName
LIMIT 1000
Run yourself →

Infrastructure publicly attributed to this actor.


MATCH (n)-[:ATTRIBUTED_TO]->(a:ACTOR {name: $name})
RETURN labels(n)[0] AS kind, n.name AS name
LIMIT 25
Run yourself →

Or query Whisper from your own LLM workflow via the Whisper MCP server.