Sana'a (South24 Center)

Sana'a and several Yemeni governorates experienced continued internet service disruptions Tuesday evening (August 19) after a hacking group calling itself "S4uD1Pwnz" claimed responsibility for a new attack targeting Yemen Net, the internet service provider controlled by the Houthi group.

Users reported frequent service interruptions and severe slowdowns, lasting from nighttime hours through Wednesday morning. The group claimed responsibility via its Telegram channel without specifying the attack's nature or methodology.

A technical expert told ‘South24’ that initial indicators suggest a Distributed Denial of Service (DDoS) attack, explaining that this pattern involves flooding servers with fake requests that disrupt responses to legitimate ones. However, he emphasized that this remains a technical presumption given the absence of confirmed technical details from either the attackers or the service provider.

The expert noted that this attack type isn't technically complex and can be countered with available protection measures, but Yemen Net's weak technical staff and capabilities made the attack's impact more pronounced.

This attack coincided with the same group's announcement that it had breached the electronic system of the Yemeni Red Sea Ports Corporation in Hodeidah, claiming it had obtained data for all maritime voyages and manipulated information databases, in addition to seizing IP addresses and usernames of managers and employees.

The group stated that it changed company names within the system to its own as proof of penetration before completely disabling the system. The Houthis have not commented on these claims.

Since last July, the group has escalated operations, claiming to have hacked dozens of government and university websites in addition to communication networks, including Yemen Mobile and ’You‘. On August 11, an attack claimed by the group caused a near-total internet blackout in Sana'a and other governorates, marking the widest cyberattack in the country to date.

Despite the absence of official comment from the Houthis or Yemen Net regarding these developments, the group's name has sparked speculation about potential Saudi connections, as the first part "S4uD1" refers to "Saudi" in encoded form. It remains unclear whether this represents a genuine identity or a deception attempt.

These attacks highlight the fragility of Yemen's digital infrastructure amid the ongoing war. A broad segment of Yemen's population still depends on internet and communication services provided by Houthi-controlled companies in Sana'a, given the Yemeni government's failure to counter the group at this level.

Recently, the Public Telecommunications Corporation in Aden began selling Starlink devices and subscriptions for satellite internet service, a move that could reduce dependence on Houthi-controlled internet, particularly amid information about espionage activities the group conducts against opponents.

This comes alongside widespread blocking campaigns implemented by the Houthis against websites of independent and opposition channels and sites, including the South24 Center for News and Studies, since March 2024.