How Yemen's civil war between the Hadi government and Houthi rebels is waged in cyberspace, with the latter gaining control of the “.ye” top-level domain
for Control of the Country's Internet Tweets: Peter W. Singer / @peterwsinger : Houthi rebels are using control of YemenNet's IP infrastructure to host Coinhive mining services to generate revenue Fascinating detail in this @RecordedFuture report on the cyber side of Yemen conflict http://www.recordedfuture.com/ ... @axios : The conflict tearing Yemen apart is providing a look at how today's wars spill over into digital conflict http://www.axios.com/...
Context & Ripple Effects
The Recorded Future report Axios draws on shows Yemen's civil war acquiring a digital front: the Houthis now control the country's .ye top-level domain and YemenNet's IP infrastructure, turning state network assets into spoils of war. This extends a pattern flagged as early as 2015, when the Yemeni Cyber Army was assessed as likely an Iranian government-run operation — suggesting Tehran-aligned capability operating inside Yemen's networks for years.
Control of physical and logical internet infrastructure has since proven to be real leverage in this conflict: Yemen's delay of repairs on the AAE-1 subsea cable linking Asia and Europe during an investigation into owners' alleged Houthi militia ties showed how much pressure sits on the Red Sea's cable chokepoints.
First-order effects
- Whoever controls the .ye registry and YemenNet's IP space can intercept or redirect traffic to Yemeni domains and monetize the network directly — the Houthis are doing exactly that by hosting Coinhive crypto-mining services on YemenNet infrastructure to generate revenue.
- The Hadi government loses not just territory but the digital symbols and plumbing of statehood: its ccTLD, its national ISP, and the ability to present itself as the legitimate operator of Yemen's internet.
Second-order effects
- Mining revenue gives the Houthis a self-generated financing stream outside traditional patronage channels — a flow that later drew international scrutiny when the US DOJ began investigating Iran's use of Binance to move money to networks backing groups including the Houthis.
- Iran gains a tested playbook through its proxy: the same state-capture-of-infrastructure model seen in the Yemeni Cyber Army reappears in the broader Iran-Israel cyber confrontation, which related coverage shows already hitting civilian systems like fuel distribution.
Third-order effects
- If the pattern holds, national internet assets — ccTLDs, IP blocks, landing stations, subsea cables — become contested war prizes rather than neutral utilities, forcing registrars, IANA-adjacent governance bodies, and cable consortia to plan for contested-sovereignty scenarios.
- Conflict finance migrates toward digital extraction (crypto-mining on captured infrastructure, sanctions-evasion rails), pushing regulators and financial-intelligence agencies to treat hostile control of a country's network layer as a sanctions and terror-financing problem, not just a cybersecurity one.
The trend: Civil wars are increasingly fought for control of a country's digital infrastructure itself, with whoever holds the domain, IP space, and cables gaining both revenue and geopolitical leverage.