Keymous+

Keymous+ is a hacktivist-branded threat actor assessed to originate in North Africa, with reporting most consistently pointing to Algeria. Emerging publicly in late 2023, the group presents itself as a pro-Palestinian and anti-Israel collective under slogans such as “Hack for Humanity,” but has also been assessed as a hybrid actor that combines political messaging, propaganda amplification, and large-scale disruptive operations with a commercial DDoS-as-a-Service component. Researchers have linked Keymous+ at a structural or operator level to the EliteStress DDoS-for-hire platform, although public proof of ownership has not been established. The group appears to maintain an internal division between an Alpha Team associated with breach and leak activity and a Beta Team responsible for DDoS operations; by mid-2025, Beta Team activity accounted for nearly all confirmed operations while Alpha Team activity appeared largely dormant. Keymous+ has also claimed control of or association with sub-groups including Anonymous Algeria, DDOS54, and Hack for Humanity. It operates prominently through Telegram and uses public claim-and-amplification tactics, including target announcements, uptime verification, and coalition messaging. Keymous+ is best known for high-volume DDoS campaigns. Independent telemetry verified hundreds of attacks in 2024, while the group publicly claimed more than 700 attacks by 2025, indicating a pattern of exaggeration mixed with genuine disruptive activity. Observed methods include multi-vector flooding and amplification techniques, and the actor has been repeatedly described as relying on publicly available booter or stressor services rather than bespoke tooling. The group has also been associated with website defacements, unverified breach claims, propaganda operations, and some claimed data theft. In conflict-driven campaigns, it has publicly claimed attacks or exfiltration involving government ministries and educational institutions, though not all such claims have been independently validated. Targeting has been broad and strongly shaped by geopolitical events. Confirmed and claimed victims span government, telecommunications, financial services, transportation and logistics, health care, education, and energy. Morocco, Saudi Arabia, Sudan, India, and France have been identified among the most targeted countries in confirmed telemetry, while later campaigns also focused on Israel, Jordan, Kuwait, Oman, and other Gulf states. Keymous+ has participated in operations tied to #OpIsrael and #OpIndia and has been active in anti-Western and pro-Iran-aligned mobilizations during Middle East crises. The actor is notable for coalition behavior. It has publicly coordinated or aligned with groups including NoName057(16), Mr Hamza, AnonSec, Moroccan Dragons, Inteid, Anonymous Kashmir, DieNet, Dark Storm Team, Conquerors Electronic Army, Nation of Saviors, and other Telegram-based hacktivist brands. During the 2026 Middle East escalation, Keymous+ was repeatedly identified as one of the most active disruptive actors globally and one of the principal drivers of attack claims against government and financial targets. Despite this visibility, its tradecraft is generally assessed as low to moderate sophistication, with operational impact deriving from scale, timing, mobilization speed, and propaganda value rather than advanced intrusion capability. Overall, Keymous+ is best characterized as a politically opportunistic, Algeria-linked hacktivist and commercial DDoS actor whose core capability is disruptive denial-of-service activity, supplemented by public breach claims, occasional claimed exfiltration, and alliance-based influence operations across multiple regional conflicts.