Loading threat actor…
Keymous Plus is a pro-Iran, pro-Palestinian hacktivist group active in the cyber campaigns surrounding the 2026 Iran-Israel conflict. It has been identified as one of the most active geographically distributed disruption actors in that ecosystem, with operations attributed to operators in Bangladesh and alignment with broader Iran-backed or Iran-aligned hacktivist coalitions. The group is known primarily for high-volume disruptive operations, especially distributed denial-of-service campaigns against government and public-sector targets across the Middle East. Keymous Plus conducted broad multi-country campaigns against Bahrain, Kuwait, Jordan, Qatar, Syria, the United Arab Emirates, and Egypt, and also made claims involving Israel and India. Its targeting has centered on government ministries, e-government services, and other public institutions, making government and public administration its clearest sector focus. Reporting also links the group to claims against Israeli educational infrastructure involving alleged access to sensitive records, though disruptive activity remains the most consistently substantiated behavior. Operationally, Keymous Plus is associated with coordinated campaign branding and propaganda-driven hacktivism, including named operations publicized through social channels. Its most substantiated activity consists of DDoS claims with external uptime-check verification in some cases, indicating an emphasis on visible service disruption and psychological impact rather than stealthy long-term intrusion. The group has been described as running one of the broadest sustained geographic campaigns among pro-Iran and pro-Palestinian hacktivist actors during the conflict period. Keymous Plus appears within a wider ecosystem of ideologically aligned groups that mobilized around anti-Israel and anti-Gulf-state narratives during the regional escalation. Its dominant motivation is ideological alignment with Iranian and Palestinian causes rather than conventional financial crime. No high-confidence evidence in the supplied facts supports ransomware or extortion operations by this actor.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
3 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Pro-Iran/Palestine threat group conducting a broad geographically distributed campaign across multiple countries.
Named as another highly active pro-Iranian hacktivist group during the March 2026 escalation, involved in DDoS claim activity against regional targets.
High-volume disruptive actor running geographically expanding DDoS sweeps across Gulf and regional government targets, while also making sensitive breach claims such as alleged access to Israel’s Ministry of Education portal.
Pro-Iran hacktivist group operating from Bangladesh as part of Iran’s globalized recruitment ecosystem.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.