A wave of politically charged cyberattacks is reshaping the digital threat landscape across multiple continents—and a shadowy group calling itself Keymous+ is at the centre of it all according to a new report from cybersecurity organisation Radware..
Claiming more than 700 distributed denial-of-service (DDoS) attacks in 2025, Keymous+ has escalated its operations at an alarming pace, disrupting government services, telecom operators, educational platforms and financial systems across Europe, North Africa, the Middle East, and Asia.
With no clear ideological stance, and no consistent list of enemies, the group defies traditional categorisation. It describes itself simply as “North African hackers,” but its targets range from Israeli manufacturing infrastructure to French telecoms and Danish universities.
“There’s no clear political playbook,” said Ori Meidan, a cybersecurity expert who has analysed Keymous+’s activity. “They align themselves with different causes depending on the moment—one week they’re part of #OpIsrael, the next they’re joining anti-India campaigns. It’s erratic, but that unpredictability is part of the threat.”
Part of what sets Keymous+ apart is its growing web of alliances. The group regularly co-brands operations with other hacktivist collectives, including Mr Hamza, NoName057(16), and the Moroccan Dragons. These joint efforts, often marketed under names like “Red Eye Op,” suggest a decentralised but cooperative model of cyber sabotage.
“Modern hacktivism is increasingly networked,” said Meidan. “These groups share infrastructure, amplify each other’s attacks, and compete for attention in much the same way influencers do.”
This reputational economy has serious consequences for digital infrastructure. With every new collaboration, the reach of coordinated attacks increases. What used to be the work of isolated actors now resembles a loosely connected federation of cyber insurgents.
Adding to the complexity, Keymous+ has adopted a pseudo-organisational model, claiming to operate with an “Alpha Team” (focused on breaches and leaks) and a “Beta Team” (tasked with DDoS campaigns). While the Alpha Team appears dormant, the Beta Team remains hyperactive.
Analysts believe this structure is as much about perception as functionality. “They want to look sophisticated and structured,” Meidan said. “Whether that’s true or not, the perception alone can boost recruitment, reputation and deterrence.”
There are also growing suspicions that Keymous+ may be linked to commercial cybercrime operations. A tweet from the group in June advertised a stress-testing service called EliteStress, which offers DDoS attacks for hire. The link between ideology and monetisation has led some to question whether Keymous+ is a true hacktivist collective—or simply using the label for cover.
Regardless of motive, the impact is real. In an increasingly tense global climate, Keymous+ has found a way to inject disruption across geopolitical and economic boundaries.
“They’re hard to pin down, hard to predict, and hard to stop,” Meidan warned. “And that makes them one of the most dangerous types of threat actors in the world right now.”
