Keymous+ Profile Details DDoS Operations and Assessed EliteStress Link
Summary
The profile details Keymous+’s DDoS methods, targets and defenses. It reports that NETSCOUT ATLAS independently verified 249 attacks in Feb–Sep 2024, while the group claimed more than 700 by 2025, and assesses an operator-level link to EliteStress.
Key points
- Keymous+ first appeared publicly in November 2023 with a DDoS claim against Morocco’s national e-Visa portal.
- Researchers assess an operator-level relationship between Keymous+ and the commercial DDoS-for-hire platform EliteStress; the article says no ownership document or direct confession has been published.
- NETSCOUT ATLAS reportedly independently verified 249 attacks from February to September 2024; the group’s cumulative DDoS claims exceeded 700 by 2025.
- The profile describes direct floods and reflection/amplification attacks, using infrastructure that includes cloud instances, compromised devices, proxies and VPNs.
- The article reports solo attacks peaking at 11.8 Gbps and collaborative attacks with DDoS54 reaching 44 Gbps; it also says more than 30% of confirmed attacks began around 06:00 UTC.
- Recommended defenses include detecting attack vectors rather than relying on IP blocklists, reducing amplification exposure, monitoring the group’s Telegram activity and planning for coalition-scale traffic.
Article Details
- Attack Vectors
- DDoS using TCP SYN, UDP, DNS-query, and HTTP/2 floods.
- Reflection and amplification using CLDAP, DNS, NTP, memcached, SNMP, NetBIOS, rpcbind, L2TP, WS-DD, and chargen.
- Attack traffic reportedly sourced from Tor exit nodes, public cloud instances, compromised IoT devices, commercial VPN and proxy services, and infected hosts.
- Alpha Team reportedly conducted breaches, collected local data, and ran leak campaigns; the article says this activity later went inactive.
- Defensive Notes
- Prioritize vector-based detection for reflection protocols and HTTP/2 floods over IP blocking, because the article reports that source addresses are often spoofed.
- Audit externally accessible services for open resolvers, misconfigured SNMP agents, and accessible memcached instances; disable or rate-limit UDP services without a legitimate external requirement.
- Monitor the group’s known Telegram channels for target announcements and check-host.net proof links as potential early warnings.
- Maintain elevated monitoring around 06:00 UTC, when the article says more than 30% of confirmed attacks occur.
- Plan upstream mitigation capacity for coalition-scale attacks; the article reports a collaborative peak of 44 Gbps, compared with 11.8 Gbps for solo operations.
MITRE ATT&CK
T1005 · Data from Local SystemAlpha Team is reportedly responsible for breaches and local data collection before its activity went inactive.T1090.003 · Multi-hop ProxyTor exit nodes and commercial VPN or proxy services are reported as sources used to obscure attack traffic.T1498 · Network Denial of ServiceThe article describes DDoS as Keymous+’s primary method across confirmed operations.T1498.001 · Direct Network FloodKeymous+ is reported to use TCP SYN, UDP, DNS-query, and HTTP/2 floods.T1498.002 · Reflection AmplificationThe article reports reflection and amplification using CLDAP, DNS, NTP, memcached, SNMP, NetBIOS, rpcbind, L2TP, WS-DD, and chargen.T1499 · Endpoint Denial of ServiceThe article reports Layer-7 HTTP/2 flooding against web-facing infrastructure.T1567 · Exfiltration Over Web ServiceThe article says stolen Saudi banking-sector data surfaced on cybercrime and leak forums following July 2025 operations.T1583.003 · Virtual Private ServerPublic cloud instances are reported as part of the attack-source pool.T1584.005 · BotnetThe article reports compromised IoT devices and infected hosts being incorporated into attack pools.
Threat Actors
AnonSecThe article reports an alliance with Keymous+ and says joint operations were coordinated with allied hacktivist groups.Anonymous AlgeriaA representative reportedly described Anonymous Algeria as a sub-group controlled and managed by Keymous+.DDOS54The article describes DDOS54 as a Keymous+-managed sub-group and reports collaborative DDoS operations with it.Hack for HumanityA representative reportedly described Hack for Humanity as a sub-group controlled and managed by Keymous+; the article also identifies it as a banner for early operations.Keymous PlusThe article explicitly identifies Keymous Plus as another name for Keymous+ and attributes DDoS campaigns and reported breach and leak activity to the group.Keymous+The article attributes DDoS campaigns and reported breach and leak activity to this group, and assesses a suspected operator-level relationship with EliteStress.Moroccan DragonsThe article reports an alliance with Keymous+ and says joint operations were coordinated with allied hacktivist groups.Mr HamzaThe article reports an alliance with Keymous+ and says joint operations were coordinated with allied hacktivist groups.NoName057(16)The article reports an alliance with Keymous+ and says joint operations were coordinated with allied hacktivist groups.
Tools
Countries
AlgeriaResearchers attribute the group’s origins to Algeria, characterizing it as a small collective that coalesced around two simultaneous pressures: longstanding Algerian–Moroccan cyber tensions and the outbreak of the GazaFranceConfirmed attacks heavily target government, telecom, financial, transport, healthcare, education, and energy organizations, with Morocco, Saudi Arabia, India, France, and Israel among the most targeted countries.IndiaConfirmed attacks heavily target government, telecom, financial, transport, healthcare, education, and energy organizations, with Morocco, Saudi Arabia, India, France, and Israel among the most targeted countries.IsraelIts activity has centered on geopolitical flashpoints, especially Morocco, Israel, and conflict-linked targets, while researchers also link it to the EliteStress DDoS-as-a-Service platform.MoroccoIts activity has centered on geopolitical flashpoints, especially Morocco, Israel, and conflict-linked targets, while researchers also link it to the EliteStress DDoS-as-a-Service platform.Saudi ArabiaConfirmed attacks heavily target government, telecom, financial, transport, healthcare, education, and energy organizations, with Morocco, Saudi Arabia, India, France, and Israel among the most targeted countries.SudanGeographically, confirmed attack telemetry places Morocco, Saudi Arabia, Sudan, India, and France as the five most targeted countries.
Industries
EducationConfirmed attacks heavily target government, telecom, financial, transport, healthcare, education, and energy organizations, with Morocco, Saudi Arabia, India, France, and Israel among the most targeted countries.EnergyConfirmed attacks heavily target government, telecom, financial, transport, healthcare, education, and energy organizations, with Morocco, Saudi Arabia, India, France, and Israel among the most targeted countries.Financial ServicesGovernment agencies represent the largest confirmed victim category, followed by telecommunications, financial services, transportation and logistics, hospitality, healthcare, education, and energy.GovernmentConfirmed attacks heavily target government, telecom, financial, transport, healthcare, education, and energy organizations, with Morocco, Saudi Arabia, India, France, and Israel among the most targeted countries.HealthcareConfirmed attacks heavily target government, telecom, financial, transport, healthcare, education, and energy organizations, with Morocco, Saudi Arabia, India, France, and Israel among the most targeted countries.HospitalityGovernment agencies represent the largest confirmed victim category, followed by telecommunications, financial services, transportation and logistics, hospitality, healthcare, education, and energy.TelecommunicationsGovernment agencies represent the largest confirmed victim category, followed by telecommunications, financial services, transportation and logistics, hospitality, healthcare, education, and energy.Transportation and LogisticsGovernment agencies represent the largest confirmed victim category, followed by telecommunications, financial services, transportation and logistics, hospitality, healthcare, education, and energy.