Keymous+ DDoS Attacks Surge 4X in Power, Coordinated Strikes Target Global Organizations at Start of Business Day
Since the beginning of 2025, NETSCOUT experts have been observing an active wave of DDoS attacks attributed to a group known as Keymous+. Between February and September alone, 249 incidents were recorded, targeting 60 organizations across 15 countries and 21 industries.
According to NETSCOUT’s ATLAS telemetry, the attackers employed both conventional flood-based techniques and multivector scenarios, leveraging multiple channels simultaneously. The most powerful assaults occurred in collaboration with another threat group, DDoS54, during which the bandwidth of the attacks surged nearly fourfold — from 11.8 Gbps to 44 Gbps.
The primary victims were government institutions, hospitality and tourism companies, logistics operators, financial organizations, and telecommunication providers. The highest concentration of attacks was recorded in Morocco, Saudi Arabia, Sudan, India, and France. Such geographic patterns suggest motivations that are both financial and political, particularly given the frequency of incidents across the Middle East and North Africa (MENA) region.
Analysis of temporal patterns revealed that Keymous+ operations are executed with remarkable precision. Nearly one-third of all attacks occurred within a single hour — around 06:00 UTC, coinciding with the start of the business day in many targeted regions: when government offices open, transportation systems go live, markets begin trading, and hotels experience peak guest check-ins.
During these hours, legitimate traffic increases while SOC teams are not yet fully active, making it significantly harder to isolate malicious streams. Secondary peaks were also observed at 01:00, 10:00, and 12:00 UTC, with complete inactivity during other periods — possibly reflecting infrastructure leasing limits or internal scheduling constraints.
The attacks leveraged a broad and diverse infrastructure — ranging from Tor network nodes and cloud instances to home IoT devices, VPN services, and proxy networks. On average, more than 42,000 unique IP addresses participated in each assault, with some cases involving hundreds of thousands. A majority of the traffic bore signs of IP spoofing, suggesting the use of commercial DDoS-for-hire services capable of disguising packets as if originating from legitimate ASNs and data centers.
The campaign employed both reflection-based amplification techniques — exploiting protocols such as CLDAP, DNS, memcached, NTP, SNMP, and rpcbind — and direct floods via TCP, UDP, and DNS requests. The flexibility of tool selection, combined with the campaign’s scale and the confirmed collaboration with DDoS54, indicates an escalating and highly adaptive cyber threat. Following the April 12 partnership announcement, NETSCOUT recorded a significant surge in the intensity and complexity of the attack vectors, including sophisticated combinations of CLDAP/DNS amplification and UDP flooding.
Although the involvement of other groups such as NoName057(16), Dark Storm Team, or Anonymous Gaza has not been confirmed, open-source intelligence suggests potential links. The only officially verified cooperation remains that between Keymous+ and DDoS54, confirmed through both public statements and correlating telemetry data.
In summary, over eight months, nearly 250 coordinated DDoS attacks have targeted critical infrastructure and organizations across fifteen countries. Despite relying on seemingly simple techniques, Keymous+ has demonstrated exceptional organization, a vast operational toolkit, and scalable attack capabilities through alliances. The campaign underscores the urgent need to reassess defensive strategies against modern DDoS threats — particularly in sectors with vulnerable or mission-critical infrastructures.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
