Hacktivist Surge Targets Middle East Amid Rising Cyber Espionage Threats

Executive Summary

Between February 28 and March 2, 2026, a coordinated wave of 149 hacktivist-driven distributed denial-of-service (DDoS) attacks targeted 110 organizations across 16 countries, following the U.S.-Israel military campaign against Iran. The majority of attacks were concentrated in the Middle East, with Kuwait, Israel, and Jordan accounting for over 76% of incidents. Nearly half of the targeted organizations were in the government sector, with finance and telecommunications also significantly affected. The attacks were orchestrated by at least 12 hacktivist groups, with Keymous+ and DieNet responsible for nearly 70% of activity. Attack methods included volumetric DDoS, hack-and-leak operations, phishing campaigns using malicious mobile applications, credential harvesting, and wiper malware targeting industrial control systems. (rescana.com)

Background

The escalation of cyber activities coincides with heightened geopolitical tensions in the Middle East. On February 28, 2026, the U.S. and Israel launched coordinated military strikes against Iran, codenamed Operation Epic Fury and Operation Roaring Lion, respectively. These operations targeted Iranian military and nuclear infrastructure, including the assassination of Supreme Leader Ali Khamenei. In response, Iranian state-sponsored actors and pro-Iranian hacktivist collectives have threatened and claimed retaliatory cyberattacks on U.S., Israeli, and allied critical infrastructure, including DDoS attacks, data wipers, and information operations. (en.wikipedia.org)

Hacktivist Activity

Between February 28 and March 1, 2026, over 150 hacktivist incidents were claimed in open hacktivist channels monitored by CloudSek’s Middle East feeds. The activity is explicitly tied to the current escalation involving Israel, Palestine, and Iran, and is dominated by DDoS, website defacement, and claimed data-breach operations against government, financial, aviation, telecom, and other critical-infrastructure targets in the region. (cloudsek.com)

Notable hacktivist groups involved include Keymous+ and DieNet, which have been responsible for nearly 70% of the attack activity between February 28 and March 2. The first DDoS attack was launched by Hider Nex (also known as Tunisian Maskers Cyber Force) on February 28, 2026. Hider Nex is a shadowy Tunisian hacktivist group that supports pro-Palestinian causes and leverages a hack-and-leak strategy combining DDoS attacks with data breaches to leak sensitive data and advance its geopolitical agenda. (toddpigram.com)

Attack Methods and Targets

The hacktivist groups employed various attack methods, including:

• Volumetric DDoS Attacks: Overwhelming targeted websites with artificial traffic to disrupt services.

• Hack-and-Leak Operations: Compromising systems to steal and publicly release sensitive data.

• Phishing Campaigns: Distributing malicious mobile applications to harvest credentials.

• Credential Harvesting: Collecting login information through deceptive means.

• Wiper Malware: Deploying malware to erase data on industrial control systems.

The primary targets were government entities, financial institutions, telecommunications companies, and critical infrastructure sectors across the Middle East. (rescana.com)

Implications

The surge in hacktivist cyber activities poses significant risks to the stability and security of the Middle East. The targeting of critical infrastructure and government entities can lead to operational disruptions, economic losses, and erosion of public trust. The involvement of multiple hacktivist groups with varying capabilities and objectives complicates attribution and response efforts. The blending of hacktivist and state-sponsored activities further blurs the lines between cybercrime and statecraft, challenging traditional cybersecurity frameworks.

Recommendations

Organizations operating in the Middle East should consider the following measures to mitigate the risks associated with the current cyber threat landscape:

• Enhanced Monitoring: Implement continuous monitoring of network traffic and system logs to detect unusual activities indicative of cyberattacks.

• Incident Response Planning: Develop and regularly update incident response plans to ensure swift and coordinated reactions to cyber incidents.

• Employee Training: Conduct regular cybersecurity awareness training to educate employees about phishing schemes and other social engineering tactics.

• Collaboration: Engage with local and international cybersecurity communities to share threat intelligence and best practices.

By proactively addressing these recommendations, organizations can strengthen their defenses against the evolving cyber threat landscape in the Middle East.

Highlights:

• U.S. braces for cyberspace retaliation from Iran, Published on Tuesday, March 03
• Hackers join U.S. and Israel's fight with Iran, Published on Wednesday, March 11