Hacktivist Groups Keymous+ and DieNet Drive 70% of Retaliatory Cyber Attacks

Cybersecurity researchers have documented a significant surge in hacktivist activity during the final days of February 2026, with two groups — Keymous+ and DieNet — driving nearly 70% of all tracked retaliatory cyber attack activity between February 28 and March 2, targeting government websites, financial institutions, and critical infrastructure.

Attack Patterns

The attacks primarily consisted of distributed denial-of-service (DDoS) campaigns against government websites and financial institutions in NATO-aligned countries, combined with defacement attacks on vulnerable web applications and data theft from exposed databases. Keymous+ focused on European government targets, while DieNet concentrated on financial services and telecommunications infrastructure. The attacks were largely unsophisticated — volumetric DDoS and exploitation of known vulnerabilities — but their coordinated timing and volume created significant disruption.

Motivation and Attribution

Both groups publicly claimed their attacks were retaliatory in nature, motivated by geopolitical events including military operations in the Middle East and ongoing tensions over Western sanctions. The groups communicated primarily through Telegram channels, posting evidence of successful attacks and coordinating timing. While the groups present themselves as ideologically motivated hacktivists, researchers note that the distinction between hacktivist groups, state-sponsored proxies, and financially motivated criminals has become increasingly blurred, with some groups operating across all three categories simultaneously.

Defensive Implications

The surge highlights the growing role of hacktivist activity in geopolitical conflict, where cyber attacks serve as a form of asymmetric response to conventional military and diplomatic actions. Organizations in targeted sectors should ensure their DDoS mitigation services are configured and tested, verify that public-facing applications are patched against known vulnerabilities, and monitor for indicators of compromise associated with the groups' known tooling. The hacktivist threat is unlikely to diminish as long as geopolitical tensions persist.