Middle East retaliatory hacktivist DDoS campaign
Campaign
Summary
Hide ▲
Show ▼
A retaliatory hacktivist DDoS campaign has surged across the Middle East, creating broad disruption risk for government and public-infrastructure targets. Researchers recorded 149 claims against 110 organizations in 16 countries during February 28 to March 2, 2026. Keymous+, DieNet, and NoName057(16) accounted for most of the activity, while Hider Nex launched the first recorded attack on February 28. The wave matters because the activity is concentrated in state-level targets and appears tied to escalating regional conflict.
Related Happenings
UAE and Gulf cyberattack surge after Iran conflict escalation
Target Trend
First: 06.05.2026 08:30
Last: 06.05.2026 08:30
Sources 1
About this happening:
Cyberattack volume surged across the **UAE** and wider **Gulf** after military operations against **Iran** began, pushing daily breach attempts to **600,000 to 800,000** and raisi...
UAE and Gulf cyberattack surge after Iran conflict escalation
Target TrendAbout this happening: Cyberattack volume surged across the **UAE** and wider **Gulf** after military operations against **Iran** began, pushing daily breach attempts to **600,000 to 800,000** and raisi...
Handala post-ceasefire retaliatory cyberattack campaign targeting the U.S. and Israel
Campaign
First: 09.04.2026 04:22
Last: 09.04.2026 04:22
Sources 1
About this happening:
**Handala** and other **pro-Iranian hackers** are keeping a retaliatory **cyber campaign** active after the **ceasefire announcement**, leaving **U.S. and Israeli targets** at ong...
Handala post-ceasefire retaliatory cyberattack campaign targeting the U.S. and Israel
CampaignAbout this happening: **Handala** and other **pro-Iranian hackers** are keeping a retaliatory **cyber campaign** active after the **ceasefire announcement**, leaving **U.S. and Israeli targets** at ong...
North Korean Drift contributor targeting campaign
Campaign
First: 06.04.2026 19:35
Last: 06.04.2026 19:35
Sources 1
About this happening:
A **North Korean** targeting campaign against **Drift Protocol contributors** ran for at least **six months** before the later theft, increasing the attackers' access and credibil...
North Korean Drift contributor targeting campaign
CampaignAbout this happening: A **North Korean** targeting campaign against **Drift Protocol contributors** ran for at least **six months** before the later theft, increasing the attackers' access and credibil...
DarkSword iPhone exploit chain exploitation wave
Exploitation Wave
First: 18.03.2026 23:15
Last: 18.03.2026 23:15
Sources 1
About this happening:
**DarkSword** is an **active iPhone exploitation wave** targeting **iOS 18.4 through iOS 18.7**, with **Apple** expanding **iOS 18.7.7** and **iPadOS 18.7.7** to more older device...
DarkSword iPhone exploit chain exploitation wave
Exploitation WaveAbout this happening: **DarkSword** is an **active iPhone exploitation wave** targeting **iOS 18.4 through iOS 18.7**, with **Apple** expanding **iOS 18.7.7** and **iPadOS 18.7.7** to more older device...
Latest development: 02.04.2026 16:30
Apple broadened availability of iOS 18.7.7 and iPadOS 18.7.7 on April 1 to more devices still running iOS 18, including iPhone XR through iPhone 16 models, iPhone SE (2nd and 3rd generation), and multiple iPad models, so they can receive security patches against DarkSword web-based watering hole attacks that can deploy malware after a user visits a compromised website. Apple also began sending lock screen notifications to users running older software, urging installation of the latest security updates.
UK organizations saw blocked cyber-attacks rise 36% YoY in February 2026
Target Trend
First: 11.03.2026 12:30
Last: 11.03.2026 12:30
Sources 1
About this happening:
**UK organizations** faced **1504 blocked cyber-attacks per organization per week** in **February 2026**, a **36% YoY increase** that signals a worsening threat environment. That...
UK organizations saw blocked cyber-attacks rise 36% YoY in February 2026
Target TrendAbout this happening: **UK organizations** faced **1504 blocked cyber-attacks per organization per week** in **February 2026**, a **36% YoY increase** that signals a worsening threat environment. That...
Timeline
-
04.03.2026 19:21 1 articles · 2mo ago
Hider Nex launches first DDoS attack against Middle East targets
Exploitation ObservedHider Nex, also known as Tunisian Maskers Cyber Force, launched the first distributed denial-of-service attack on Middle East targets on February 28, 2026, marking the opening move in the retaliatory hacktivist wave tied to the U.S.-Israel campaign against Iran.
Show sources
- 149 Hacktivist DDoS Attacks Hit 110 Organizations in 16 Countries After Middle East Conflict — thehackernews.com — 04.03.2026 19:21
-
04.03.2026 19:21 2 articles · 2mo ago
Retaliatory hacktivist DDoS claims span 16 countries
Campaign Scope UpdateRetaliatory hacktivist DDoS activity against organizations across 16 countries was measured at 149 claims against 110 organizations between February 28 and March 2, 2026, with Keymous+ and DieNet driving nearly 70% of attack activity and 12 groups accounting for 74.6% of the claims.
Show sources
- 149 Hacktivist DDoS Attacks Hit 110 Organizations in 16 Countries After Middle East Conflict — thehackernews.com — 04.03.2026 19:21
- 149 Hacktivist DDoS Attacks Hit 110 Organizations in 16 Countries After Middle East Conflict — thehackernews.com — 04.03.2026 19:21