Threat Actor Characterization
Shadow Cyber Security
ID: 1d7ebd872d46738a4ad9398968b7a11e36500| Cyber Security | Shadow³³ | — | — |
Actor Network Graph
Open Network GraphMITRE ATT&CK®
Shadow Cyber Security is referenced in OSINT primarily as an alliance partner of Keymous+ (Aug 2025) with a stated focus on intelligence sharing. Standalone offensive operations are not well documented in the reviewed sources. ATT&CK mapping is therefore conservative and focuses on coordination/propaganda and reconnaissance support; direct disruption techniques should not be attributed to Shadow Cyber Security without direct evidence.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1585.001 | Social Media Accounts | TA0042 |
|
| T1595 | Active Scanning | TA0043 |
|
Shadow Cyber Security — North Africa‑Context Hacktivist Brand (Alliance Partner of Keymous+; Intel‑Sharing Focus)
Classification: TLP: WHITE — Open Source Intelligence (OSINT)
Category: Cyber / Hacktivism — Alliance support role; intelligence sharing; influence / information warfare adjacency
Assessed home base: Unclear; OSINT places activity context in North Africa via alliance positioning
Executive Summary
Shadow Cyber Security is a hacktivist-branded entity referenced in OSINT primarily through its relationship with Keymous+, a prominent North African hacktivist collective. A 2025 Orange Cyberdefense profile of Keymous+ describes Shadow Cyber Security as having formed a formal alliance with Keymous+ in August 2025, with a primary focus on intelligence sharing. The same reporting frames the relationship as mutually supportive in North African contexts and tied to regional influence and information warfare motivations.
Beyond alliance references, open sources reviewed for this deliverable provide limited independent detail on Shadow Cyber Security’s standalone operations, targets, or technical tooling. Accordingly, this profile treats Shadow Cyber Security as an ecosystem node: a brand whose main evidenced role is alliance-level support (intel sharing and mutual enablement) rather than a fully documented, independently profiled operator.
Confidence is high that Shadow Cyber Security is publicly recognized as an alliance partner of Keymous+ with an “intelligence sharing” role. Confidence is low–medium regarding specific offensive capabilities or independent operations, due to a lack of consistent technical artifacts and third-party validation in open reporting reviewed here.
IOC Appendix (TLP:WHITE) — Shadow Cyber Security
Note: Reviewed OSINT does not provide stable, high-fidelity technical indicators (e.g., malware hashes, dedicated C2 domains) attributable to Shadow Cyber Security. This appendix therefore focuses on behavioral indicators and correlation cues relevant to an alliance enablement node.
