Cyber Threat Actor: Group_Dmar

Group_Dmar is a threat actor known for conducting cyber attacks against Kuwaiti government digital assets, primarily utilizing website defacements to disseminate politically charged messages. The group's sole publicly documented alias remains Group_Dmar, with no additional monikers referenced in available reporting. Their operations specifically targeted Kuwait's parliamentary infrastructure during high-profile national events, as evidenced by their compromise of the Kuwaiti parliament website on November 26, 2016—the day of parliamentary elections. This temporal targeting indicates strategic timing to maximize visibility and political impact during sensitive electoral processes. The actor demonstrated consistent focus on Kuwaiti domestic affairs, with no recorded incidents targeting entities outside Kuwait or in non-governmental sectors.

The group's operations centered on political disruption and advocacy objectives rather than financial gain or traditional espionage. Their 2016 parliament website defacement featured accusations against Kuwaiti legislator Abdul Hamid Dashti, alleging Iranian collaboration and threatening to release purported secret communications involving Iranian and Syrian officials. Concurrently, Group_Dmar leveraged the platform to highlight grievances of Kuwait's stateless Bidoon population, demanding legislative action to address citizenship rights and access to education and healthcare. Their modus operandi relied exclusively on website defacements as the primary attack vector, replacing official content with customized political manifestos without evidence of more advanced persistent threats, data exfiltration, or secondary malware deployment. The group framed its actions as defending Saudi Arabian interests, explicitly declaring Saudi sovereignty as a "red line" not to be crossed, though available sources provide no substantiated evidence of direct affiliation with Saudi state entities or other organized collectives. This singular documented operation represents their most consequential publicly attributed campaign, exploiting the symbolic value of national government platforms to amplify geopolitical messaging during periods of heightened political sensitivity.