Cyber Threat Actor: Shmook Amer

The threat actor known by the aliases Shmook Amer and Dr.Hjd has conducted cyber operations targeting Kuwaiti government entities, primarily employing website defacement as a tactic to disseminate political messages. Their activities are documented in two separate incidents, both focused on Kuwait’s digital infrastructure. In March 2014, they compromised the website of Kuwait’s Ministry of Interior (moi.gov.kw), posting a message in Arabic that urged regional military intervention to address the Syrian civil war. This intrusion coincided with Kuwait’s role in hosting international humanitarian conferences for Syria, reflecting a strategic alignment with geopolitical events. The hackers emphasized the need for action over rhetoric, directly addressing Kuwaiti officials.

A separate 2016 operation against Kuwait’s parliamentary website—claimed by a group called "Group_Dmar"—shared thematic similarities but lacked explicit attribution to Shmook Amer or Dr.Hjd. This attack accused MP Abdul Hamid Dashti of acting as an Iranian agent and threatened to leak alleged communications involving Iranian and Syrian officials. It also advocated for stateless Bidoon residents’ rights, criticizing Kuwait’s citizenship policies. While both incidents demonstrate a focus on Kuwaiti governmental targets and use of defacement for ideological messaging, no technical tools, malware, or persistent intrusion methods beyond website compromises are cited. The actors’ objectives centered on political disruption and public shaming, leveraging timely events like elections and humanitarian conferences to amplify their reach. No state affiliations or collaborative ties with other threat groups are explicitly declared in available reporting.