Moroccan hackers retaliate against Algeria in escalating cyber conflict

A Moroccan hacking group, known as "Phantom Atlas," has launched significant cyberattacks targeting Algerian government institutions in retaliation for a recent data breach of Morocco’s National Social Security Fund (CNSS) attributed to Algerian hackers.

In a statement shared on Telegram, Phantom Atlas claimed responsibility for breaching Algeria’s General Post and Telecommunications Corporation (MGPTT) within just 24 hours of the CNSS attack. The group asserted that it extracted over 13 gigabytes of confidential files, which included personal data and sensitive strategic documents. Reports suggest that the total amount of stolen data could be as high as 20 gigabytes.

Phantom Atlas issued a stark warning to the Algerian government, stating, “We are observing. We are capable. Any future act of provocation will be met with a targeted and disproportionate response.” They further claimed to have infiltrated the Algerian Ministry of Labor, uncovering documents that allegedly highlighted significant mismanagement and structural deficiencies within key state institutions.

In a parallel operation, another Moroccan entity, "OPx005," conducted a large-scale Distributed Denial of Service (DDoS) attack, disrupting multiple Algerian government websites, including those of the Prime Minister's office, Ministry of Foreign Affairs, Ministry of Interior, and Ministry of Defense.

This wave of cyberattacks followed an incident where the Algerian hacking group "Jabaroot" breached CNSS systems, exposing the personal data of nearly two million Moroccan employees across approximately 500,000 businesses. Leaked documents reportedly included salary certificates and employee lists from various organizations, including the royal holding SIGER and the Israeli liaison office in Rabat.

In response to the breach, CNSS confirmed that its systems had been targeted by a series of cyberattacks aimed at circumventing security protocols. While acknowledging the breach, CNSS claimed that preliminary checks indicated the leaked documents were often false, inaccurate, or truncated. They activated IT security protocols immediately upon detecting the data leak and implemented measures to strengthen their infrastructure.

Jabaroot retaliated by releasing personal information of CNSS Director General Hassan Boubrik, challenging the institution to prove the accuracy of the leaked documents. The group claimed their initial attack was in response to alleged harassment of official Algerian social media pages, specifically referencing the suspension of the Algerian Press Service account on the platform X.

Political figures in Morocco have reacted strongly to these events. Abdellah Bouanou, head of the Justice and Development Party’s parliamentary group, has called for enhanced cybersecurity measures across public institutions.

Phantom Atlas concluded their message with a resolute warning: “This is not merely a cyberattack. It is a message of deterrence and defiance. We will not remain silent in the face of aggression.” They emphasized that every hostile act against Morocco would be met with a firm response, asserting their strategic capabilities and resilience.

In the aftermath of the CNSS breach, Moroccan cybersecurity researchers investigated the Jabaroot group and uncovered operational security mistakes that exposed the attackers' identities. An investigation traced one of the handles associated with the attackers to a security engineer named Rachid Mzannar, currently residing in Bochum, Germany. Despite claims of Algerian origins, forensic analysis suggested that the individual may actually be from Tunisia.

The incident underscores the escalating cyber conflict between Morocco and Algeria, highlighting the vulnerabilities of state institutions and the growing threat of cyber warfare in the region.