Ransomware and Data-Theft Claims in the Maghreb: Q1–Q3 2026

Bottom line

Five findings matter for a board or a CISO in the Maghreb, and for any firm that outsources work to, or sells into, the region.

1. The ransomware record is thin, and thinness is not safety. We observed 20 Maghreb-linked claims in the first nine months of 2026, split 5, 10, and 5 by quarter. That is a quarter of the 83 across our six Gulf markets and about a ninth of France's 185. These are observed volumes in our collection, not a comparable measure of real incidence, and smaller markets, thinner reporting, and fewer English-language leak-site profiles all lower what we can see. The tracker's raw yearly counts, taken before cleaning and on an uneven record in earlier years, are 9 for 2023, 15 for 2024, 23 for 2025, and 23 so far in 2026.
2. Morocco is where the claims are. Thirteen of the 20 claims (65%) name Moroccan organizations, against four in Tunisia, two in Libya, one in Algeria, and none in Mauritania. Morocco also leads the forum market, with 80 of the 129 posts.
3. The service layer is a target. Five of the 20 claims (25%) name outsourcing, staffing, audit, or accounting firms, which hold payroll, HR, and customer records for clients in Europe and in the region. Other listings name Maghreb sites of foreign-owned firms, such as a plant and a support operation, and we do not count those because their headquarters are elsewhere. For clients abroad, the exposure is second-hand.
4. Forum and Telegram posts are where public bodies are most often named. One monitor lists 129 posts for the five countries over about August 2025 to October 2026, a longer window than the leak-site claims: 80 for Morocco, 20 for Algeria, 17 for Tunisia, 10 for Libya, and 2 for Mauritania. Among the posts whose details we could see (35 Moroccan after one exclusion, 20 Algerian, 17 Tunisian, and 10 Libyan), 9, 12, 5, and 5 respectively name ministries, agencies, or public programs. Five handles account for 44% of Morocco's posts, and at least five handles recur in more than one country, which does not prove they share operators.
5. Libya's central bank is the one confirmed public response. After Qilin listed the Central Bank of Libya on 22 June, the bank said it rejected extortion and found no confirmed access to accounts, balances, or assets, and suggested the data came from an earlier hacking operation, while the Internal Security Agency warned that some leaked files carry malware. It is a useful template for a measured public statement, and it also shows how a claim can be partly true and partly old.

We rate the risk to Moroccan service providers and to public bodies in all five countries as High, and for Moroccan and Tunisian manufacturers, pharma, and retail as Elevated. For Libyan energy and financial institutions we rate it Elevated, with low visibility. These are our assessments, built on leak-site claims and forum posts that no one has verified.

1. Scope, and what the numbers can bear

This report covers claims naming organizations in Morocco, Algeria, Tunisia, Libya, and Mauritania that were published on leak sites between 1 January and 30 September 2026. Claims dated in October are cited separately as a later development. The tracker lists 23 such entries for the five countries. After removing organizations that are headquartered elsewhere, 20 remain. We removed an entry from a Chilean intellectual-property office, one from a Pakistani cement maker, and one from an Egyptian appliance group, all filed under the wrong country. We count the same domain or organization name listed again within 14 days, by the same or another group, once, and found no such repeats. This rule can merge genuinely separate incidents at one organization, so a repeated listing counts as one claim and not as proof of one incident. We attribute an organization to a country by its headquarters or main operations, using its domain and public profile, so a plant or a service centre of a foreign-owned firm is not counted. The tracker’s company descriptions are sometimes generated automatically, and we have not verified them. A second tracker we checked dates some entries differently and lists a few the first does not. Visibility differs by country, so the counts are not complete incident totals. The forum figures come from a commercial monitor’s country filter, cover a longer window than the leak-site claims (about August 2025 to October 2026), and are not comparable with them.

Three caveats apply to everything below.

• Leak sites, the sites on which groups publish stolen data, show only victims who did not pay or negotiate privately. Real incident counts may be larger.
• A group’s claim is not proof of compromise. We use “claim” for an unverified listing and “incident” only for an established event. We have not independently verified any published dataset, and several forum posts reuse old or public data.
• Hacktivist listings can be politically timed and can be both claims and messaging. We name no actor’s nationality or sponsor unless public reporting does, and we do not link similar handles across years without evidence.

Terms. RaaS: ransomware-as-a-service, a platform that developers rent to independent affiliates. EDR: endpoint detection and response, security software on servers and laptops. Initial access broker (IAB): a seller of ready-made entry into a network. Hacktivism: attacks made for political or ideological reasons. Web shell: a small script that gives remote control of a web server. BPO: business-process outsourcing.

2. Timeline: a thin flow with a spring peak

The flow is about two claims a month. The second quarter peaks at 10 because four Moroccan institutions were listed by one group on a single day, 27 April in the tracker we count from and 26 March in a second tracker (Case 2), and the two Libyan claims fall in April and June. If the second tracker's date is right, Q1 would be 9 and Q2 6. Morocco has claims in every quarter, 3, 5, and 5, while Tunisia's three Q2 claims are its last of the window. The tracker lists no new claim for the five countries between 26 September and 11 October.

The yearly bars are raw tracker counts, not the 20 cleaned claims used in the rest of this report. They show the tracker's 2026 entries to 11 October level with all of 2025, up from 9 in 2023. Because the earlier years were collected more thinly and the counts are not cleaned, we read the bars as a rising signal, not a measured growth rate. The 2026 bar is the same set as the 23 in-scope raw entries before we removed three filed under the wrong country, and it holds no October entry; after cleaning, 20 claims remain and the latest is dated 25 September. We found no official Maghreb statistics on ransomware incidents to set beside them, though Morocco's national cybersecurity directorate reports 879 cyber incidents of all kinds in 2025 (section 10).

3. The groups at a glance

Eleven groups made 20 claims. APT73 leads with four, all in one batch dated 27 April, or 26 March in a second tracker, and Qilin, Tengu, and The Gentlemen made three each. The other seven groups made one claim each. Ten of the 11 groups also appear in our French data, and together they made 19 of the 20 Maghreb claims. Only Stormous does not. So the Maghreb is a minor market for brands that work mostly in Europe and North America, not a home market for local operators.

The same groups in the Maghreb, France, and Türkiye

French and Turkish counts come from our France and Türkiye reports. Read the France report · Read the Türkiye report

4. Who is being hit

Our own classification of the 20 claims, using the tracker’s sector tags and correcting the few we could see were wrong. Each claim is counted once.

With so few claims, the mix is a signal and not a statistic. Business services lead at 25%: a customer-service outsourcing provider, two recruitment and staffing firms, an audit and accounting firm, and an advisory network. Manufacturing follows at 20%, from sanitary ware and engineering to a bus maker and a diversified Algerian group. Only 3 of the 20 name public bodies, but the forum market looks different (section 7): public bodies are the most common target in the posts we could see. Compared with Türkiye, where 39% of claims hit manufacturers, and France, where small firms and communes dominate, the Maghreb list is about services.

In the Maghreb the listed organization is often a middleman: a firm that holds other firms’ people and records.

5. Case files

Counts show the shape of the problem. Individual cases show how it works. Each case below states what was claimed, what the timing and structure suggest, and how far we trust it.

Case 1. The service layer: five firms, four groups

Claims. Five service firms were listed: an advisory and accounting network in Morocco (Tengu, 20 February), a customer-service outsourcing provider in Morocco (Qilin, 4 March), a Tunisian staffing firm (Titan, 14 April), a Moroccan audit and accounting firm (Qilin, 10 July), and a Moroccan recruitment agency formerly part of a global staffing brand (The Gentlemen, 14 August). Four different groups made the five claims. Outside our count, other listings name Maghreb sites of foreign-owned firms: one lists a German cable maker's plants, including a Tunisian one, with a claimed 1.1 TB across five sites, and another lists an outsourced support operation based in the Netherlands and Tunisia, with a claim of 86.7 million connection records.
Reading. These firms hold payroll, identity documents, contracts, and customer data for many clients, often in Europe, because the Maghreb is a large nearshore base for French-speaking customer service and staffing. A claim against the middleman can expose its clients without anyone touching their networks. That is a hypothesis, not a finding, and the foreign-owned cases are single listings with large claimed volumes that we could not verify.
Confidence. High that the listings exist. Moderate on the supplier-risk reading, which is our inference. Low on the volumes claimed for the foreign-owned sites.

Case 2. One day, four national institutions (APT73)

Claims. On 27 April APT73 listed four Moroccan names: a national television channel, a state-owned strategic-studies institute, the national telecom operator, and the audiovisual-communication regulator. A second tracker dates all four to 26 March.
Reading. Four national media, telecom, research, and regulatory bodies listed together by one brand look like a campaign aimed at visibility, and not at a ransom from a small firm. We hold no evidence of what, if anything, was taken, and no public response from any of the four. The conflicting dates between the two trackers show how much a single date in a leak-site record should be trusted: little.
Confidence. High that the listings exist. Low on the data, the motive, and the date.

Case 3. Libya: a central bank, an oil firm, and ports

Claims. Payload listed a Libyan petroleum company on 8 April, and Qilin listed the Central Bank of Libya on 22 June. The bank said on 30 June that it had rejected negotiation or payment, that no confirmed signs showed accounts, balances, or assets had been breached, that basic services kept running, and that the data may come from an earlier hacking operation. Libya's Internal Security Agency separately warned that some of the leaked files contain malware meant to infect whoever opens them, told people not to download files from untrusted sources, and said sharing the documents could carry legal liability. In the forum feed, one handle, EvaN47, made five of Libya's ten posts between 30 June and 24 September: a technical-education ministry, the foreign ministry, the ports company, the Red Crescent, and the national oil corporation.
Reading. Libya has few leak-site claims but a sustained forum campaign against state bodies and critical operators, at about one listing a week in September. The central bank's statement is a model of a measured answer: it denies what it could not confirm and does not deny that data was published. The malware warning adds a lesson for everyone: leaked files may carry malware, so open them only in an isolated environment. We do not know whether the forum posts and the ransomware claims are linked, and we do not link them.
Confidence. High on the listings and on the bank's public statement. Low on the data and on any link between the two sets.

Case 4. Morocco’s forum market: one handle, eight listings in ten days

Claims. Between 1 and 10 October one handle, Nameless511, posted eight Moroccan listings: a sports-retail chain, two ministry datasets and a journalists' file, a university, a computer retailer twice, a Moroccan hosting or e-commerce site, and a ministry of housing. Another handle, anisanas2, made 12 of Morocco's 80 posts, including a ministry of investment, a medical distributor, a delivery firm, and a classifieds site. A seller also listed a remote-code-execution and SQL-injection exploit for Moroccan targets on 10 September.
Reading. Morocco's market is dominated by a few prolific sellers who post often and cover public bodies and consumer sites. One listing of a ministry on 2 October was posted twice the same day by two handles, once on a forum and once on Telegram, which suggests reposting or competing claims, not two breaches. Several titles quote very large counts, such as one that reads “109,683K”, whose unit we cannot confirm, and we cannot check any of them. Some titles are mis-tagged: one listing filed under Morocco names a Mexican state economy office.
Confidence. High that the posts exist. Low that each describes a real, new breach.

Case 5. Handles that cross borders, and politics

Claims. At least five handles appear in more than one country: xNov (Morocco 7 posts, plus a Tunisian admin panel and an Algerian university), Keymous (Morocco 3, plus a Tunisian insurer), anisanas2 (Morocco 12, plus an Algerian research directorate), Infrastructure Destruction Squad (the Algerian defense ministry twice, plus a Libyan airline), and Elite Squad (a Libyan university and a Moroccan association). A family of handles built on the same root (dark07x, Dark07xx, dark07xxxx) appears in Algeria and Tunisia. The Algerian defense ministry was named four times in September by two handles, two posts each. On 24 September, the day after Morocco's 23 September legislative election, a handle named a listing about the elections. In April 2025, an Algerian hacker group called JabaRoot DZ claimed a large breach of Morocco's social-security fund, saying it was retaliating for a takeover of an Algerian news agency account, and published data on Telegram that researchers said covered about two million employees. Handles with similar names, jabaroot0 and Jabrooot, appear in 2026 listings.
Reading. Some handles recur in listings for more than one country, which does not prove they share operators or an organization, and listings cluster around political events and the Morocco–Algeria rivalry. We do not link the 2026 handles to the 2025 group, and we cannot say who sits behind any handle. A defense-ministry name in a listing may mean a real intrusion, an old leak, or a claim made for effect.
Confidence. High on the listings and on the public reporting of the 2025 breach. Low on actor identity and on links between handles.

Case 6. Tunisia’s telecom cluster, and limited visibility in Mauritania

Claims. Four of Tunisia's 17 forum posts, which the monitor dates from August 2025 to July 2026, name telecom or internet providers: two operators in August and September 2025 from one handle family, webmail access to two internet providers in July 2026, and an internet provider in March 2026. Other Tunisian listings name a justice ministry, an administration school, a ministry of vocational training, an insurer, a legal database, and a jobs site with 137,000 rows. For Mauritania the tracker lists no claim in the window and the monitor lists two posts, one naming a telecom and internet provider on 15 May 2026.
Reading. Selling webmail or account access at an internet provider is more serious than selling a leaked table, because the buyer can reuse it against the provider's customers. Mauritania's count is a measure of visibility, not of safety: few English-language profiles and few local reports mean few records, and a lack of listings does not prove a lack of incidents.
Confidence. High that the posts exist. Low on what any of them contains, and very low on Mauritania's real exposure.

6. Active threat actors: presence, motivation, and TTPs

Three selected actors, chosen for relevance to defenders and not by volume, made 10 of the 20 claims and are profiled below. Tengu has the same number of claims as two of them, but we hold less technical reporting on it than on these three. Their public technical detail comes from global incident reporting, not from the Maghreb cases, so read the tradecraft as known behavior of each group in general, not proof of what happened to a named firm. Technique IDs refer to MITRE ATT&CK.

Five actors with sufficient public technical reporting are shown, each with at least one Maghreb claim. Marks reflect public reporting on each group worldwide, not Maghreb incident evidence. An empty cell means the technique is not documented in the sources we reviewed, not that the group does not use it. APT73 has no column because we hold less public technical reporting on it.

Actor profiles

Other groups worth knowing

• Tengu (3). A newer RaaS brand that vendors say works through exposed remote services, valid accounts, and living-off-the-land tools. It listed an advisory network in Morocco on 20 February, an Algerian diversified group on 28 January, and a Moroccan sanitary-ware firm on 17 January.
• Krybit, LockBit 5.0, INC Ransom, and Payload (1 each). A Marrakech hotel group on 12 September (Krybit), an online sports store on 13 April (LockBit 5.0), a Moroccan pharmacy-related firm on 25 September (INC Ransom), and a Libyan petroleum company on 8 April (Payload).
• Arcus Media, Titan, and Stormous (1 each). Arcus Media listed a Moroccan engineering firm on 25 July. The tracker dates the RaaS brand to May 2024. Titan listed the Tunisian staffing firm on 14 April, and Stormous a Tunisian supermarket brand on 28 June, the only one of the 11 groups that does not appear in our French data.

7. Beyond the leak sites: the forum and hacktivist market

Ransomware crews post victims on their own sites. Everyone else posts on criminal forums and Telegram: data sellers, access brokers, hacktivists, and attention seekers. In the Maghreb this is the larger market. One commercial monitor lists 129 posts across the five countries under its country filter, covering about August 2025 to October 2026, against 20 leak-site claims in nine months. We could see details for 85 of the 129 posts: 36 of Morocco's 80 (35 after we excluded one filed under Morocco that names a Mexican office), all 20 Algerian, 17 Tunisian, and 10 Libyan posts, and both Mauritanian ones. The public-body counts in this report refer to those visible posts. We name no victims here, because the claims are unverified and naming a target may amplify an unproven claim.

The two columns cover different windows and are not comparable. The forum feed spans about August 2025 to October 2026.

What the market looks like

• Concentrated in Morocco, scattered elsewhere. Morocco's top five handles account for 35 of its 80 posts (44%): anisanas2 12, Nameless511 8, xNov 7, PKA291 5, and Keymous 3. In Algeria, Tunisia, and Libya no handle exceeds two posts, except EvaN47 with five of Libya's ten.
• Public bodies dominate the visible listings. In the listings we could see, 9 of 35 Moroccan posts (a mis-tagged Mexican item excluded), 12 of 20 Algerian posts, 5 of 17 Tunisian posts, and 5 of 10 Libyan posts name ministries, agencies, or public programs. Universities and schools add 3 for Morocco, 3 for Algeria, and 2 for Tunisia.
• Access as well as data. Titles offer a web shell and a firewall access on government domains, webmail access at internet providers, an admin panel, an exploit for sale, and a database of lawyers. Selling access is different from selling data: it can be used again.
• Large claimed volumes, possibly old data. Many titles state a record count, from 5,000 to 137,000 rows to six-figure thousands. Some are listings of old or aggregated data, and some are reposts of the same data by a second handle.

As elsewhere, data published by attackers may come from older leaks or several sources, and victims should qualify it before acting. For a ministry, a university, or a retailer, that means checking whether a sample matches current records, how old the fields look, and whether the poster is reselling something already public.

Confidence. That the posts exist: high. That each describes a real breach: low. That any maps to a ransomware incident: low. We cannot link any listing to any claim, and we do not.

8. Update outside the report window: October 2026

The tracker lists no new leak-site claim for the five countries after 25 September. The forum monitor shows 10 Moroccan listings from 1 to 10 October, eight of them from one handle (Case 4), and a Libyan ministry listing on 7 October. On 9 October the press reported the Qilin arrest relevant to our other reports, though it ties him to attacks on German companies, not to the Maghreb. None of these is in the 20.

9. How they get in

Leak sites show victims, not intrusions, so this section draws on public vendor reporting and on how the forum listings are titled. The consistent picture:

• Exposed web applications and administrative panels. Many forum titles name a site or a panel, and one offers an exploit for remote code execution and SQL injection. Public-sector web apps are the usual entry, and Morocco's cybersecurity directorate found 20 critical flaws in 76 public-sector web applications it audited between January and September 2025.
• Valid accounts and exposed remote services. Vendors describe Qilin, The Gentlemen, and Tengu affiliates working through VPN accounts, exposed remote services, and tools that blend into normal administration. A listing of a firewall access on government domains fits the same route.
• Bought access. Forum sellers offer webmail access, admin panels, and web shells at internet providers and ministries, and buyers can pick the target.
• Shared providers. Outsourcing, staffing, and advisory firms hold many clients' files, which is one hypothesis worth investigating among several.

10. The regulatory frame

The five countries differ widely, and we rely on public legal summaries, not on the official texts. Morocco: Law 05-20 on cybersecurity requires state administrations and entities of vital importance to report incidents to the national cybersecurity authority, the DGSSI, immediately, and in January 2026 the DGSSI said that many entities do not declare incidents systematically or on time, or are slow to provide the technical data it asks for, which weakens its view of the real threat, and urged systematic and immediate declaration. It reports 879 cyber incidents in 2025. Morocco’s personal-data law, Law 09-08, is overseen by the CNDP, and commentators say it does not require breach notification, though notifying is recommended. Algeria: Law 18-07 on personal-data protection was amended by Law 25-11 of 24 July 2025, which commentators say adds a 72-hour breach notice to the ANPDP, data protection officers, and impact assessments, and the national cybersecurity agency is the ASSI. Tunisia: Organic Law 2004-63 on personal data has no detailed breach-notification rule according to commentators, while the cybersecurity decree-law of 11 March 2023, in force from 11 September 2023, widened the powers of the national cybersecurity agency and, according to commentators, requires covered entities to declare incidents, though we did not check the specific article or which entities are in scope. Libya: there is no comprehensive data-protection law or authority, and the Cybercrime Law No. 5 of 2022 is criticized by rights groups. Mauritania: Law 2017-020 created a personal-data authority, constituted in 2022, and we could not confirm how fully it is applied. Take legal advice for any specific case. We are not lawyers.

11. Outlook for Q4 2026 and Q1 2027

These are our forecasts, not findings, and each rests on the data above.

1. The leak-site flow stays low, at 5 to 12 claims a quarter. The quarterly record has run 5, 10, and 5, and none was listed after 25 September. This is a qualitative scenario, not a statistical forecast. It assumes broadly stable collection coverage and attribution rules, and another batch like the four-in-a-day one would move it.
2. Service providers stay in the sights. Outsourcing, staffing, and advisory firms drew claims from four groups, so expect more from new brands as well, and more foreign-owned Maghreb sites to appear in listings.
3. Forum and hacktivist listings keep following the news. Morocco's post-election period, the Morocco–Algeria rivalry, and Libya's institutions are likely themes. A single prolific handle can add eight listings in ten days, so a quarter's count can swing on one person.
4. Libya's critical operators stay exposed with low visibility. The central bank, an oil firm, and the ports company are named in different sets, and the country has no data-protection regime to force disclosure.
5. Reporting duties become part of planning. Algeria's 72-hour notice is reported to be in force, Morocco's DGSSI asks for immediate declaration, and Tunisia's agency requires declaration, so groups operating in several countries need one playbook with several clocks.

12. What to do this quarter

1. Start with your network edge and your public web apps. Inventory every internet-facing VPN, firewall, remote-access gateway, webmail, and admin panel, and every public web application. Set a proposed internal target of 48 hours to patch actively exploited flaws, use compensating controls where patching cannot be immediate, and prioritize by confirmed exploitation, exposure, asset criticality, and vendor guidance.
2. Check whether your credentials are for sale. Search infostealer logs, combolists, and broker listings for employee and vendor accounts, including webmail, change the passwords of accounts whose credentials appear, revoke active sessions, and check for password reuse.
3. If you outsource to the region, ask your provider what it holds. Request MFA, EDR, and offline-backup evidence, limit the client data it keeps, and agree in advance how and when it will tell you about an incident.
4. Public bodies: audit before a forum does it for you. Test every public web application, remove default and test panels, and review who has access. Morocco's audits found 20 critical flaws in 76 applications, which is the scale to plan for.
5. Verify claimed data before you act. If your name appears with a record count, check where the data could come from, how old it is, and whether it matches your records, then decide on notification with your data-protection lead. Do not open leaked files on a normal workstation: Libya's Internal Security Agency warned that some files leaked from its central bank carry malware.
6. Set your reporting deadlines and escalation steps for every country you operate in. Know who reports to which authority, how fast, and who briefs the board, and rehearse a public statement as measured as the Libyan central bank's: deny what you cannot confirm, do not deny what is true.
7. Watch for your organization's name. Leak sites, Telegram channels, and broker forums may carry your data before you learn of a breach. Detection there can buy days.

Sources

• Ransomware.live, country victim records
• RansomLook, group and post records
• Teiss, Central Bank of Libya says data breach has been contained
• TelQuel, Cyberattaques en hausse : la DGSSI exige une déclaration immédiate des incidents
• ThreatCluster, citing Libya Herald, Malware found in alleged leaked data from the Central Bank of Libya
• Resecurity, Cybercriminals attacked the National Social Security Fund of Morocco
• CybelAngel, Escalating cyber hostilities in North Africa (CNSS breach update)
• Hespress, Morocco says 879 cyber-incidents reported in 2025 amid expanded audits
• Morocco World News, Morocco sets September 23 as date for parliamentary elections
• Regulations.ai, Morocco Cybersecurity Law 05-20
• CMS, Data protection and cyber security laws in Algeria
• InCyber, Tunisia expands scope of national cybersecurity agency
• Libya Law Society, Law No. 5 of 2022 on combating cybercrimes
• Proven Data, Qilin attack chain and MITRE ATT&CK TTPs

Sources are linked in their original language. The vendor forum feed we sampled is a commercial service and is not linked.