Cyber Threat Actor: Mauritania Attacker

The threat actor known as Mauritania Attacker operates under the alias Anon Ghost, identifying as a pro-ISIS hacktivist collective. This group publicly distanced itself from the broader Anonymous movement while aligning its activities with ideological support for Islamic State propaganda. Their operations emphasize symbolic disruption over financial gain or data theft, focusing on public demonstrations of capability and allegiance to specific geopolitical causes. The group explicitly framed its actions as opposition to Zionism and Israel while expressing solidarity with global movements it characterized as freedom struggles.

Mauritania Attacker's confirmed targeting centers on government entities in Southeast Asia, specifically demonstrated through their compromise of Malaysian law enforcement social media infrastructure. Their strategic objective involves disrupting official communications channels to disseminate militant imagery, threatening messages, and Arabic-language declarations supporting ISIS. Tactics include account takeover through unspecified credential compromise, defacement of profile elements with jihadist symbolism, and coordinated propaganda distribution across platforms like Facebook and Twitter. The group leaves deliberate identifiers such as "#AnonGhost was here" to claim responsibility while avoiding attribution to other hacktivist collectives.

Public reporting links Mauritania Attacker to a July 2015 operation against Malaysian Police accounts, which served as both a capability demonstration and ideological statement. During this incident, they replaced official profile pictures with ISIS-affiliated graphics and posted militant photographs alongside threats directed at government personnel. Restoration of compromised accounts occurred following the breach, indicating the operation's primary impact was temporary disruption rather than persistent access. The group's affiliation with pro-ISIS narratives is explicitly stated in their communications, though no deeper organizational structure or state sponsorship is evidenced in available disclosures. Their operations reflect a focus on low-complexity attacks achieving high-visibility psychological effects aligned with extremist propaganda objectives.