Cyber Threat Actor: Abdellah Elmaghribi

Abdellah Elmaghribi, also known by the alias Moroccan Wolf, is the individual identified in the public defacement of the Turkmen embassy website in Minsk. The defacement message explicitly credited him as the perpetrator and referenced an associate known as Moroccan Wolf, indicating that these aliases are used interchangeably in the actor’s public statements. The actor’s public claim of affiliation with the Islamic State Hackers, referred to in the defacement as El Moujahidine, establishes a clear link to that extremist group’s cyber wing. No other aliases or personal details are provided in the source material, so the profile is limited to these confirmed identifiers.

The actor’s known activity targeted a government diplomatic website, specifically the Turkmen embassy’s online presence located in Minsk, Belarus. The defacement replaced the site’s content with a black‑and‑white image of an armed individual and textual statements in English and Russian. The English message declared the site to be “in the service of the regime,” while the Russian text conveyed a similar accusation. The concluding line of the defacement read “#Struck by Abdellah Elmaghribi And Moroccan Wolf. By ISLAMIC STATE HACKERS (El Moujahidine) Your Security Get Owned,” which directly conveys an intent to disrupt the target’s online presence and to propagate propaganda associated with the Islamic State. No explicit financial or espionage motives are mentioned in the source; the observable objective is disruption coupled with ideological messaging.

The observed tactics consist solely of a website defacement that involved uploading an image and overlaying text; no malware families, exploit kits, or specific intrusion vectors are described in the available reporting. Consequently, no details about initial access methods, command‑and‑control infrastructure, or tooling can be supplied without speculation. Attribution to the Islamic State Hackers (El Moujahidine) is explicitly stated in the defacement message, providing a clear, publicly asserted affiliation with that extremist hacking collective. No state sponsorship or criminal consortium linkage is mentioned in the source material, so those aspects remain unspecified in this profile.

The most concrete and publicly reported operation attributed to this actor is the April 9 defacement of the Turkmen embassy website in Minsk, which resulted in the site being taken offline and replaced with the propagandistic image and text described above. This incident exemplifies the actor’s demonstrated capability to compromise government‑facing web assets and to use the compromised platform for ideological messaging. No further campaigns are detailed in the supplied material, so the profile is confined to this verified incident. This completes the factual threat actor profile based solely on the evidence provided.