Cyber Threat Actor: Moroccan Hassan

The threat actor known as Moroccan Hassan, also spelled Morocaan Hassan, operates from France. The actor publicly claims to be a member of a self‑styled “Moroccan deterrent force.” This self‑description appears in communications accompanying the defacement incidents. No further personal details such as age or real name are provided in the open sources.

In January 2015 the actor targeted hundreds of subdomains belonging to the French National Centre for Scientific Research (CNRS) and the charity Restaurants du Cœur. Specifically, 128 *.cnrs.fr subdomains and approximately twenty Restaurants du Cœur subdomains were altered. The modification consisted of uploading an HTML file named Mkd to each affected subdomain. The Mkd file displayed the actor’s group logo, the Moroccan flag, two war rifles and a textual message. The message included the statements “Je ne suis pas Charlie / Je ne suis pas terroriste / Je suis musulman et fier de l’être” and a quotation about a believer not eating while a neighbor is hungry. The actor framed the defacement as part of a broader cyber protest against French digital infrastructure that began earlier in January.

The activity was described as ideological messaging rather than an attempt to steal data or cause systemic disruption. No malware families, exploit kits, or specific initial access vectors were reported in the coverage of this incident. The actor’s tooling appears limited to website modification techniques, without evidence of more sophisticated payloads. No indication of financial gain, espionage objectives, or persistent access was mentioned in the sources.

The actor’s claimed affiliation with a “Moroccan deterrent force” remains an unverified self‑statement, with no evidence linking the group to a state sponsor or criminal organization. No other campaigns or operations have been publicly attributed to Moroccan Hassan beyond the January 2015 defacement. Consequently, the known activity consists of this single, ideologically motivated website defacement event targeting French research and charitable organizations.