Moroccan Hassan

Profile narrative

Moroccan Hassan, also referenced as Morocaan Hassan, is the alias used by a hacktivist who has claimed to be a young internet user from France and to belong to a self‑described “Moroccan deterrent force.” The actor’s public statements emphasize Muslim identity and frame the actions as a response to perceived disrespect toward Islam, while explicitly denying any connection to terrorism. No further personal details such as age, real name, or formal organizational ties have been disclosed in open sources.

The actor’s known activity has focused on French digital assets, specifically targeting the Centre Nationale de Recherche Scientifique (CNRS) and the charitable organization Les Restaurants du Cœur. These targets represent the research and humanitarian sectors, and the attacks were confined to subdomains within the .cnrs.fr and restaurant‑du‑cœur.fr domains. The stated objective appears to be ideological messaging rather than financial gain, espionage, or large‑scale systemic disruption, as the actor sought to convey religious pride and protest perceived slights against Islam through the defaced content.

The technique observed in the 2015 incident involved website defacement by uploading an HTML file named “Mkd” that displayed the actor’s group logo, the Moroccan flag, images of firearms, and textual messages advocating religious peace and social justice. No specific malware families, exploit kits, or initial access vectors were described in the reporting, so the exact method of gaining control over the subdomains remains unspecified. The operation was presented as part of a broader series of cyber manifestations aimed at French online infrastructure that began in early January 2015, indicating a pattern of coordinated, message‑driven actions rather than isolated, financially motivated intrusions.

The most prominently documented campaign occurred on 28 January 2015, when Moroccan Hassan defaced approximately 128 CNRS subdomains and around twenty subdomains of Les Restaurants du Cœur, replacing their legitimate content with the Mkd file. This action was framed as participation in a protest movement that had been active since 9 January 2015, underscoring the actor’s intent to use web defacement as a platform for ideological expression. No additional campaigns or attributable incidents have been publicly attributed to this alias in the available sources.

Incidents

Attributed incidents are available to members.