Cyber Threat Actor: Jihadists

The threat actor isknown by several aliases including Jihadists, Jihadi, Islamic Extremists, Jihadis, and Mujahideen, and operates primarily within Mozambique. Public reporting links the group to the Islamic State, noting its connection to the violent insurgency that has persisted in the country’s northern Cabo Delgado region. The actor’s location and affiliations are therefore tied to extremist militant activity rather than to a state sponsor or criminal consortium. No further details about its internal structure, size, or resources are provided in the available sources.

In February 2022 the actor compromised a Mozambican government web portal, conducting a web defacement that replaced official content with imagery associated with jihadist militants. The attack forced authorities to take the server offline temporarily, disrupting public access to government services and demonstrating a capability to target governmental online infrastructure in the region. By inserting jihadist symbolism the defacement served a propaganda purpose, amplifying the actor’s ideological message while simultaneously causing operational disruption. This incident illustrates the actor’s use of website defacement as a tactic to achieve both visibility and interference, reflecting the broader extremist objectives observed in the Cabo Delgado insurgency. No specific malware families, initial access vectors, or tooling styles are described in the reported event, and no financial or espionage motives are indicated. The profile remains confined to the confirmed facts of the defacement operation and the actor’s stated extremist affiliation.