Cyber Threat Actor: Mormoroth

Mormoroth, also known by the alias Mourner, is an Iranian hacker who came to public attention in February 2014 after compromising the Network Information Center of Paraguay (nic.py). The actor operates under the online moniker Mormoroth and has been linked to a single publicly reported intrusion that targeted Paraguay’s domain name registry. No further biographical details, such as age, affiliation, or broader operational history, are available in the open sources referenced here.

In the NIC.py breach, Mormoroth exploited a remote code execution vulnerability to gain access to the registry’s backend systems, noting in a blog post on ha.cker.ir that inappropriate directory permissions allowed unrestricted browsing and file reading without needing full server control. The actor used a localroot exploit to obtain root privileges, copied data from the server, and then altered the DNS records for google.com.py to redirect visitors to a defacement page rather than compromising Google’s own infrastructure. Mormoroth subsequently leaked user credentials and other internal data after Paraguayan authorities initially denied the breach, despite prior warnings from a cybersecurity expert about the unaddressed flaw. The actor’s tooling style, as described, relied on exploiting existing misconfigurations and publicly available exploit code rather than deploying custom malware.

Public attribution of Mormoroth to a state sponsor, criminal consortium, or any larger group has not been established in the available reporting, and no additional campaigns or operations have been definitively linked to this alias. Consequently, the actor’s typical targets, sectors, geographic focus, and strategic objectives—whether financial, espionage‑oriented, or disruptive—remain unspecified in the documented record. The profile is therefore limited to the confirmed facts surrounding the 2014 NIC.py intrusion, the associated TTPs, and the actor’s known aliases and Iranian location.