Cyber Threat Actor: Moroccan Islamic Union-Mail

Thethreat actor referenced in the source material identifies itself as the Moroccan Islamic Union‑mail, a name that explicitly includes a Moroccan reference. The group is described by a source as consisting of young men who wear black T‑shirts and conceal their faces with masks. No public statement links the organization to a state sponsor or to a known criminal consortium; the only affiliation asserted is the self‑described Moroccan Islamic Union‑mail identity. The alias appears in the reporting as the sole name used by the actors when claiming responsibility for their activities. No additional aliases or alternative designations are mentioned in the source material.

The group’s observed activity consists of website defacements, specifically the takeover of a maritime organization’s homepage where they displayed an image of a soldier’s grave accompanied by a message written in Arabic. This defacement represents a website‑alteration tactic, which the actors have claimed to repeat in a series of similar online attacks. The targeting described in the source is limited to the maritime sector, as the compromised homepage belonged to a maritime entity. No explicit geographic focus beyond the group’s self‑identified Moroccan affiliation is stated in the material. The actors have not been associated with any particular malware family, exploit kit, or specific initial‑access technique in the reported coverage. Their method, as described, relies on gaining unauthorized access to web servers to replace content with political imagery and text.

The most concrete operation detailed in the source is the hijacking of the maritime homepage, which featured a grave image and an Arabic‑language statement and was publicly claimed by the Moroccan Islamic Union‑mail as part of a broader pattern of similar defacements. The actors have asserted responsibility for a series of comparable online attacks, indicating a repeated use of the website‑defacement approach. No further details about the scope, duration, or impact of this series are provided in the source material. The profile therefore reflects only the facts explicitly presented: a self‑identified Moroccan Islamic Union‑mail group conducting website defacements, with a demonstrated focus on maritime‑sector targets and a claim of responsibility for multiple similar incidents. No additional information about motives, sponsorship, size, or technical capabilities is available from the source.