GINC-APT-0805 · State

Jabaroot

Also Jabaroot DZ.

Category
State · Attributed to a state or working for one.
Origin
Algeria(medium confidence)
Sources
3 sources carry it
Identifier
GINC-APT-0805 · jabaroot

What it is

JabaRoot is an Algerian hacker group that has targeted Moroccan government systems, successfully exfiltrating sensitive data from the Ministry of Economic Inclusion and the National Social Security Fund (CNSS). The group has claimed responsibility for the breach, which has raised concerns among cybersecurity experts regarding its scale and impact on citizens' privacy. The motives behind the attack remain unclear, but it has been noted as one of Morocco's most significant cyber-attacks affecting multiple victims. Resecurity has identified the group's activities as part of a broader trend of APT targeting government entities in the region.

Names

The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.

Other names
Jabaroot DZ

Attribution

Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.

Western sources

Tools

The tools and malware families the sources tie to it.

  • Cyber Eye RAT
  • CyberGate
  • Xpert

Sources

  • Malpedia malpedia.caad.fkie.fraunhofer.de