GINC-APT-0850 · State

MORH4x

Category: State · Attributed to a state or working for one.
Origin: Morocco(high confidence)
Sources: 3 sources carry it
Identifier: GINC-APT-0850 · morh4x

What it is

MORH4x is a self-proclaimed Moroccan hacking group that claimed responsibility for a data leak from Algeria's pharmaceutical industry ministry. The group announced the breach on the BreachForums website, stating that the leaked files span from 2019 to 2025 and include internal documents related to Algeria's pharmaceutical imports. This incident is part of a series of escalating cyberattacks between Moroccan and Algerian hacking groups.

Attribution

Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.

Western sources

MISP Galaxy (CFR tagging)Morocco
ThreatActor.info (Malpedia et al.)Morocco

Tools

The tools and malware families the sources tie to it.

Cyber Eye RAT
CyberGate
Hacking Team UEFI Rootkit

Sources

Malpedia malpedia.caad.fkie.fraunhofer.de