Skip to content
Cyber Threat
CTI Academy Sponsor CTI Academy
MA

Ransomware attacks in Morocco

29 organisations in Morocco have been listed on ransomware leak sites, ranking #54 worldwide. Updated .

Victims
29
0.1% of global total
Global rank
#54
of 180 countries
Active groups
16
Most: Apt73
Sectors
15
Most: Business Services

ThreatAI analysis

Compiled from this database and the ransomware.live profiles of the groups active in Morocco. Figures are computed from the tracked records, not inferred.

Morocco sees 29 ransomware attacks recorded, ranking 54th globally; most active groups include Apt73, Tengu, Qilin targeting sectors like Business Services and Manufacturing.

Morocco in the global picture

Morocco accounts for 29 of the ransomware disclosures tracked here, ranking #54 worldwide and making up 0.1% of the global total. The sectors listed most often are Business Services, Manufacturing, Consumer Services.

Who is most active in Morocco

Apt73 — 4 victims in Morocco. Tengu — 4 victims in Morocco. Qilin — 3 victims in Morocco. Qilin ransomware was first observed in July of 2022.

Ransomware threat profile: Morocco

Morocco ranks #54 worldwide for ransomware disclosures, with 29 victims in this database — 0.1% of the global total. The groups listing the most organisations here are Apt73, Tengu and Qilin.

The most frequently listed industries in Morocco are Business Services, Manufacturing, Consumer Services. Healthcare is especially exposed: an outage at a hospital or clinic can put patients at risk, which raises the pressure to pay quickly.

The volume reflects Morocco's integration into the global economy and the reach of ransomware operations that target organisations of every size. Organisations here should weigh the active groups documented on this page when prioritising detection rules and incident-response planning.

Victims in Morocco 29

Organization Disclosed
Eurogate Tanger (container terminal operations)
N0n
CNESTEN
Qilin
pharma5.ma
Incransom
pharma5.ma
Incransom
lasultanahotels.com
Krybit
lasultanahotels.com
Krybit
Avanta Maroc Ex Adecco
Thegentlemen
Brazer Ingenierie
Arcusmedia
Eurodefi
Qilin
planetsport.ma
Lockbit5
2m.ma
Apt73
haca.ma
Apt73
iam.ma
Apt73
ires.ma
Apt73
Outsourcia
Qilin
www.shora.ma
Tengu
Nafae Sanitaire S.a.r.l
Tengu
www.marjane.ma
Stormous
DOVERN Import
Spacebears
Le MULTI LABORATOIRE LC2A
Tengu
STAR LÉGUMES
Tengu
LA VOIE EXPRESS
Medusa
Dolidol
Thegentlemen
Best Profil
Lynx
MTTEXPERTISES.COM
Incransom
askgs.ma
Ransomhub
www.usmba.ac.ma
Gdlockersec
seocommarrakech.com
Funksec
SM EMBALLAGE
Spacebears

Frequently asked questions

How many ransomware attacks have occurred in Morocco?

Morocco has recorded 29 ransomware victim disclosures in this database, ranking #54 globally. This represents 0.1% of all tracked ransomware attacks worldwide.

Which ransomware groups target Morocco?

The ransomware groups most active in Morocco are Apt73, Tengu, Qilin, Incransom. These groups collectively account for the majority of victim disclosures attributed to Morocco.

Which industries are most targeted by ransomware in Morocco?

In Morocco, the most frequently targeted sectors are Business Services, Manufacturing, Consumer Services. These industries hold valuable data and often have critical operational requirements that make them attractive ransomware targets.

How does Morocco rank globally for ransomware attacks?

Morocco ranks #54 globally for ransomware attacks with 29 victim disclosures, representing 0.1% of the worldwide total of 23,595 tracked victims.

How can organisations in Morocco protect against ransomware?

Organisations in Morocco should implement a layered security approach including regular offline backups, network segmentation, multi-factor authentication, endpoint detection and response (EDR) tools, and employee security awareness training. Monitoring threat intelligence feeds for active groups targeting Morocco is also recommended.