Morocco
MARansomware victim intelligence profile · Ranked #55 globally · Updated: May 12, 2026
Ransomware Threat Profile: Morocco
Morocco ranks #55 globally for ransomware attacks, with 20 confirmed victims in this database — representing 0.1% of the worldwide total. The most active ransomware groups targeting Morocco include Apt73, Tengu, Spacebears.
The most frequently targeted industries in Morocco are Business Services, Consumer Services, Manufacturing. Manufacturing organisations are attractive targets because production downtime directly impacts revenue, creating strong incentives to restore operations by paying the ransom.
Morocco's attack volume reflects broader trends in ransomware targeting: the volume of attacks reflects the country's integration into the global economy and the proliferation of ransomware operations that target organisations of all sizes worldwide.
Organisations in Morocco should consider the active threat groups documented here when assessing their cybersecurity posture, implementing detection rules, and prioritising incident response planning.
Recent Victims in Morocco (20 cached of 20 total)
| # | Organization | Group | Sector | Date |
|---|---|---|---|---|
| 1 | planetsport.ma | Lockbit5 | Consumer Services | Apr 29, 2026 |
| 2 | haca.ma | Apt73 | Public Sector | Apr 27, 2026 |
| 3 | iam.ma | Apt73 | Technology | Apr 27, 2026 |
| 4 | ires.ma | Apt73 | Public Sector | Apr 27, 2026 |
| 5 | 2m.ma | Apt73 | Telecommunication | Apr 27, 2026 |
| 6 | Outsourcia | Qilin | Business Services | Mar 4, 2026 |
| 7 | www.shora.ma | Tengu | Business Services | Feb 20, 2026 |
| 8 | Nafae Sanitaire S.a.r.l | Tengu | Business Services | Jan 17, 2026 |
| 9 | www.marjane.ma | Stormous | Consumer Services | Nov 6, 2025 |
| 10 | DOVERN Import | Spacebears | Consumer Services | Nov 4, 2025 |
| 11 | Le MULTI LABORATOIRE LC2A | Tengu | Manufacturing | Oct 24, 2025 |
| 12 | STAR LÉGUMES | Tengu | Agriculture and Food Production | Oct 23, 2025 |
| 13 | LA VOIE EXPRESS | Medusa | Transportation/Logistics | Oct 14, 2025 |
| 14 | Dolidol | Thegentlemen | Manufacturing | Sep 9, 2025 |
| 15 | Best Profil | Lynx | Business Services | Jun 6, 2025 |
| 16 | MTTEXPERTISES.COM | Incransom | Technology | Jun 6, 2025 |
| 17 | askgs.ma | Ransomhub | — | Feb 12, 2025 |
| 18 | www.usmba.ac.ma | Gdlockersec | Education | Jan 24, 2025 |
| 19 | seocommarrakech.com | Funksec | Business Services | Jan 11, 2025 |
| 20 | SM EMBALLAGE | Spacebears | Manufacturing | Apr 29, 2024 |
Frequently Asked Questions
How many ransomware attacks have occurred in Morocco?
Morocco has recorded 20 ransomware victim disclosures in this database, ranking #55 globally. This represents 0.1% of all tracked ransomware attacks worldwide.
Which ransomware groups target Morocco?
The ransomware groups most active in Morocco are Apt73, Tengu, Spacebears, Lockbit5. These groups collectively account for the majority of victim disclosures attributed to Morocco.
Which industries are most targeted by ransomware in Morocco?
In Morocco, the most frequently targeted sectors are Business Services, Consumer Services, Manufacturing. These industries hold valuable data and often have critical operational requirements that make them attractive ransomware targets.
How does Morocco rank globally for ransomware attacks?
Morocco ranks #55 globally for ransomware attacks with 20 victim disclosures, representing 0.1% of the worldwide total of 17,791 tracked victims.
How can organisations in Morocco protect against ransomware?
Organisations in Morocco should implement a layered security approach including regular offline backups, network segmentation, multi-factor authentication, endpoint detection and response (EDR) tools, and employee security awareness training. Monitoring threat intelligence feeds for active groups targeting Morocco is also recommended.