Introduction
We’ve been keeping a close eye on a politically motivated hacktivist group called Anonymous Moroccan. On July 12, 2025, they pulled off a surprising cyberattack - not on a neighboring country, but on valutazioneimmobile.online, a real estate website based in Italy.
At first, this might seem random. Morocco and Italy don’t exactly have a history of cyber conflict. But when you connect the dots , especially with the group’s earlier attacks on Algerian government websites , a bigger picture starts to form. One that mixes digital protest, regional politics, and strategic targeting.
The July 12 Incident: A Message Disguised as a Breach
On July 12, valutazioneimmobile.online, a digital platform for property buying and renting in Italy, was taken offline and defaced by Anonymous Moroccan.
The group didn’t just stop at DDoS or defacement. In a bolder move, they claimed to have exfiltrated and leaked sensitive user data including credentials, personal information, and financial records onto the dark web. While the full scope of the breach is still under investigation, the leaked data was allegedly published on DarkForums, a known hub for dark web leaks. If true, the impact could range from identity theft to financial fraud for users of the platform.
In their message, Anonymous Moroccan accused Italy of "corruption and injustice" and hinted that the hack was part of a broader campaign.
That raised an important question:
Why would a Moroccan-aligned threat actor go after an Italian real estate portal?
Following the Pattern: The June 23 Algerian Attacks
To find answers, we examined Anonymous Moroccan’s previous operations. Just a few weeks earlier on June 23, 2025 . The group launched a coordinated cyber assault on three Algerian government websites:
Target 1: The Presidential Portal – El Mouradia
On June 22, 2025, Anonymous Moroccan launched a DDoS attack on the official website of the Algerian Presidency commonly known as El Mouradia. This site represents the executive power in Algeria, making it one of the most symbolically important targets the group could have chosen.
They described the attack as a direct response to what they called “hostile and ongoing actions” by the Algerian regime against Morocco’s territorial integrity , a clear reference to the long-standing dispute over Western Sahara.
The group claimed their goal was to expose the fragility of Algeria’s digital infrastructure, framing the attack as a cyber message that sovereignty isn’t just about borders anymore , it’s about cyberspace too.
Claimed Impact
- Full disruption of the presidential site and its affiliated portals, including the Mediation Authority and National Health Security Agency.
- Loss of access to citizen services and official communication channels.
- A clear symbolic statement: “El Mouradia is now under digital surveillance.”
The attack was carried out using a custom-configured botnet, according to the group, designed specifically to overwhelm and disable the site. They were careful to note that no citizen data was touched, emphasizing that this was a political operation, not a personal one.
Target 2 : General Directorate of Public Service – dgfp.gov.dz
Also on June 22, 2025, Anonymous Moroccan executed another DDoS attack. This time against the General Directorate of Public Service in Algeria, known as DGFP. This institution handles key administrative and employment-related services for Algerian citizens, making its disruption both strategic and symbolic.
The group framed this as part of their ongoing digital retaliation campaign against what they call “systematic Algerian hostility” toward Morocco.
Why DGFP?
According to the group’s statement, the reasons for targeting DGFP included:
- Official Algerian statements that, in their view, challenged Morocco’s sovereignty.
- Alleged attempts to destabilize the region and “sow division” within Moroccan society.
- A clear message: Morocco is not digitally defenseless , in fact, the group claims to hold a dominant position in the cyber domain.
Claimed Impact
- The site dgfp.gov.dz was taken fully offline, rendering it inaccessible to public employees and citizens alike.
- Administrative functions related to Algeria’s public service sector were disrupted.
- The group claimed the attack caused confusion and delays among users and government staff relying on the platform.
Their final warning in this communiqué was blunt:
“Any official institution representing your regime is a potential target as long as the provocations continue. Morocco has its men — on the ground and in cyberspace.”
Target 3: National Office of Fishery Products – onplc.dz
The third coordinated attack on June 22, 2025, targeted the National Office of Fishery Products (ONPLC) a lesser-known but strategically significant Algerian institution tied to the country’s maritime economy.
While not as politically symbolic as the presidential website, ONPLC represents a critical infrastructure point within Algeria’s economic ecosystem. And that’s exactly why Anonymous Moroccan says they went after it.
Why ONPLC?
In their statement, the group outlined three key motives:
- It’s a state-run entity tied to a strategic sector fisheries and maritime products which they claim can be easily digitally crippled.
- They wanted to prove that no institution is beyond their reach, no matter how big or small.
- The goal was to broaden the pressure by disrupting Algeria’s electronic fabric in multiple areas at once.
Claimed Impact
- The ONPLC website was taken completely offline, halting all digital services linked to Algeria’s fisheries sector.
- The attack interrupted internal tracking, reporting, and administrative functions within the office.
- It caused confusion across operational workflows, with staff reportedly unable to access or manage systems.
So Where Does Italy Fit In?
Italy isn't a direct opponent of Morocco , but geopolitics is rarely that simple.
In recent years, Italy has deepened its strategic and energy partnership with Algeria, especially after the Russia–Ukraine war. Italy now relies on Algerian gas, and the two countries have held numerous bilateral meetings and diplomatic exchanges.
To Anonymous Moroccan, this kind of alignment might be interpreted as indirect support for Algeria, Morocco’s regional rival. Italy is also a NATO member, further complicating perceptions in North Africa about alliances and interference.
Anonymous Moroccan may be framing Italy not as a primary target, but as collateral in a broader campaign a warning to states that choose to side with Algeria in the diplomatic and energy arenas.
Final Thoughts: What Comes Next?
Anonymous Moroccan has shown a clear evolution in its targeting:
Algerian government institutions (June 23) — symbolic DDoS, no data theft.
Italian business platform (July 12) — DDoS, political messaging, and alleged data leak.
This shift suggests that the group is willing to escalate , moving from protest-style attacks to potentially more aggressive operations involving sensitive data.
.png)
