April 8, 2025. Actor “Jabaroot” dumps Morocco’s entire National Social Security Fund (CNSS) database. No ransom, just a straight 549MB archive containing the financial DNA of an entire nation.

The package:

A

We’re looking at the complete financial infrastructure of Morocco laid bare. Royal Air Maroc employees, Attijariwafa Bank staff, workers from Siger (the King’s personal holding company), even members of the royal household all their financial details sitting in a password-protected archive with the password “jabaroot”.

The actor posted it straight to BreachForums and Telegram under the headline “Morocco National Social Security Fund (CNSS) FULL DATABASE LEAKED 2025.” No demands, no negotiations. This is economic warfare with a hacktivist mask.

Authenticity Verification

First question with any leak this size: is it real or fabricated garbage? After pulling apart the archive, this is definitely the real deal.

Archive Breakdown:

Validation:

Every PDF in this dump was generated between November 19-23, 2024, during Moroccan business hours (CET timezone). The metadata is consistent across all files:

$ exiftool dump/**/*.pdf | grep -Ei 'Creator|Producer|Create Date'
Creator: JasperReports Library version 6.6.0
Producer: iText 2.1.7 by 1T3XT
Create Date: 2024:11:23 22:35:23+01:00
Modify Date: 2024:11:23 22:35:23+01:00

JasperReports 6.6.0 and iText 2.1.7 older Java reporting tools still common in government finance. The timestamps span four days, hinting at automated batch exports from an internal reporting setup.

Hash Analysis:

$ find dump -type f -exec shasum -a 256 {} \; > hashes.txt
$ cat hashes.txt | uniq -d
# [no output - every file is unique]

Zero duplicate hashes across 53,000+ files. Each PDF was individually rendered with unique data - impossible to fake at this scale. This confirms access to the actual generation layer, not just static file exports.

File Naming Pattern: PDFs follow sequential numeric naming from 67.pdf up to 160021766.pdf. No randomness, no gaps in the sequence classic database auto increment behavior. The CSV files contain matching record IDs that correlate perfectly with the PDF filenames.

Archive Metadata:

$ 7zz l 'CNSS - Moroccan National Social Security Fund.7z' | head -15
   Date      Time    Attr         Size   Compressed  Name
2024-11-30 00:00:05 D....            0            0  ATTESTATIONS SALARIES DECLARES
2025-04-08 10:45:52 ....A    337544633    575112208  ADHERENTS.csv
2024-11-22 19:33:06 ....A       108747               ATTESTATIONS SALARIES DECLARES/100000.pdf

The CSV export timestamp (April 8, 2025 10:45:52) matches exactly when Jabaroot posted the leak. Someone exported this data specifically for the dump, then packaged it immediately for release.

This isn’t scraped web data or reconstructed information. This is a direct export from CNSS’s internal database and reporting infrastructure.

Data Structure: The leak contains two primary datasets with complete financial and personal information:

ADHERENTS.csv (337MB, ~2M records): Each employee record contains:

SALARIES.csv (Company records, ~500k entries): Each company record exposes:

PDF Payslips (53,000+ individual files): Each PDF contains a complete salary breakdown:

The data structure reveals this came from a Java-based reporting system (JasperReports) with direct database access. Field names, data types, and relational structure all point to internal CNSS taxonomy not external scraping or third-party integration.

Threat Actor: “Jabaroot”

Operational Tradecraft

The attack methodology shows competent but not sophisticated tradecraft. Just opportunistic exploitation of weak security controls.

Initial Access Vector: The data volume and export format strongly suggest legitimate credential access or exploitation of an unpatched internal server. The ability to generate 53,000+ individual PDFs through JasperReports indicates access to the actual reporting infrastructure, not just database dumps.

Looking at the timeline:

This 4-month gap between data generation and release suggests:

  1. Compromise of backup/archive systems containing November data

Collection and Staging: The actor had access to multiple CNSS systems:

The sequential PDF naming (67.pdf to 160021766.pdf) and perfect correlation with CSV record IDs indicates systematic, automated collection not manual cherry-picking.

Exfiltration and Distribution: Multi-stage release strategy designed for maximum impact:

  1. Initial Hosting: Archive uploaded to BiteBlob file-sharing service
  2. Credibility Building: Posted teaser screenshots on BreachForums
  3. Primary Distribution: Telegram channel “JabarootDZ” with 9,000+ subscribers
  4. Amplification: Cross-posted to multiple underground forums and channels

OpSec Assessment:

The OpSec profile suggests an hacktivist rather than state-sponsored operator competent enough to avoid immediate attribution but not sophisticated enough to eliminate all traces.

Attribution Analysis

The geopolitical messaging throughout this campaign points clearly toward Algerian-aligned actors, but the technical indicators tell a more complex story.

Primary Persona: “Jabaroot”

Secondary Alias: “3N16M4”

Geopolitical Messaging:

Ar

The now-deleted Telegram post (hxxps[://]t[.]me/JabarootDZ/42) contained explicit political framing:

الجزائر خط أحمر
Algeria is a red line

مجموعة جبروت تعلن اختراق أنظمة وزارة العمل المغربية والحصول على بيانات هامة.
Jabaroot Group announces the breach of Moroccan Ministry of Labor systems and the acquisition of sensitive data.

هذا الإختراق جاء كرد على التحرشات المغربية بصفحات مواقع التواصل الإجتماعي الخاصة بالمؤسسات الرسمية الجزائرية.
This breach comes as a response to Moroccan harassment campaigns on social media targeting official Algerian institutions

Website Defacements: The actor also defaced miepeec.gov.ma (a Ministry-affiliated site) with the same “الجزائر خط أحمر” message at 16:29. Although not directly linked to CNSS, this shows wider reconnaissance and access within the gov.ma infrastructure.

Operational Timeline:

Indicators:

Assessment:

This appears to be a multi-national North African hacktivist operation with the following likely structure:

The pattern fits classic regional proxy warfare: actors aligned with state interests yet acting independently. The four-month gap between data collection (November 2024) and release (April 2025) hints at coordination amid rising geopolitical tensions.

Attribution Confidence: Medium-High for Algerian alignment, Medium for specific actor identification. The geopolitical messaging, linguistic patterns, and target selection strongly indicate Algerian-sponsored or aligned activity, but technical attribution to specific individuals remains speculative based on available OSINT.

The Broader Attack Surface: Gov.ma Infrastructure

The CNSS breach is just one piece of a bigger picture a sign of deep security gaps across Morocco’s entire gov.ma network. The same actor showed access to multiple government sites, exposing a broad and persistent vulnerability.

Case Study: miepeec.gov.ma Compromise

During the same timeframe as the CNSS leak, Jabaroot defaced miepeec.gov.ma (Ministry of Equipment and Water-affiliated site) with their signature “الجزائر خط أحمر” message. But the defacement was just the visible tip of a much deeper compromise.

Timeline Analysis:

Assessment: Even after the front-end takedown, directory paths like /wp-content/Upload remained browsable. Live reconnaissance revealed:

# Example of exposed directory structure
/wp-content/uploads/2019/
/wp-content/uploads/2020/
/wp-content/uploads/2021/
# ... continuing through 2024

Sensitive documents dating back to 2019 were still downloadable without authentication:

Security Failures Identified:

Systemic Infrastructure Problems This pattern repeats across dozens of gov.ma domains. Basic reconnaissance reveals:

Common Vulnerabilities:

Operational Security Gaps:

The Reconnaissance Goldmine

For an attacker like Jabaroot, this infrastructure represents a target-rich environment where sophisticated techniques aren’t necessary. Basic automated scanning tools can identify:

The miepeec.gov.ma compromise demonstrates that Jabaroot didn’t need skills to access CNSS - they just needed patience and awareness of where no one was watching. When dozens of government domains exhibit the same security hygiene failures, attackers don’t need to target specific systems. The targets present themselves.

Infrastructure Assessment:

The gov.ma ecosystem suffers from:

This creates an environment where a single compromised credential or unpatched vulnerability can provide access to multiple government systems, explaining how Jabaroot could move from website defacements to complete database exfiltration.

Impact Assessment

This leak enables multiple attack vectors:

Financial Fraud: Real SSNs + exact salaries + bank details = high-success phishing campaigns. Scammers can reference actual pay dates, amounts, and departmental codes.

Identity Theft: Complete PII packages for 2M+ individuals. Perfect for synthetic identity schemes.

Economic Manipulation: Selective data releases targeting specific sectors (banking, aviation, logistics) to influence markets or create operational chaos.

Political Warfare: Gradual leaking of high-ranking officials’ payslips to erode government trust and feed disinformation campaigns.

The lack of ransom demand suggests purely disruptive intent - classic state-sponsored proxy behavior.

Oracle Cloud Connection?

No evidence linking this to recent Oracle breaches. CNSS absent from Oracle customer lists, different infrastructure signatures, and internal taxonomy suggests local system compromise.

The Response (Or Lack Thereof)

CNSS finally issued a damage control statement claiming leaked documents were “misleading, inaccurate, or incomplete.” Classic bureaucratic deflection that addresses nothing.

Z

Reality check: The data is out there. BiteBlob takedowns are meaningless when the archive has already propagated through mirrors, private channels, and scraper bots.

What’s Coming:

Lessons Learned

This breach wasn’t sophisticated. It exploited basic security failures:

The Fix:

Security is an ecosystem you grow, not a product you buy.

B

Analysis based entirely on open-source intelligence. Attribution assessments are preliminary and should be treated as working hypotheses, not definitive conclusions.