I. Timeline of Events: From the CNSS to the Justice System
April 8, 2025 — The First Shockwave: The CNSS in the Crosshairs
It was that night that the group calling itself Jabarootleaked thousands of files attributed to the National Social Security Fund (CNSS). These documents — pay slips, identification, contact information — are aimed at exposing the incomes of citizens and businesses.
The leak affects about two million insured individuals according to some estimates. A few days later, the Telegram channel used by the group is deactivated, after causing panic on social media.
The Moroccan authorities react quickly: a judicial investigation is launched and the General Directorate for Information System Security (DGSSI) is mobilized.
June 2, 2025 — Claim Against the Land Registry System
Less than two months after the CNSS attack, Jabaroot announces it has infiltrated the National Agency for Land Conservation, Cadastre, and Cartography (ANCFCC).
Documents presented as notarial deeds and certificates of ownership circulate online. The group claims to have exfiltrated several terabytes of data.
But soon, doubts arise: several internal sources assert that the hack did not originate from the ANCFCC itself, but from an external contractor. The notarial platform Tawtikis suggested as a possible source. An audit is then initiated among notaries.
June 9, 2025 — New Attack Claimed: The Ministry of Justice
Shortly after, Jabaroot claims a third operation, this time against the Ministry of Justice. The collective asserts it holds personal data on thousands of judges and officials, including their contact details and salary statements.
Excel files circulate, purportedly proving the veracity of their claims.
The ministry swiftly responds with a firm denial, stating that no intrusion has been detected in its systems and that no data has been compromised. A new judicial investigation is opened to determine the actual source of the disseminated files.
II. Hypotheses of Origin and Motivations: Dissecting Jabaroot's Discourse
A Collective or a Facade?
The identity of Jabaroot remains shrouded in mystery. No identifiable structure, no public face, no clear claims outside of an anonymous discourse mixing cyber-activism and political rhetoric.
The group presents itself as a "defender of digital truth," while disseminating hostile messages towards Morocco. This stance leads many experts to view it as a political communication operation rather than a true organized hacker group.
Do the data really come from hacking?
Several hypotheses contend:
-
Direct Intrusion into Public Servers :
The scenario put forward by Jabaroot, suggesting that the collective directly penetrated Moroccan systems. No concrete technical evidence supports this to date. -
Exploitation of Peripheral Vulnerabilities :
Certain external platforms linked to the institutions, such as those of notaries or IT contractors, may have served as entry points.
This theory is deemed plausible, as it bypasses the main defenses of the administrations. -
Recycling Old Databases :
Several analyses suggest that the files circulated are old and stem from previous leaks, sometimes available on underground markets.
Jabaroot may have simply compiled this data to construct a spectacular narrative.
A Calibrated Communication to Strike Hard
Each publication from Jabaroot follows the same pattern:
-
Nocturnal dissemination on Telegram or obscure forums.
-
Staging a supposed "digital revenge" against Morocco.
-
Silence for several days, allowing panic to spread.
This pattern indicates a psychological strategy rather than a technical one. The goal: to create a sense of shock in public opinion, and sow doubt about the state's ability to protect its citizens.
III. Verifications and Counter-Investigations
Authenticity of the Documents
The published files sometimes contain real data, but often incomplete, modified, or outdated.
Flagrant inconsistencies are noted: documents dated several years back, erroneous internal references, outdated addresses.
These anomalies strengthen the idea that the collective plays on the confusion between real data and fabrications.
Internal Testimonies and Audits
Internal audits have been conducted in the affected organizations.
The initial results confirm that no vulnerabilities have been detected in the state's central servers.
However, the investigations have revealed some peripheral weaknesses: unsecured file sharing, weak passwords, absence of encryption on certain exchanges.
These points, while minor, remind us of the necessity for continuous vigilance in public institutions.
The Strategic Silence of the Authorities
In the face of these attacks, official communication has remained measured.
The government has avoided amplifying the phenomenon, favoring discreet management by cybersecurity services.
But this silence has also left room for rumors. On social media, Jabaroot has gained unprecedented visibility, becoming a sort of "digital myth" fueled by collective fears.
IV. Possible Scenarios and Stakes for Morocco
Scenario 1 — Destabilization Operation
Jabaroot could be the digital arm of a political destabilization strategy aimed at undermining public trust in Moroccan institutions.
The chosen targets — CNSS, Justice, Land Registry — touch on symbols of sovereignty and the rule of law.
Scenario 2 — Opportunistic Hacking and Staging
A small group of hackers may have exploited some minor breaches and then exaggerated their exploits to create the illusion of a massive cyber-attack.
This method is typical of modern campaigns of "media hacktivism."
Scenario 3 — Disinformation Operation Based on Recycled Data
Jabaroot may have simply retrieved existing files from the dark web to execute a political and media "coup."
This scenario would explain the speed of the publications and the absence of technical proof of recent hacking.
V. The Necessary Response: Transparency, Education, and Vigilance
1. Restore Trust
Morocco must respond with clarity: official communication, publication of independent audits, strengthening the DGSSI, and a public cybersecurity information campaign.
2. Strengthen Digital Security
-
Regular audits of servers and contractors.
-
Encryption of sensitive databases.
-
Training for administrative staff.
-
Active monitoring of channels where compromised data circulate.
3. Prevent Rather Than Suffer
Cyberattacks are inevitable, but their impact depends on preparedness.
Incident simulations, regular backups, and a clear crisis response policy must become the norm.
4. Raise Citizens' Awareness
The citizen is often the weak link. By understanding the risks (phishing, impersonation, rumors), everyone can help strengthen collective resilience.
A national digital education initiative could become a pillar of Moroccan sovereignty.
Conclusion
The Jabaroot affair reveals much more than a simple digital confrontation.
It highlights the fragility of societies in the face of disinformation, the power of fear, and the importance of transparency.
Morocco is confronted with a hybrid war, where the lines between hacking, propaganda, and manipulation blur.
But in this invisible battle, the best weapon remains the truth — methodical, verified, and shared.
Sources Consulted:
Le Matin – Le Monde – Médias24 – Le Brief – Yabiladi – Le360 – France 24 – Resecurity – CybelAngel – Consonews – DGSSI – Maghreb Intelligence – Morocco World News – Jeune Afrique – Le Desk
