Morocco
Government
Administrative & Investor Data
For Sale
Unverified
Morocco Investment Ministry Data Claim Includes 150,000 Folders and Records on 50,000 Investors
Overview
An actor using the handle "anisans2" claims to be selling data associated with Morocco's Ministry of Investment, Convergence and Evaluation of Public Policies (MICEPP). The actor describes the material as including administrative documents, authorization records and national ID-related data.
The listing claims more than 150,000 folders containing multiple files, along with data relating to more than 50,000 investors. The actor says the material includes Moroccan companies and public institutions and claims the full dataset exceeds 400 GB. Samples of documents and dataset content are advertised, while the full material is offered for sale either in whole or in parts. The dataset, its source, the stated volumes and the actor's possession of the full material have not been independently verified.
Post details
MoroccoWhat the post claims
- More than 150,000 folders extracted
- Multiple files contained within the folders
- Administrative documents included
- Authorization documents included
- National ID-related data included
- Data concerning more than 50,000 investors
- Moroccan companies included
- Public institutions included
- More than 400 GB of data claimed
- Sample documents advertised
- Sample dataset content advertised
- Full dataset offered for sale
- Seller accepts offers
- Dataset can allegedly be purchased in parts
The actor specifically names several organizations and institutions as examples of entities represented in the material. The screenshot does not provide enough underlying sample content to independently confirm those references or determine how records are distributed across the claimed 400+ GB dataset.
Screenshots
IOCs & contact identifiers
Identifiers directly visible in the listing. These support correlation and do not independently verify the dataset claim or identify the person operating the account.
| Type | Identifier | Source |
|---|---|---|
| Actor handle | anisans2 | Screenshot 1 |
| Telegram channel | @pka291channel | Screenshot 1 |
| Telegram backup | t[.]me/pka291backup | Screenshot 1 |
No Tox ID, Session ID, malware hash, attacker-controlled domain or attacker-controlled IP address is visible in the supplied material. Personal or government identifiers that may be contained in the purported evidence are not included in this table. URLs to any data will always be blurred out, but are available for subscribers on the threat feed or ransomware feed.
Mapped techniques
Claimed identifies behavior explicitly described by the actor. Inferred identifies an analytical mapping supported by the supplied material. Neither label means the activity has been independently verified.
- Collection T1213.006 Data from Information Repositories: Databases Inferred The actor claims to have extracted a large collection of structured investor information alongside administrative documents and authorization records. The supplied material does not disclose the acquisition method or independently establish unauthorized access to MICEPP systems.
Potential impact
If authentic, the claimed material could expose administrative documents, authorization records, national ID-related information and investor data involving Moroccan companies, public institutions and individuals. Depending on the underlying content, the material could support identity fraud, targeted phishing, impersonation, business-email compromise or intelligence gathering against organizations represented in the dataset.
Status Unverified
Dark Web Informer has not independently verified the dataset's authenticity, source, 150,000+ folder count, 50,000+ investor count, 400+ GB size, current availability or the actor's claim that the material contains records associated with the organizations named in the listing. The supplied screenshot documents the claim and sale offer, not the full dataset itself.
