Log in Request a demo

APT Groups

Kasablanka: The Emerging North African Cyber Threat Actor

Kasablanka is described as a threat group active since about 2021. Read its reported tradecraft, targets and defences, and why MITRE ATT&CK does not list it.

Updated 8 Min Read
Kasablanka APT cyber threat actor visual card representing espionage and phishing operations targeting government and energy sectors

Kasablanka is the name of a threat group that, according to Brandefense’s analysis, has been active since about 2021 and moved from website defacement to phishing, credential theft and cloud account abuse. Brandefense’s analysis links it to Morocco. MITRE ATT&CK does not list the group, so this attribution rests on Brandefense’s analysis alone.

The group known as Kasablanka is described in Brandefense’s analysis as a cyber threat group from North Africa or the Middle East that has matured quickly from regional hacktivism to organized cyber-espionage and financial operations. Brandefense’s analysis says the group has existed since about 2021 and believes its origins or affiliations are in Morocco. This is attribution by Brandefense’s analysis only. This group operates with a combination of ideological motivations and profit-seeking. Kasablanka has transitioned from defacing websites and leaving coded messages about political agendas to more sophisticated capabilities that include targeted phishing, credential theft, and intrusion campaigns into cloud-based platforms.

Brandefense’s analysis treats Kasablanka as a case study of a regional hacktivist collective that grew into an advanced persistent threat (APT) and mixed activism with intelligence collection and influence operations. Its campaigns sit between political aims, espionage and crime, which blurs the line between state-linked and independent actors.

Kasablanka APT group profile showing threat actor identity, risk level, target sectors, and operational activity since 2021
Kasablanka is an emerging cyber threat actor active since 2021, targeting governments, energy companies, and media organizations through phishing and espionage campaigns.

Who is the Kasablanka threat group and what drives it?

Based on its operational emphasis and targeting profile, Brandefense’s analysis says Kasablanka likely follows a hybrid model that spans hacktivism, criminal enterprise and state-aligned espionage. It states that direct state sponsorship is unconfirmed, and that the group’s interests often match regional political narratives tied to Morocco.

Warning: Attribution is not confirmedOrigin, dates and operations in this profile come from Brandefense’s analysis. MITRE ATT&CK lists no group called Kasablanka, and the analysis itself says state sponsorship is unconfirmed.

Motivations Include:

  1. Political Influence and Hacktivism: To promote nationalistic or anti-rival narratives, especially during regional political tensions.
  2. Financial Gain: Credential theft, extortion, and theft of corporate or financial data.
  3. Espionage and Intelligence Collection: Targeting government and energy organizations for strategic and economic intelligence.

The combination of motivations contributes to Kasablanka’s overall unpredictability, as it can move between propaganda and attempts at espionage rapidly.

Tactics, Techniques, and Procedures (TTPs)

Kasablanka’s technical capabilities have evolved considerably since its early operations. Brandefense’s analysis says the group has expanded its use of open-source tools, modified phishing kits, and encrypted channels to maintain long-term access and exfiltrate data.

1. Initial Access

Brandefense’s analysis says the group relies mainly on spearphishing and social engineering. Emails and social media messages often imitate trusted contacts in government or business and lure the victim to enter credentials into a spoofed portal. Many fake portals copy Microsoft 365, Gmail or government intranet pages to collect usernames and passwords.

Brandefense’s analysis adds that the group has used watering-hole compromises. In these, it breaks into websites its targets visit and injects malicious JavaScript into them.

2. Persistence and Privilege Escalation

Brandefense’s analysis says Kasablanka uses simple but effective persistence: credential reuse, remote access tools (RATs) and stolen cloud tokens. With valid credentials, it often keeps access to the compromised Microsoft 365 or Google Workspace account even after the password changes, by stealing or reusing an existing OAuth token.

3. Command and Control (C2)

Brandefense’s analysis says the group runs simple command and control (C2) through legitimate cloud services, namely Dropbox, Google Drive and Telegram bots. It also says the group uses HTTPS encryption and domain fronting to hide its traffic.

4. Malware and Tools

Brandefense’s analysis says Kasablanka depends on public tools plus small custom development. That keeps costs low and flexibility high. It lists the following:

– QuasarRAT and njRAT: Two widely available remote access tools, used for surveillance and file theft. MITRE ATT&CK describes QuasarRAT (S0262) as an open-source tool on GitHub since at least 2014 and njRAT (S0385) as first seen in 2012. Neither MITRE page lists Kasablanka as a user.

– Credential Stealers: Based on either browser or Windows extractors, included in phishing scripts.

– Malicious Phishing Kits: Phishing kits hosted on cloud providers and designed to replicate login pages for targeted organizations. 

5. Exfiltration and Evasion

Data exfiltration generally occurs via encrypted channels or cloud-based repositories. The group frequently compresses the stolen documents and credentials into a password-protected zip/archive prior to upload. To avoid detection, Brandefense’s analysis says the group hides malicious activity inside normal user activity.

How a Kasablanka intrusion runs, as described in Brandefense's analysis
  1. Phishing messageImitates a trusted contact in government or businessTechnique T1566 (MITRE ATT&CK, opens in a new tab)
  2. Fake login pageCollects usernames and passwords
  3. Cloud access keptA stolen or reused OAuth token keeps access after a password change
  4. Cloud-hosted C2Dropbox, Google Drive and Telegram bots
  5. ExfiltrationStolen files are zipped with a password and uploaded
Get your security score with ThreatWatch
ThreatWatch encouraging users to check their security score

What operations is Kasablanka reported to have run?

Brandefense’s analysis says Kasablanka moved away from ideological attacks toward planned intelligence collection. These are the operations it lists.

  • 2021: Defacement and Propaganda Campaigns: The group gained prominence through mass defacements of Algerian and Tunisian government websites while spreading nationalist and anti-country messages.
  • 2023: Energy Sector Phishing Campaign: Phishing campaigns against European and North African energy organizations, using fake Microsoft 365 login pages to obtain corporate credentials.
  • 2024: Regional Disinformation Drive: Coordinated social media campaigns to advance disinformation regarding protests and diplomatic tensions in North Africa. These disinformation operations combined cyber intrusion and influence campaigns.
  • 2025: Government Espionage Operation: Multilayered phishing campaigns against North African ministries and diplomatic entities, with more use of QuasarRAT implants, according to Brandefense’s analysis.

Brandefense’s analysis reads these operations as a shift from symbolic attacks to work that supports intelligence priorities.

How has Kasablanka changed over time?

Brandefense’s analysis sees Kasablanka as a sign of maturing regional cyber capability in North Africa. It says the group moved from amateur methods to better operational security and cloud-based persistence, using open-source tools that anyone can get.

Evolutionary Highlights:

  • Hacktivism to Espionage: From defacing websites to credential theft and espionage operations.
  • Use of Commercial Infrastructure: Using Telegram, Google Drive and Dropbox for C2 and for exfiltration.
  • Social Engineering Focus: Campaigns that rely on persuading people more than on complex malware.
  • Operational Agility: Brandefense’s analysis says the group can rebuild infrastructure quickly after a takedown.

Brandefense’s analysis says the use of njRAT and QuasarRAT points to a group that wants to be accessible and deniable, which is common for actors that mix crime and politics.

How can defenders protect against Kasablanka?

Brandefense’s analysis says Kasablanka is one of a growing set of actors that sit between politics, espionage and cybercrime. Its work is mostly regional, but Brandefense’s analysis reads its targeting of energy and diplomatic sectors in Europe as a sign it may want to expand beyond North Africa.

Strategic Implications:

  1. Regional Cyber Escalation: Cyber capability is growing among non-traditional actors in North Africa.
  2. Espionage Expansion: Intelligence collection in the region, driven by economic and diplomatic issues.
  3. Information Warfare: Disinformation is mixed with operations to influence narratives.

Defensive Recommendations:

  1. Strengthen Identity Protection: Use and monitor multi-factor authentication (MFA), and watch all OAuth activity on cloud accounts.
  2. Phishing Defense: Implement domain monitoring for impersonation websites as well as regular employee phishing tests.
  3. Network Monitoring: Look for unauthorized access. Review unusual cloud access logs and data movement.
  4. Threat Intelligence Sharing: Work with other regional CERTs on shared infrastructure and attack patterns.
  5. Incident Response Planning: Train teams for incident response, using the social engineering and credential theft seen in Kasablanka cases.

Conclusion

The report describes Kasablanka as a new kind of regional APT group: technically capable, politically flexible and opportunistic. A hacktivist group turning into a hybrid actor that can run espionage and financial crime shows how cyber capability is spreading. It works at the edges of the established APT ecosystem, and regional groups like it can become real threats locally and abroad.

Brandefense’s analysis says that as of 2025 the group keeps extending its capabilities across propaganda, espionage and cybercrime. Defenders should keep assessing how these motives overlap, so they can detect and respond better and understand what such actors mean for the region.

You can download and review the sheet for all the details!

Two cybersecurity professionals reviewing threat intelligence on a laptop in a secure operations center
Brandefense provides trusted threat intelligence and digital risk protection for global security teams.

Frequently Asked Questions.

What is the Kasablanka threat group?

According to Brandefense's analysis, Kasablanka is a threat group from North Africa or the Middle East, active since about 2021, that moved from defacing websites to phishing, credential theft and cloud intrusions.

Is Kasablanka listed in MITRE ATT&CK?

No. The MITRE ATT&CK groups list has no group named Kasablanka, and the QuasarRAT and njRAT software pages do not list it as a user.

Which tools does Kasablanka use?

Brandefense's analysis names QuasarRAT and njRAT, credential stealers and phishing kits. MITRE describes QuasarRAT as an open-source tool on GitHub since at least 2014 and njRAT as first seen in 2012.

How can organizations defend against Kasablanka?

Brandefense's analysis recommends MFA and OAuth monitoring, domain monitoring for impersonation sites, review of cloud access logs, CERT cooperation and incident response training on credential phishing.

Sources

  1. 1 MITRE ATT&CK Groups
  2. 2 MITRE ATT&CK QuasarRAT (S0262)
  3. 3 MITRE ATT&CK njRAT (S0385)
  4. 4 MITRE ATT&CK Phishing (T1566)

Try it on your own domain

Type a domain to see the kinds of imitations an attacker would consider.

Generated in your browser, nothing is sent.

    Check a domain with the free scanner

    #apt groups #cloud security #Cyber Espionage #Identity Security #Middle East Threat Landscape #threat intelligence
    Share

    In This Article

    TechniquesEncrypted Channel TermsThreat actor TermsCredential theft TermsHacktivism TermsCyber espionage TermsAdvanced persistent threat (APT) TermsTactics, techniques and procedures (TTPs) TermsInitial access

    Where To Next.

    All APT Groups Articles
    In plain words · Glossary term Threat actor

    A threat actor is an individual or a group that poses a threat to an organization or system.

    Open →     Keep reading · Article DarkHotel (APT-C-06 / ATK52 / DUBNIUM): The Global Espionage Network Behind Elite Cyber Intrusions

    DarkHotel (APT-C-06, DUBNIUM) profile: espionage actor, its shift from hotel Wi-Fi attacks to supply chain and cloud-based operations, aliases and targets.

    Open →     Keep reading · Article Looking at Your Company Through the Eyes of an Attacker: What Is an Attacker’s-Eye View?

    What is an attacker's-eye view?

    Open →

    Knowledge HubThreat group profiles apt groupscloud securityCyber Espionage