Between 1 and 3 November 2026, Brandefense Blackhole first recorded three separate hacktivist claims against two public bodies and one company. This ranking sets each one next to what its own posts show and whether the pages we opened mention it. A claim is a claim: nothing below is confirmed by us.
We ranked the three by our reading of plausible impact. The yardstick is how serious the harm would be if the claim were true, lowered where the posts offer little to check. Morocco is ranked first for possible harm, not for strength of proof. The order is ours, not a finding of the sources.
- Period.
- 1 to 3 November 2026 (first recorded by Blackhole).
- Rank 1.
- Morocco’s Ministry of National Education, Preschool and Sports named as the “next victim” by a group calling itself blacknet00; nothing more stated.
- Rank 2.
- Takedown of German Federal Criminal Police Office (BKA) portals, claimed in posts that name three different groups (only one names the recruitment portal).
- Rank 3.
- Takedown of the website of Cellnex Telecom, claimed in posts tagged TunisianMaskers.
- Official pages.
- None of the three pages we opened on 3 November 2026 mentioned the claim.
1. Morocco’s Education Ministry Named as a “Next Victim”
On 3 November a Telegram channel posted that the “next victim of blacknet00” would be Morocco’s Ministry of National Education, Preschool and Sports. A second post the day before named the Kingdom of Morocco and its education ministry. Brandefense Blackhole holds 15 posts that mention blacknet00. It first recorded 13 of them on 31 October, although the posts themselves date from 8 to 20 October, and 2 on 3 November.
The 3 November post is an announcement only. It carries no data sample, no file list and no leak link, and the 2 November post has one image that we have not opened. On the same morning the channel also named a ministry of education in Saudi Arabia as a coming target.
The 13 older posts present the name as a ransomware alliance with another group. They list claimed email and system breaches at bodies in several countries, and we have not checked any of them. The group calls itself a ransomware alliance; we group it here because it posts claims in the same way. Announcing targets before showing material is what a pressure or publicity campaign looks like, which is our reading.
We ranked it first on that reading: a real leak from an education ministry could expose staff, pupil and exam records, the most serious outcome of the three. The ministry’s home page, opened on 3 November 2026, carries no statement about the claim.
2. German Federal Criminal Police Portals Claimed Down
Three posts from 1 and 2 November concern the BKA, Germany’s Federal Criminal Police Office. A 1 November post signed NoName057(16) marks the BKA portal and a digital application portal with a red cross, which we read as a down claim, plus a third site. It includes the line “Thank you for developing your digital infrastructure”. A 2 November post from a chat of Dark Storm Team repeats the same three targets with new check reports.
A second 2 November post, signed BD Anonymous Team, says it took down the BKA recruitment portal and gives a political motive about Palestine. The posts use the #OpGermany tag, as in the campaign covered in our NoName057(16) OpGermany claims post.
The NoName057(16) post and the Dark Storm post say “digital application portal”; the BD Anonymous post says “recruitment portal”. The posts do not say these are the same site. We treat them as one for this ranking, which is our reading.
The only proof stated in the text is a public availability-checker report for each site; the posts also carry an image or video that we did not open. A report of this kind usually shows that test servers did not get an answer at one moment. It does not show how long the outage lasted or whether any applicant data was touched.
It ranks second because the target is a federal police body and three groups claim it. The impact is limited to a recruitment website, which is why it sits below a possible data leak. The BKA press landing page we opened on 3 November 2026 showed no release list and no statement; we did not open the full press listing.
3. Cellnex Telecom Website Claimed Down
On 1 November two channels posted almost the same text, in English and Arabic, under the tag TunisianMaskers. The posts say a cyberattack was launched on Cellnex Telecom and that “The site is currently not working”. The same check report is cited as proof in both.
The two posts disagree about the target. One calls Cellnex a “Spanish technology and internet company” and the other a “Spanish energy company”. Cellnex is named only as the target the posts claim, and the inconsistency suggests the text was written quickly rather than from knowledge of the company, which is our reading.
The posts say “cyber attack” and describe a website outage, most likely a DDoS, which is our reading. They mention no data and no network access. A company website being unreachable says little about the company’s other systems. That is why we rank it third.
The Cellnex news page, opened on 3 November 2026, lists items up to 23 September 2026 and does not mention the claim. Pages opened: men.gov.ma home page, bka.de press landing page and cellnex.com/news, on 3 November 2026 only. A checker report of this kind usually shows one moment only, so it cannot tell us how long a site was down.
| Claim | What is claimed | Proof offered | Pages we opened |
|---|---|---|---|
| 1. Morocco education ministry | Named as the next victim; nothing more stated | None; announcement only | Not mentioned on the page we opened |
| 2. BKA portals | Portal taken down | Availability-checker reports | Not mentioned on the page we opened |
| 3. Cellnex Telecom website | Website taken down | One availability-checker report | Not mentioned on the page we opened |
What Do These Claims Have in Common?
All three are cheap to make and hard to check. An announcement, a checker report and a short slogan need no access to a network. A real data leak would need files and details that someone could verify, and none were posted in the cases above.
Two of the three are website outages. A distributed denial-of-service attack floods a site with requests so that users cannot reach it, as explained in our entry on DDoS attacks. For the longer history of such groups, see our report on hacktivism and DDoS trends.
What Should Defenders Do With Claims Like These?
The steps below are our advice, not findings from the posts. They apply whether or not a claim proves true.
- Check your own logs firstLook at web, DNS and provider logs for the stated time before you reply to anyone.
- Keep the evidenceSave the post text and the dates; do not open or share the group’s own links.
- Ask your providerAgree on traffic filtering and a static fallback page before an outage, not during one.
- Look for the dataIf a leak is announced, search for your own records in the places where leaks are posted and tell your regulator if any are real.
- Say only what you knowPublish a short factual statement once your own checks are done.
What Is Still Unknown?
We do not know whether any of the three sites was down for more than a moment, or whether the Moroccan ministry holds any leaked data. The next useful facts would come from the ministry, the BKA and Cellnex. We will update this article if any of them confirms or denies a claim.