Morocco’s Marjane Group Hit by Stormous Ransomware Attack Morocco’s largest retail company, Marjane Group, has been targeted in a ransomware attack by the threat actor group Stormous, which publicly claimed responsibility on November 6. The attack specifically disrupted marjane.ma, the company’s digital infrastructure, with the group threatening to leak stolen data unless contacted by a Marjane representative. The incident coincides with a recent leadership transition at Marjane, where Mourad Alem replaced Ayoub Azami as president and CEO last month. Azami had led the company for a decade before moving to a new role within Al Mada, Marjane’s majority shareholder. Stormous, first detected on Telegram in April 2021, gained prominence in February 2022 and has since aligned itself with Russia, even issuing threats against France following the Ukraine war. After a lull in late 2022, the group resurged in early 2023, claiming around 30 attacks between March 21 and April 3 alone. Security researchers, including ZeroFox, have questioned the group’s credibility, noting that past claims often involved reposting already leaked data rather than verified breaches. Stormous operates under a double extortion model, encrypting systems while exfiltrating data. The group claims to avoid targeting critical infrastructure, such as hospitals, and excludes Russian entities from its operations—though it briefly claimed an attack on a U.S. hospital before retracting. The attack on Marjane underscores the persistent threat posed by ransomware groups, particularly those with geopolitical motivations.