ires.ma listed on apt73 leak site

• Ransomware group: apt73
• Country: Morocco
• Sector: Government & Defense
• Announcement date: April 27, 2026

The apt73 group claims a breach of ires.ma

The Morocco-based state-owned analytical center ires.ma has been listed on a leak site by the threat actor group known as apt73. According to the announcement made on April 27, 2026, the group claims to have compromised the institution's systems and is threatening to release the stolen information if their demands are not met.

The event was officially announced on the group's leak site on April 27, 2026, which is also the date the group claims the attack occurred. While information regarding the specific identity and background of the apt73 group remains limited, the group has taken the step of listing the organization as a victim of their operations. The threat actor has indicated that if the institution does not establish contact, the collected data will be made public.

Details of the claimed data theft

The apt73 group alleges that they have successfully exfiltrated approximately 30 GB of data belonging to ires.ma. The group claims that this data contains a variety of sensitive internal materials, ranging from administrative records to personal employee information. The announcement suggests a significant breach of the organization's digital environment.

Based on the claims made by the threat actor, the following types of data are reportedly involved in the leak:

• Internal documents
• Email attachments
• Contact lists
• Financial records
• Personal information
• Employee resumes

The group has provided screenshots as evidence of the breach, which include examples of employee resumes and personal contact details, intended to demonstrate the validity of their claims.

About the Institut Royal des Études Stratégiques

The target of this alleged attack, the Institut Royal des Études Stratégiques (IRES), is a state-owned think tank located in Morocco. The institution plays a critical role in the country's governance by conducting strategic studies and providing essential policy recommendations to the government. Its primary mission involves carrying out research and analysis designed to help develop and shape the long-term strategic vision of the nation.

Analysis and potential implications

The alleged leak of data from a strategic research center of this nature may pose significant risks to the institution's operational security and its state-level analytical processes. Because the organization is state-owned, the exposure of sensitive information could have indirect implications for national security policies and strategic partnerships. Furthermore, the exposure of personal data belonging to employees could lead to secondary risks, such as identity theft and targeted phishing attacks against the individuals involved.

The methods used by the threat actor, involving both a ransom demand and the threat of public data leakage, suggest that this incident may follow a double-extortion scenario. In such scenarios, attackers not only encrypt data to disrupt operations but also steal sensitive information to use as leverage for extortion. Organizations facing such threats often face complex legal obligations, such as those mandated under Moroccan data protection regulations regarding the handling of personal information.

In the government and defense sector, maintaining the integrity of strategic research is paramount. Organizations in this sector typically focus on robust defensive measures to mitigate these risks, such as implementing strict access controls, enhancing monitoring of data exfiltration, and ensuring comprehensive encryption for both data at rest and data in transit. Strengthening incident response plans is also a common defensive step to manage the fallout of potential leaks and ensure organizational resilience against sophisticated threat actors.