Phantom Atlas

Phantom Atlas is a Moroccan patriotic hacktivist collective that became prominent during the 2025 Morocco–Algeria cyber confrontation. Its official Telegram identity describes the group as a Moroccan security team defending the Kingdom of Morocco and the Moroccan people. In a May 2025 H24Info interview, members said previously separate operators consolidated after the breach of Morocco's CNSS and characterized their mission as digital patriotism and active defense.

The operational profile extends beyond symbolic disruption. In April 2025, Phantom Atlas claimed unauthorized access to Algeria's General Post and Telecommunications Corporation (MGPTT), extraction of more than 13GB of confidential files, and a separate compromise of the Algerian Ministry of Labor. In June, the group claimed access to Algérie Télécom's internal network-infrastructure map, describing routers, distribution rings, routes and interconnections across several provinces.

Phantom Atlas also claimed a destructive defacement against Sahrawi National Radio. Reporting states the group said it gained platform access, wiped published content/articles, rendered the site inaccessible and uploaded a defacement image. This establishes a distinct integrity/destructive branch that should not be conflated with its data-acquisition campaigns.

A critical boundary is DDoS attribution. Morocco World News explicitly attributes a parallel April 2025 large-scale Algerian-government DDoS campaign to OPx005, not Phantom Atlas. DDoS is therefore excluded from this actor's technical profile.

Key judgment — high confidence: Phantom Atlas is a Morocco-aligned retaliatory hacktivist actor whose strongest public outcomes are unauthorized access with confidential/strategic data acquisition, external defacement and claimed destructive removal of web content against Algerian and Sahrawi/Polisario-linked targets.