This is a fact sheet on the collective called Mr Hamza, which has been involved in numerous cyber attacks, including in collaboration with DieNet, discussed here.
Origin and main characteristics
The group Mr Hamza is said to have originated in Morocco around October 2024. This collective, as has already been partly stated, is known for attacks carried out in collaboration with other collectives including the famous NoName057, Z-Pentest, Holy League. For the coordination of operations, it is very likely that one of the preferred channels is Telegram.
Attribution of attacks and motivations
With a preference for DDoS attacks, the Mr Hamza collective is known for selling hacking tools and attacking large and critical facilities.
| Date | Operation | Objective | Method | Notes |
|---|---|---|---|---|
| Oct 2024 | Leak date army Egypt | Egyptian Army | Data leakage | Collaboration with Emorocco Hacktivists |
| Dec 2024 | #OpItaly (various stages) | Italian ministries and agencies | DDoS + defacement | Also MI6, ENISA, INCIBE |
| Jan 2025 | Attack on DIS (Italian Intelligence Agency) | DIS website | DDoS | Confirmed by Cyber Press |
| Mar 2025 | #Oops_Turkia | Turkish Ministry of Defence, SIEM, citizen passports | Leakage + threatened data dumping | Claimed on Telegram |
| Apr 2025 | Op_USA (?) | US & allied military infrastructure | DDoS + data leak | Coordinated with Vortex and Arab Ghosts |
Italy met Mr Hamza in December 2024, following a massive campaign of DDoS attacks (sometimes with defacement) on ministries and government agencies. In January 2025, there was a DDoS attack on the DIS (Department of Security Information).
Specifically, in Italy, Mr Hamza was also involved in the offensive against Klinger (in which Gunra Ransomware was used) and against an IT services company hit by an RDP intrusion by the actor Rivka. In this regard, we learn in a very detailed article in The Daily Tech Feed that:
The offer was posted on the ‘ramp4u.io’ forum. Similar to the previous incident involving the same author, this provides a first foothold for potential buyers at an Italian IT services company.
Underlying Mr Hamza’s activities is a strong anti-Israeli ideology and therefore in favour of the Palestinian cause. This allowed Mr Hamza to espouse causes that were akin to these ideologies.
At the time of writing this article, the collective has a public channel in Telegram and a registered mailbox on the Tutanota encrypted mail service.
Among the various activities claimed by the group are PsyOps, i.e. operations for psychological purposes, made to spread a certain propaganda or destabilise public opinion. During the attacks in Turkey (#Ops_Turkey) Mr Hamza launched DDoS attacks and data leaks not only to cause technical damage, but also to convey a political message. For instance, they explicitly stated that their actions were ‘warning operations’ in response to ‘moral provocations’. The group uses pro-Palestinian, anti-Western, anti-Israel language and storytelling, with statements aimed at encouraging ideological solidarity and recruitment.
Curiosity about the name
Hamza is a very important Arabic word (حمزة), its meaning is ‘lion’ and thus also ‘courage’ and ‘ferocity’, it is derived from the root ḥ-m-z, related to strength and determination. In Arabic culture, this name is also associated with people including Ḥamza ibn ʿAbd al-Muṭṭalib, uncle of the prophet Muhammad. Considered one of the greatest warriors of early Islam, he was known as ‘Asad Allāh’ – The Lion of God. ʿAbd al-Muṭṭalib died in the Battle of Uhud fighting valiantly for Islam and is revered today as a martyr and heroic figure. The choice of this name, therefore, is intended to convey concepts such as heroism and martyrdom; it is a very identifying name with very strong symbolic characteristics.
The prefix ‘ Mr ‘ is instead most probably linked to the desire to give a ‘western touch’ to the collective (Mr Robot, Mr DDoS, etc…) and this would be more than understandable since Arab culture is not very widespread in the western world. There is a caustic note in that ‘Mr’, almost as if to make him more respectable, which in reality cannot be said considering the virulence of the offences committed and the hatred felt for the West.
