On August 13, 2019, an entity calling itself Moroccan Revolution Team (MRT) hacked the website of state-controlled Nigerian airline company Aero Contractors.[1] The hack took the website down for five hours and displayed a webpage with a picture of a man holding the body of a child killed in a 2016 airstrike in Syria. Text on the image read: "Hacked by Moroccan Revolution... | M.R.T | I M Coming for you | Stop the waar." The page played audio from a Vox video on the Syrian civil war uploaded to YouTube in 2017.
MRT has used both pro-jihadi imagery and anti-ISIS messaging in their hacks as far back as 2015. In July 2019, MRT hacked a website with a French domain, defacing it with imagery including a logo featuring a fist holding a jihadi flag frequently used by ISIS and Al-Qaeda In The Arabian Peninsula (AQAP).[2]
A July 2019 hack by MRT showing a logo with a jihadi flag.
On August 18, 2019, Zone-h.org reported that MRT hacked an Australian website, defacing it with images that, similar to that used in the earlier August 2019 hack on the Nigerian airline's website, did not feature a jihadi flag and had text that read: "F*ck ISIS."[3]
An August 18, 2019 hack by MRT of an Australian website featuring an anti-ISIS message.
[1] Techpoint.africa/2019/08/14/nigerian-airline-company-aero-contractors-website-hacked-by-alleged-isis-tied-group, August 14, 2019.
[2] Zone-h.org/mirror/id/32648614, July 13, 2019.
[3] Zone-h.org/mirror/id/32758998, August 18, 2019.