Anonymous Sudan is a hacker group that has been active since mid-January 2023 and believed to originated from Russia with no links to Sudan or Anonymous.[1][2] They have launched a variety of distributed denial-of-service (DDoS) attacks against targets.
Despite the name, there is no provable link between Anonymous Sudan and the country of Sudan.[3][1][2] The group surfaced as a Russian-speaking Telegram channel in mid-January.[4] Some experts,[5] incluidng cybersecurity company CyberCX,[2] believe the group originates from or is supported by Russia.[1] The group is also not linked to Anonymous (hacker group).[1][6]
The group claims to target countries and organizations engaging in self-described "anti-Muslim activity"[3] and anti-Zionist,[7] and claiming a pro-Islam stance.[8][9] However, they have also collaborated with pro-Russian attack groups like Killnet.[10] Their attacks seem to align with a pro-Russian agenda.[1]
As a response to the International Committee of the Red Cross rules of engagement for civilian hackers, a representative of Anonymous Sudan said the rules were "not viable and that breaking them for the group's cause is unavoidable".[11]
Anonymous Sudan has launched a variety of distributed denial-of-service (DDoS) attacks against targets in Sweden, Denmark,[12] US,[13] Australia,[14] and other countries.[3] Their victims include Cloudflare,[15] Associated Press,[16] Netflix,[17][18] and PayPal,[19] among others. Anonymous Sudan has successfully disrupted the website of Scandinavian Airlines (SAS)[20] and even took down Microsoft 365 software suite,[21] including Teams and Outlook.[3] They also took Twitter, now known as X, offline in more than a dozen countries to pressure Elon Musk to enable Starlink service for Sudan.[22][6][23] According to the Cyberint Research Team, the group launched 670 attacked in their first 6 months.[24]
On 8 June 2023, Anonymous Sudan claimed to have done a DDoS attack on Azure portal, that caused an outage of the Azure Portal and some others Microsoft cloud services between ~15 UTC and ~17:30 UTC.[25]
In July 2023 and during the War in Sudan between the Sudanese Armed Forces (SAF) and Rapid Support Forces (RSF), Anonymous Sudan launched cyberattacks on Kenyan government and private websites in the last week of July in retaliation for the country's backing to the RSF.[26][27]In January and February 2024, Anonymous Sudan also claimed to have disabled all internet services in Chad[28] and Djibouti, respectively, as part of a cyberattack to protest the country's relations with the RSF.[29] The group continued attacking Intergovernmental Authority on Development (IGAD) countries,[30] including Uganda during February due to their backing of the RSF.[31] The group also attached the United Arab Emirates, one of the major supporters of the RSF.[32]
On 10 July 2023, Anonymous Sudan attacked the Archive of Our Own with a Denial-of-service attack. Anonymous Sudan claimed responsibility in a Telegram post, saying it was motivated over the website's United States registration as well as its sexual and LGBT content.[33][34] The group then demanded $30,000 worth of Bitcoin within 24 hours to end the attack.[33][34] The site came back online the next day with Cloudflare protection added.[35]
In October 2023 and during the Israel–Hamas war, media teams operation in the region have been exposed to various kinds of cyberattack, with the Jerusalem Post website going down on 9 October, with Anonymous Sudan claiming responsibility. The Palestinian Authority news agency Wafa also experienced a cyberattack on 18 October, as did Al-Jazeera English on 31 October and Al-Mamlaka TV on 3 November.[36] In November 2023, the group targeted Israel infrastructure.[37][38]
In December 2023, Anonymous Sudan also launched a DDoS attack on ChatGPT[39][40][41] after Tal Broda, a member of OpenAI's leadership, made a social media post dehumanizing Palestinians, calling for more intense bombing in Gaza, and advocating ethnic cleansing.[42][43]
In January 2024, Anonymous Sudan failed to hack the London Internet Exchange in response to the UK's missile strikes in Yemen.[7][44]