Anonymous Sudan is a criminal hacker group that has been active since mid-January 2023. They are alleged to have committed over 35,000 distributed denial-of-service (DDoS) attacks against entire small countries, government agencies, universities, newspapers, hospitals and LGBT sites. While they claim to be doing it for pro-Palestinian ideological reasons, they have attempted to extort money from victims.
In a US federal grand jury indictment unsealed in October 2024, two Sudanese brothers, Ahmed Omer and Alaa Omer, were arrested and charged in March 2024 with operating and controlling Anonymous Sudan. The US Department of Justice and FBI seized and disabled the group's DDoS tools and infrastructure at that time.[1][2][3][4] Contrary to its name, there are no known links to the hacker collective Anonymous.[5] Some analysts believe it may have originated in Russia.[5][6]
Origins and identity
Despite the name, the group surfaced as a Russian-speaking Telegram channel in mid-January.[7] Some experts,[8] including cybersecurity company CyberCX,[6] believe the group originates from or is supported by Russia.[5] The group is not linked to Anonymous.[5][9]
Key people
Ahmed and Alaa Salah Yusuuf Omer are accused of running Anonymous Sudan.[4] On 16 October 2024, a federal grand jury indicted both brothers in California for their alleged roles in operating the cybercriminal organization.[2][10] The charges include conspiracy to damage protected computers, with Ahmed facing additional counts for damaging computers.
Targets and motives
Anonymous Sudan claims to target countries and organizations engaging in purported "anti-Muslim activity".[11] The group claims to be anti-Zionist,[12] as well as pro-Islam;[13][14] however, they have also collaborated with pro-Russian attack groups like Killnet,[15] and their attacks seem to align with a pro-Russian agenda.[5] As a response to the International Committee of the Red Cross rules of engagement for civilian hackers, a representative of Anonymous Sudan said these rules were "not viable and that breaking them for the group's cause is unavoidable".[16]
Possible link with SN_BLACKMETA
According to the cybersecurity firm Radware, the hacker group SN_BLACKMETA, which claims responsibility for two attacks on the Internet Archive in 2024[17][18] and claims pro-Palestinian motives, may be linked to Anonymous Sudan due to similarities in their operations, target choices, and rhetoric. Radware researchers suggested that the letters "SN" could stand for "Sudan".[19] According to a German source, SN_BLACKMETA is a Russian hacker group from the region around the Russian city of Veliky Novgorod, southeast of Saint Petersburg, and claim to have no state sponsorship.[20]
Attacks
Anonymous Sudan has launched a variety of DDoS attacks against targets in Sweden, Denmark,[21] the US,[22] Australia,[23] and other countries.[11] Their victims include Cloudflare,[24]Associated Press,[25]Netflix,[26][27] and PayPal,[28] among others. Anonymous Sudan has successfully disrupted the website of Scandinavian Airlines (SAS),[29] and even took down Microsoft 365 software suite,[6] including Teams and Outlook.[11] They also took Twitter (now known as X) offline in more than a dozen countries to pressure Elon Musk to enable Starlink service for Sudan.[30][9][31] According to the Cyberint Research Team, the group launched 670 attacks in their first 6 months of activity.[32] On 8 June 2023, Anonymous Sudan claimed responsibility for a DDoS attack on Azure portal, which caused an outage of this and other Microsoft cloud services between ~15 UTC and ~17:30 UTC.[33]
During the ongoing civil war in Sudan between the Sudanese Armed Forces (SAF) and Rapid Support Forces (RSF), Anonymous Sudan launched cyberattacks on the Kenyan government and private websites in the last week of July 2023, in retaliation for the country's support of the RSF.[34][35] In January and February 2024, Anonymous Sudan claimed to have disabled all internet services in Chad and Djibouti, respectively, as part of a cyberattack to protest the country's relations with the RSF.[32][36] The group continued attacking Intergovernmental Authority on Development (IGAD) countries,[36] including Uganda in February, due to their backing of the RSF.[37] The group also attacked the United Arab Emirates, a major supporter of the RSF.[38]
On 10 July 2023, Anonymous Sudan attacked fanfiction site Archive of Our Own with a denial-of-service attack. Anonymous Sudan claimed responsibility in a Telegram post, saying the act was motivated by the website's United States registration and its inclusion of sexual and LGBT content.[39][40] The group then demanded $30,000 worth of Bitcoin within 24 hours to end the attack.[39][40] The site came back online the next day with Cloudflare protection added.[41]
During the Israel–Hamas war, media teams operating in the region have been exposed to various kinds of cyberattack. The Jerusalem Post website went down on 9 October 2023, with Anonymous Sudan claiming responsibility. The Palestinian Authority news agency Wafa also experienced a cyberattack on 18 October 2023, as did Al-Jazeera English on 31 October 2023 and Al-Mamlaka TV on 3 November 2023.[42] In November 2023, the group targeted Israel infrastructure.[43][44] In December 2023, Anonymous Sudan launched a DDoS attack on ChatGPT,[45][46][47] after Tal Broda, a member of OpenAI's leadership, made a social media post dehumanizing Palestinians, calling for more intense bombing in Gaza, and advocating ethnic cleansing.[48][49]
Anonymous Sudan forced the closure of the emergency department at Cedars-Sinai Medical Center in California for approximately eight hours, redirecting incoming patients to other medical facilities. The total damages incurred as a result of these attacks were estimated to exceed $10 million.[52]
Legal actions and indictments
In October 2024, a US federal grand jury in the Central District of California indictment was unsealed, which detailed the March 2024 indictment, arrest, and charging of two Sudanese nationals brothers, Ahmed Salah Yusuuf Omer, 22, and Alaa Salah Yusuuf Omer, 27, for their alleged involvement in operating and controlling the cybercriminal group Anonymous Sudan.[4] They are charged with one count of conspiracy to damage protected computers, with Ahmed facing three additional counts of damaging protected computers. The indictment claims that the group was responsible for tens of thousands of DDoS attacks against critical infrastructure, corporate networks, and government agencies both in the United States and around the world.[53]
In March 2024, the US Department of Justice and FBI seized and disabled Anonymous Sudan’s Distributed Cloud Attack Tool (DCAT), which had been utilized to conduct these cyberattacks. Over a one-year period, the tool was reportedly employed in more than 35,000 DDoS attacks, impacting high-profile targets, including the U.S. Department of Justice, Department of Defense, and Cedars-Sinai Medical Center in Los Angeles.[54]
If convicted, Ahmed faces a potential maximum sentence of life in federal prison, while Alaa could face up to five years.[52]
