Loading threat actor…
Anonymous Sudan is a DDoS-focused threat actor active since January 2023 that publicly presented itself as a pro-Islam or pro-Palestinian hacktivist collective while also operating as a cybercriminal service. U.S. authorities alleged that the group was operated and controlled by two Sudanese brothers, Ahmed Salah Yousif Omer and Alaa Salah Yusuuf Omer, and charged them in connection with tens of thousands of distributed denial-of-service attacks conducted worldwide. The group used a platform referred to as the Distributed Cloud Attack Tool, also marketed under names including Godzilla, Skynet, and InfraShutdown, and allegedly sold attack capability to other actors as a DDoS-for-hire service while also extorting some victims to stop attacks. Anonymous Sudan became known for high-profile disruptive operations against technology companies, media organizations, hospitals, government agencies, cloud providers, airlines, telecommunications entities, and online platforms. Reported and claimed victims have included Microsoft services, OpenAI, Cloudflare’s public website, PayPal, X, Netflix, Scandinavian Airlines, hospitals in the United States, Kenyan internet infrastructure, Israeli targets, and multiple government and media entities. The group’s operations frequently caused temporary service outages and in some cases multi-day disruption. The actor’s core capability is large-scale distributed denial-of-service activity, including sophisticated Layer 7 attacks against API endpoints as well as other HTTP-based and SYN-flood techniques designed to bypass mitigation services. Authorities and researchers also linked the group to attack orchestration infrastructure built from cloud-hosted systems and open proxy resolvers rather than a traditional botnet of compromised consumer devices. Anonymous Sudan used Telegram extensively for propaganda, victim notification, operational claims, and service marketing. Although the group branded itself around Sudanese, Islamic, or pro-Palestinian themes, multiple security researchers and incident reports assessed that its targeting, messaging, tradecraft, and coordination aligned closely with pro-Russian interests. Anonymous Sudan has been described as affiliated or closely coordinated with Killnet and was identified as one of the most prolific components of the broader Killnet collective in 2023. It collaborated publicly with other pro-Russian or hacktivist actors and was cited as a viable threat to high-profile European events such as the 2024 Paris Olympics. At the same time, the strongest judicially supported attribution in the available reporting is the U.S. indictment alleging operation by Sudanese nationals. The group’s targeting has been heavily concentrated on the United States, Israel, and European organizations, often justified through anti-Western, anti-LGBTQ+, anti-Israel, or anti-Muslim rhetoric. It also targeted hospitals and emergency-related services, including Israeli alert applications and a U.S. medical center, demonstrating willingness to disrupt civilian-facing and potentially safety-critical services. Anonymous Sudan has also engaged in extortion, including ransom demands tied to continued DDoS disruption. Overall, the actor is best characterized as a disruptive, politically themed but criminally operated DDoS actor with demonstrated global reach, strong propaganda discipline, and repeated overlap with pro-Russian hacktivist ecosystems.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
9 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Hacktivist-branded activity; described as distinct from the original 'OpSudan' and collaborating with Killnet against Western targets, illustrating blurred lines between hacktivism and state-aligned activity.
Mentioned as part of a list of proliferating hacktivist names; no specific operations described in this content.
Anonymous Sudan is a hacktivist group conducting DDoS attacks against Western and Israeli targets, with suspected links to Russian interests. Their operations are as much information operations as technical attacks.
DDoS-for-hire operation that marketed attacks as hacktivism while selling disruptive services to paying customers, conducting extortion, and targeting hospitals, cloud providers, government services, financial institutions, universities, and major technology platforms.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.