Anonymous Sudan

Despite the name, the group is not linked to Anonymous.{{Cite web |last=Shah |first=Saqib |date=2023-08-29 |title=Hacker group behind Twitter outage mocks Elon Musk's rebrand |url=https://www.standard.co.uk/news/tech/who-are-anonymous-sudan-hacker-group-behind-microsoft-outage-b1088879.html |access-date=2024-02-14 |website=Evening Standard |language=en}} It first surfaced as a Russian-speaking Telegram channel in mid-January.{{Cite web |title=Anonymous Sudan {{!}} NETSCOUT |url=https://www.netscout.com/blog/asert/anonymous-sudan |access-date=2024-02-14 |website=www.netscout.com |language=en}} Some experts,{{Cite web |title='Hactivists' who targeted Microsoft claim they're working for Sudan |url=https://fortune.com/europe/2023/06/28/hactivists-targeted-microsoft-anonymous-sudan-security-experts-convinced-russia-behind-it/ |access-date=2024-02-14 |website=Fortune Europe |language=en}} including cybersecurity company CyberCX,{{Cite news |last=Taylor |first=Josh |date=19 June 2023 |title=Hackers behind Microsoft outage most likely Russian-backed group aiming to 'drive division' in the west |url=https://www.theguardian.com/technology/2023/jun/19/hackers-behind-microsoft-outage-most-likely-russian-backed-group-aiming-to-drive-division-in-the-west |access-date=11 July 2023 |work=The Guardian |language=en-GB |issn=0261-3077}} believe the group originates from or is supported by Russia. Writing on Telegram, the group responded to a Truesec report of its connection to Russia{{cite web |title=Anonymous Sudan: Threat intelligence report |url=https://files.truesec.com/hubfs/Reports/Anonymous%20Sudan%20-%20Publish%201.2%20-%20a%20Truesec%20Report.pdf |publisher=Truesec |access-date=February 18, 2025 |quote=The group is only active on Telegram, like Russian hacktivist groups, and only interacts with Russian actors...Most posts are made in English and Russian, but not Arabic.}} by saying, "We have nothing to do with Russia...We help them because they helped us before, and this is a way to give back."{{cite news |title=Posing as Islamists, Russian hackers take aim at Sweden |url=https://www.japantimes.co.jp/news/2023/05/14/world/russia-hackers/ |access-date=February 18, 2025 |work=Japan Times |date=May 14, 2023 |quote=Anonymous Sudan, for its part, has dismissed claims that it works on behalf of Russia. "We have nothing to do with Russia," the group wrote on Telegram, after Truesec published a report in February outing the group. "We help them because they helped us before, and this is a way to give back."}}

Ahmed and Alaa Salah Yusuuf Omer are accused of running Anonymous Sudan. On 16 October 2024, a federal grand jury indicted both brothers in California for their alleged roles in operating the cybercriminal organization.{{Cite web |last=Bestari |first=Novina Putri |title=Internet Lumpuh Gara-gara Ulah Kakak Beradik, Nasibnya Tragis |url=https://www.cnbcindonesia.com/tech/20241017120150-37-580495/internet-lumpuh-gara-gara-ulah-kakak-beradik-nasibnya-tragis |access-date=2024-10-17 |website=CNBC Indonesia |language=id}} The charges include conspiracy to damage protected computers, with Ahmed facing additional counts for damaging computers.

Anonymous Sudan claims to target countries and organizations engaging in purported anti-Muslim activity.{{Cite web |title=What is Anonymous Sudan? |url=https://www.cloudflare.com/learning/ddos/glossary/anonymous-sudan/ |website=Cloudflare}} The group claims to be anti-Zionist,{{Cite web |last=Gold |first=Jon |title=London internet attack highlights confusing hacktivism movement |url=https://www.csoonline.com/article/1291724/london-internet-attack-highlights-confusing-wide-ranging-hacktivism-movement.html |access-date=2024-02-14 |website=CSO Online |language=en}} as well as pro-Islam;{{Cite web |date=2023-11-27 |title=Anonymous Sudan: Pro-Islamic Hacker Group Engages in Cryptocurrency Donation Campaign |url=https://ict.org.il/anonymous-sudan-hacker-group/ |access-date=2024-02-14 |website=ICT |language=en-US}}{{Cite news |date=2023-05-14 |title=Posing as Islamists, Russian Hackers Take Aim at Sweden |url=https://www.bloomberg.com/news/features/2023-05-14/posing-as-islamists-russian-hackers-take-aim-at-sweden |access-date=2024-02-14 |work=Bloomberg.com |language=en}} however, they have also collaborated with pro-Russian attack groups like Killnet,{{Cite journal |date=2023 |title=Anonymous Sudan and Killnet Factor in the Russia-Ukraine War in the Context of Cyber Security |url=https://www.ceeol.com/search/article-detail?id=1205994 |journal=Future Human Image |language=English |issue=19 |pages=34–40 |issn=2311-8822}} and their attacks seem to align with a pro-Russian agenda. As a response to the International Committee of the Red Cross rules of engagement for civilian hackers, a representative of Anonymous Sudan said these rules were "not viable and that breaking them for the group's cause is unavoidable".{{Cite news |last=Tidy |first=Joe |date=2023-10-04 |title=Rules of engagement issued to hacktivists after chaos |url=https://www.bbc.com/news/technology-66998064 |access-date=2023-10-15 |publisher=BBC News}}

According to the cybersecurity firm Radware, the hacker group SN_BLACKMETA, which claims responsibility for two attacks on the Internet Archive in 2024{{citation |last=Lyons |first=Jessica |title=Multi-day DDoS storm batters Internet Archive |date=29 May 2024 |url=https://www.theregister.com/2024/05/29/ddos_internet_archive |archive-url=https://archive.today/20240601081103/https://www.theregister.com/2024/05/29/ddos_internet_archive/ |archive-date=1 June 2024 |publisher=The Register}}{{Citation |last=Davis |first=Wes |title=The Internet Archive is under attack, with a breach revealing info for 31 million accounts |date=2024-10-10 |url=https://www.theverge.com/2024/10/9/24266419/internet-archive-ddos-attack-pop-up-message |access-date=2024-10-10 |archive-url=https://archive.today/20241010052449/https://www.theverge.com/2024/10/9/24266419/internet-archive-ddos-attack-pop-up-message |archive-date=10 October 2024 |publisher=The Verge}} and claims pro-Palestinian motives, may be linked to Anonymous Sudan due to similarities in their operations, target choices, and rhetoric. Radware researchers suggested that the letters "SN" could stand for "Sudan".{{citation |title=Six-day, 14.7 Million RPS Web DDoS Attack Campaign Attributed to SN_BLACKMETA |date=24 July 2024 |url=https://www.radware.com/security/threat-advisories-and-attack-reports/six-day-web-ddos-attack-campaign/ |archive-url=https://archive.today/20241010155819/https://www.radware.com/security/threat-advisories-and-attack-reports/six-day-web-ddos-attack-campaign/ |archive-date=10 October 2024 |publisher=Radware}} According to a German source, SN_BLACKMETA is a Russian hacker group from the region around the Russian city of Veliky Novgorod, southeast of Saint Petersburg, and claim to have no state sponsorship.{{cite web |last=Schräer |first=Frank |title=Cyber attack on Internet Archive apparently carried out by Russian hackers |work=Heise Online |date= 17 October 2024|access-date=2024-10-17 |url=https://www.heise.de/en/news/Cyber-attack-on-Internet-Archive-apparently-carried-out-by-Russian-hackers-9983840.html}}

Anonymous Sudan has launched a variety of DDoS attacks against targets in Sweden, Denmark,{{Cite web |date=2023-11-29 |title=LockBit, Anonymous Sudan Attacks and More |url=https://www.globalsign.com/en/blog/lockbit-anonymous-attacks-november-newsscam |access-date=2024-02-14 |website=GlobalSign |language=en}} the US,{{Cite web |date=2023-07-21 |title=Anonymous Sudan's DDoS attacks against US targets |url=https://incyber.org/en/anonymous-sudans-ddos-attacks-against-us-targets/ |access-date=2024-02-14 |website=InCyber |language=en-GB}} Australia,{{Cite web |date=2023-06-19 |title=Who is 'Anonymous Sudan'? |url=https://www.abc.net.au/listen/programs/radionational-drive/1606/102497420 |access-date=2024-02-14 |website=ABC listen |language=en-AU}} and other countries. Their victims include Cloudflare,{{Cite web |last=Staff |first=S. C. |date=2023-11-13 |title=Anonymous Sudan DDoS attack hits Cloudflare website |url=https://www.scmagazine.com/brief/anonymous-sudan-ddos-attack-hits-cloudflare-website |access-date=2024-02-14 |website=SC Media |language=en}} Associated Press,{{Cite web |date=2023-11-01 |title=AP cyberattack: Has Anonymous Sudan hit Associated Press? |url=https://techmonitor.ai/technology/cybersecurity/ap-cyberattack-associated-press-anonymous-sudan-ddos |access-date=2024-02-14 |language=en-US}} Netflix,{{Cite web |date=2023-10-02 |title=Netflix impacted by Anonymous Sudan DDoS attack |url=https://www.scmagazine.com/brief/netflix-impacted-by-anonymous-sudan-ddos-attack |website=Media}}{{Cite web |last=Power|first=Shannon |date=2023-09-29 |title=Netflix taken down by hackers over LGBTQ+ content |url=https://www.newsweek.com/netflix-hacked-lgbtq-hulu-down-1830810 |access-date=2024-02-14 |website=Newsweek |language=en}} and PayPal,{{Cite web |date=2023-07-17 |title=Anonymous Sudan claims successful DDoS cyberattack on PayPal |url=https://techmonitor.ai/technology/cybersecurity/anonymous-sudan-paypal-ddos-cyberattack |access-date=2024-02-14 |language=en-US}} among others. Anonymous Sudan has successfully disrupted the website of Scandinavian Airlines (SAS),{{Cite web |last=Staff |first=S. C. |date=2023-06-01 |title=Scandinavian Airlines receives $3M demand to cease Anonymous Sudan DDoS attacks |url=https://www.scmagazine.com/brief/scandinavian-airlines-receives-3m-demand-to-cease-anonymous-sudan-ddos-attacks |access-date=2024-02-14 |website=SC Media |language=en}} and even took down Microsoft 365 software suite, including Teams and Outlook. They also took Twitter (now known as X) offline in more than a dozen countries to pressure Elon Musk to enable Starlink service for Sudan.{{Cite news |date=2023-08-31 |title=Anonymous Sudan hacks X to put pressure on Elon Musk over Starlink |url=https://www.bbc.com/news/technology-66668053 |access-date=2024-02-13 |work=BBC News |language=en-GB}}{{Cite news |last=Farmer |first=Ben |date=2023-08-31 |title=Hackers shut down Twitter putting Musk under pressure to extend Starlink internet service to Sudan |url=https://www.telegraph.co.uk/news/2023/08/31/hackers-twitter-musk-pressure-sudan-starlink/ |access-date=2024-02-14 |work=The Telegraph |language=en-GB |issn=0307-1235}} According to the Cyberint Research Team, the group launched 670 attacks in their first 6 months of activity.{{Cite web |title=Anonymous Sudan Launches Cyberattack on Chad Telco |url=https://www.darkreading.com/cyberattacks-data-breaches/anonymous-sudan-launches-cyberattack-on-chad-telco |access-date=2024-02-14 |website=www.darkreading.com |language=en}} On 8 June 2023, Anonymous Sudan claimed responsibility for a DDoS attack on Azure portal, which caused an outage of this and other Microsoft cloud services between ~15 UTC and ~17:30 UTC.{{Cite web |title=Azure status history {{!}} Microsoft Azure |url=https://azure.status.microsoft/en-us/status/history/ |access-date=2024-02-13 |website=azure.status.microsoft}}

During the ongoing civil war in Sudan between the Sudanese Armed Forces (SAF) and Rapid Support Forces (RSF), Anonymous Sudan launched cyberattacks on the Kenyan government and private websites in the last week of July 2023, in retaliation for the country's support of the RSF.{{Cite web |date=31 July 2023 |title=Sudan hackers target Kenyan govt websites |url=https://www.dabangasudan.org/en/all-news/article/sudan-hackers-target-kenyan-govt-websites |url-status=live |archive-url=https://web.archive.org/web/20230730193414/https://www.dabangasudan.org/en/all-news/article/sudan-hackers-target-kenyan-govt-websites |archive-date=30 July 2023 |access-date=31 July 2023 |website=Radio Dabanga}}{{Cite news |date=2023-07-28 |title=Kenya cyber-attack: Why is eCitizen down? |url=https://www.bbc.com/news/world-africa-66337573 |access-date=2024-02-14 |language=en-GB}} In January and February 2024, Anonymous Sudan claimed to have disabled all internet services in Chad and Djibouti, respectively, as part of a cyberattack to protest the country's relations with the RSF.{{Cite web |date=6 February 2024 |title=Anonymous Sudan hacks IGAD countries over alleged RSF support |url=https://sudantribune.com/article282046/ |access-date=7 February 2024 |website=Sudan Tribune |language=en}} The group continued attacking Intergovernmental Authority on Development (IGAD) countries, including Uganda in February, due to their backing of the RSF.{{Cite web |last=Kwinika |first=Savious Parker |date=2024-02-09 |title=Anonymous Sudan attacks again, this time in Uganda |url=https://itweb.africa/content/WnxpEv4YRKE7V8XL |access-date=2024-02-14 |website=ITWeb Africa |language=en-ZA}} The group also attacked the United Arab Emirates, a major supporter of the RSF.{{Cite web |date=2024-02-02 |title=Anonymous Sudan claims responsibility for cyber attacks on UAE entities {{!}} Digital Watch Observatory |url=https://dig.watch/updates/anonymous-sudan-claims-responsibility-for-cyber-attacks-on-uae-entities |access-date=2024-02-14 |language=en-US}}

On 10 July 2023, Anonymous Sudan attacked fanfiction site Archive of Our Own with a denial-of-service attack. Anonymous Sudan claimed responsibility in a Telegram post, saying the act was motivated by the website's United States registration and its inclusion of sexual and LGBTQ content.{{cite web |last=Hollingworth |first=David |date=11 July 2023 |title=Fanfic Writers Targeted by Anonymous Sudan in Apparent DDOS Attack on AO3 |url=https://www.cybersecurityconnect.com.au/commercial/9292-fanfic-writers-targeted-by-anonymous-sudan-in-apparent-ddos-attack-on-ao3 |access-date=11 July 2023 |website=Cyber Security Connect}}{{cite web |last=Diaz |first=Ana |date=10 July 2023 |title=Archive of Our Own is down due to a DDoS attack |url=https://www.polygon.com/23790167/ao3-down-ddos-attack-archive-of-our-own |access-date=11 July 2023 |website=Polygon}} The group then demanded $30,000 worth of Bitcoin within 24 hours to end the attack. The site came back online the next day with Cloudflare protection added.{{cite web |last=Weatherbed |first=Jess |date=11 July 2023 |title=The massive fanfic archive AO3 is back after a wave of DDoS attacks |url=https://www.theverge.com/2023/7/11/23790860/ao3-fanfiction-archive-down-outage-ddos-attacks |access-date=11 July 2023 |website=The Verge}}

During the Gaza war, media teams operating in the region have been exposed to various kinds of cyberattack. The Jerusalem Post website went down on 9 October 2023, with Anonymous Sudan claiming responsibility. The Palestinian Authority news agency Wafa also experienced a cyberattack on 18 October 2023, as did Al Jazeera English on 31 October 2023 and Al-Mamlaka TV on 3 November 2023.{{cite web |title=Attacks, arrests, threats, censorship: The high risks of reporting the Israel-Gaza war |url=https://cpj.org/2023/11/attacks-arrests-threats-censorship-the-high-risks-of-reporting-the-israel-hamas-war/ |url-status=live |archive-url=https://web.archive.org/web/20231113122417/https://cpj.org/2023/11/attacks-arrests-threats-censorship-the-high-risks-of-reporting-the-israel-hamas-war/ |archive-date=2023-11-13 |access-date=2023-11-13 |publisher=Committee to Protect Journalists}} In November 2023, the group targeted Israel infrastructure.{{Cite web |title=Anonymous Sudan Targets Israel's Critical Infrastructure – Westoahu Cybersecurity |url=https://westoahu.hawaii.edu/cyber/global-weekly-exec-summary/anonymous-sudan-targets-israels-critical-infrastructure/ |access-date=2024-02-14 |language=en-US}}{{Cite web |date=2023-10-15 |title=How hackers piled onto the Israeli-Hamas conflict |url=https://www.politico.eu/article/israel-hamas-war-hackers-cyberattacks/ |access-date=2024-02-14 |website=POLITICO |language=en}} In December 2023, Anonymous Sudan launched a DDoS attack on ChatGPT,{{cite web |last=Jain |first=Samiksha |date=15 Dec 2023 |title=Anonymous Sudan Targets OpenAI Again, Demands Firing of Research Head |url=https://thecyberexpress.com/anonymous-sudan-openai-cyberattack/ |archive-url=https://archive.today/20231217202929/https://thecyberexpress.com/anonymous-sudan-openai-cyberattack/ |archive-date=17 December 2023 |work=The Cyber Express}}{{Cite web |last=Sharma |first=Aakash |date=19 Dec 2023 |title='Will target ChatGPT until it stops dehumanizing Palestinians': Hackers on outage |url=https://www.indiatoday.in/world/story/chatgpt-outage-cyberattackers-accuses-open-ai-tool-of-bias-amid-israel-hamas-war-2477825-2023-12-19 |archive-url=https://archive.today/20231228152205/https://www.indiatoday.in/world/story/chatgpt-outage-cyberattackers-accuses-open-ai-tool-of-bias-amid-israel-hamas-war-2477825-2023-12-19 |archive-date=28 December 2023 |work=India Today |location=Delhi}}{{Cite web |last=Winder |first=Davey |title=ChatGPT Down As Anonymous Sudan Hackers Claim Responsibility |url=https://www.forbes.com/sites/daveywinder/2023/11/10/chatgpt-down-as-suspected-cyber-attackers-strike/ |access-date=2024-02-14 |website=Forbes |language=en}} after Tal Broda, a member of OpenAI's leadership, made a social media post dehumanizing Palestinians, calling for more intense bombing in Gaza, and advocating ethnic cleansing.{{cite web |last1=Sabin |first1=Sam |title=Anonymous Sudan hacking group sets sights on ChatGPT |url=https://www.axios.com/2023/12/16/chatgpt-hacking-group-anonymous-sudan |access-date=14 January 2024 |website=Axios|date=16 December 2023 }}{{cite web |last=Varanasi |first=Lakshmi |date=15 Dec 2023 |title=Hackers behind recent ChatGPT outage say they'll target the AI bot until it stops 'dehumanizing' Palestinians |url=https://www.businessinsider.com/hackers-behind-chatgpt-outage-bot-must-stop-dehumanizing-palestinians-2023-12?IR=T |archive-url=https://archive.today/20231217123539/https://www.businessinsider.com/hackers-behind-chatgpt-outage-bot-must-stop-dehumanizing-palestinians-2023-12?IR=T |archive-date=17 December 2023 |work=Business Insider}}

In January 2024, Anonymous Sudan failed to hack the London Internet Exchange in response to the UK's missile strikes in Yemen.{{Cite web |title=Anonymous Sudan claims cyberattack on London Internet Exchange in response to UK's Yemen strikes |url=https://www.teiss.co.uk/news/anonymous-sudan-claims-cyberattack-on-london-internet-exchange-in-response-to-uks-yemen-strikes-13362 |access-date=2024-02-14 |website=teiss |language=En}} The group targeted systems at the University of Cambridge and the University of Manchester on 19 February 2024, citing the United Kingdom's support for Israel in the Gaza war, and targeting these specific universities "because they are the biggest ones" they could find. Disruption was largely over by 20 February, though some systems were still affected.{{Cite web |last=Jack |first=Patrick |date=2024-02-20 |title=UK universities targeted by cyberattack |url=https://www.timeshighereducation.com/news/uk-universities-targeted-cyber-attack |access-date=2024-02-22 |website=Times Higher Education |language=en}}

Anonymous Sudan forced the closure of the emergency department at Cedars-Sinai Medical Center in California for approximately eight hours, redirecting incoming patients to other medical facilities. The total damages incurred as a result of these attacks were estimated to exceed $10 million.

In October 2024, a US federal grand jury in the Central District of California indictment was unsealed, which detailed the March 2024 indictment, arrest, and charging of two Sudanese nationals brothers, Ahmed Salah Yusuuf Omer, 22, and Alaa Salah Yusuuf Omer, 27, for their alleged involvement in operating and controlling the cybercriminal group Anonymous Sudan. They are charged with one count of conspiracy to damage protected computers, with Ahmed facing three additional counts of damaging protected computers. The indictment claims that the group was responsible for tens of thousands of DDoS attacks against critical infrastructure, corporate networks, and government agencies both in the United States and around the world.{{Cite web |last=Baran |first=Guru |date=2024-10-17 |title=Anonymous Sudan Hackers Charged for Cyber Attacks on Critical Infrastructure |url=https://cybersecuritynews.com/anonymous-sudan-hackers-charged/ |access-date=2024-10-17 |website=Cyber Security News |language=en-US}}

In March 2024, the US Department of Justice and FBI seized and disabled Anonymous Sudan’s Distributed Cloud Attack Tool (DCAT), which had been utilized to conduct these cyberattacks. Over a one-year period, the tool was reportedly employed in more than 35,000 DDoS attacks, impacting high-profile targets, including the U.S. Department of Justice, Department of Defense, and Cedars-Sinai Medical Center in Los Angeles.{{Cite web |date=2024-10-16 |title=US charges 2 with running 'Anonymous Sudan' hacking group |url=https://www.nextgov.com/cybersecurity/2024/10/us-charges-2-running-anonymous-sudan-hacking-group/400325/ |access-date=2024-10-17 |website=Nextgov.com |language=en}}

If convicted, Ahmed faces a potential maximum sentence of life in federal prison, while Alaa could face up to five years.{{Cite web |title=Sudanese brothers charged for 'Anonymous Sudan' attacks targeting critical infrastructure, government agencies and hospitals |url=https://therecord.media/anonymous-sudan-brothers-charged-ddos-attacks-hospital-critical-infrastructure#:~:text=%E2%80%9CFor%20example,%20Anonymous%20Sudan's%20DDoS,in%20damages%20to%20U.S.%20victims.%E2%80%9D |access-date=2024-10-17 |website=therecord.media}}

{{Reflist}}

{{Hacking in the 2020s}}

Category:Hacker groups

Category:Hacking in the 2000s

Category:Hacktivists

Category:Hacking in the 2020s

Category:Organizations established in 2023

Category:Cyberattack gangs

Category:Anti-Zionist organizations

Category:Islamist groups

Category:Opposition to Islamophobia

Category:Russia–Sudan relations

Category:Islamic organizations that oppose LGBTQ rights