Threat Actor Characterization
Anonymous Sudan
ID: 07b6bffbe1da7c5177abf105066332ed43345| AnonymousSudan | — | — | — |
Related profiles
| ID | Threat | Origin | Type | Categories | |
|---|---|---|---|---|---|
|
9b3cd18f79d9e1d51728a310139561c332348 | KillNet | Russia | affiliated | Hacktivist Group |
|
29a0765877c8ff945846d15b13866e4784732 | Pro‑Palestine Hackers Movement | Palestine | ally-of | Hacktivist Group |
|
bdab2ea5d96983904c7307dda950e83743058 | REvil | Unknown | affiliated | Crimeware |
|
fdb5014ef144797b626949b3c253102782783 | SiegedSec | Unknown | co-actor | Hacktivist Group |
|
131885bdee7830a7b8da4526fc33b96895956 | UserSec | Russia | affiliated | Hacktivist Group |
Related files
Actor Network Graph
Open Network GraphMITRE ATT&CK®
Anonymous Sudan — high-tempo DDoS/extortion hacktivists active since 2023. Publicly linked by Microsoft to Storm-1359 Layer-7 DDoS waves; associated in 2023 with KillNet/REvil propaganda arcs. U.S. indictment (Oct 2024) charged two Sudanese nationals with operating the group and conducting tens of thousands of DDoS attacks. Capability: low–moderate technically, high in tempo and media impact.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1498 | Network Denial of Service | TA0040 | |
| T1657 | Financial Theft | TA0040 |
|
| T1585 | Establish Accounts | TA0042 |
|
| T1102 | Web Service | TA0011 |
|
| T1589 | Gather Victim Identity Information | TA0043 |
|
CLASSIFICATION: Unclassified / Open Source
Executive Summary
Anonymous Sudan is a prolific DDoS-focused hacktivist label active since early 2023, responsible for high-visibility availability attacks and public extortion against airlines, tech platforms, and government targets. Microsoft publicly associated the actor it tracks as Storm-1359 with the June 2023 Microsoft 365/Azure Layer-7 DDoS waves (focus on “disruption and publicity”) and described access to botnets/open proxy infrastructure. Reporting ties Anonymous Sudan’s operations to KillNet/REvil propaganda arcs in 2023; however, a U.S. federal indictment (Oct 16, 2024) charged two Sudanese nationals with operating and controlling Anonymous Sudan, crediting them with tens of thousands of DDoS attacks and detailing targets across critical infrastructure and the private sector. Impact has ranged from hours-long outages (e.g., SAS airline, Microsoft services, ChatGPT) to extortion demands and claimed targeting of Israeli alerting systems during wartime. Overall capability: low–moderate technical, high operational tempo and media impact. Confidence: high for the core picture (Microsoft/Cloudflare/LE sources).
- Branding & narrative. Self-presented as Sudanese/Islamic hacktivists; messaging aligned to anti-Western/anti-Israeli positions and topical geopolitical triggers. Analysts in 2023 frequently linked the group’s propaganda to pro-Russia hacktivist ecosystems (e.g., KillNet), especially when joint threats were issued.
- Attribution break. DoJ/Europol (Oct 2024) identified two Sudanese nationals as operators, challenging the earlier “pure front for Russia” hypothesis (though co-campaigning with pro-Russia labels still occurred).