Two Leaders of Anonymous Sudan Arrested by U.S. Justice

Active since early 2023, the hacktivist group has enabled more than 35,000 DDoS attacks, several of which targeted sensitive Western entities.

The U.S. Department of Justice (DoJ) revealed on October 11, 2024, the arrest, in March 2024, of two Sudanese nationals accused of being the leaders of the hacktivist group Anonymous Sudan. Active since early 2023, the cybercriminal collective allegedly facilitated around 35,000 DDoS attacks, according to Europol figures. These attacks reportedly caused at least $10 million (€9.2 million) in damages to affected organizations in the United States.

Anonymous Sudan claimed responsibility for notable DDoS attacks, including against the DoJ, Microsoft, OpenAI, or PayPal in the United States, as well as against the French government’s interministerial network in March 2024. The group displayed close ties with the Russian hacktivists from Killnet, to the point that some analysts viewed Anonymous Sudan as a Russian group or aligned with Moscow’s objectives. Even the group’s Sudanese origin seemed doubtful.

However, DoJ investigators lean toward the hypothesis of a criminal and opportunistic positioning. Anonymous Sudan allegedly carried out spectacular attacks to promote its DDoS attack tool, with the aim of renting it out to other entities. Moreover, contrary to what the cybercriminals suggested, this tool was not connected to a botnet but to a series of powerful cloud servers.

According to cybersecurity giant CrowdStrike, Anonymous Sudan’s effectiveness relied on “a custom-built attack infrastructure hosted on high-bandwidth rented servers” and “sophisticated techniques to bypass DDoS mitigation services and the ability to quickly identify and exploit vulnerable API endpoints.”

The two suspects were arrested in an undisclosed country. The DoJ indictment also targets three other members of Anonymous Sudan, who are still at large.