Anonymous Sudan
Anonymous Sudan ran high-volume application-layer (layer 7) DDoS attacks while presenting itself as a hacktivist group. US prosecutors allege its attacks caused more than $10 million in damage to US victims and shut a hospital emergency department for about eight hours.
- Public attribution
- In October 2024 the US Department of Justice unsealed charges against two Sudanese nationals for operating and controlling the group.
- Active since
- Around 2023
- Targets
- Government, healthcare and technology services
- Large online platforms and cloud services
Status: Reported disrupted in March 2024 when US authorities seized its DDoS tool; charges unsealed October 2024.
Notable campaigns
2023Layer 7 DDoS on Microsoft services
Microsoft reported HTTP(S) floods, cache bypass and Slowloris attacks by an actor it tracks as Storm-1359; the attacks were publicly claimed by Anonymous Sudan.
2024Takedown and charges
US authorities seized the group's DDoS tool in March 2024; the indictment was unsealed in October 2024.
Signature ATT&CK techniques
- T1498Network Denial of Service
- T1499.002Endpoint Denial of Service: Service Exhaustion Flood
- T1499.003Endpoint Denial of Service: Application Exhaustion Flood
- T1583.003Acquire Infrastructure: Virtual Private Server
- T1090Proxy
Mapped to ATT&CK from the behaviour described in the cited sources; MITRE has no group entry for this actor.
Defences that work against this actor
- Put public services behind a CDN or DDoS protection service with layer 7 (WAF) rules, not just network-layer scrubbing.
- Rate-limit by client, and challenge or block traffic patterns such as cache-busting query strings.
- Tune server timeouts to resist slow-connection attacks such as Slowloris.
- Have a DDoS runbook and provider contacts ready before an attack.