Anonymous Sudan

Overview

Anonymous Sudan emerged in mid-January 2023 on Telegram — initially as a Russian-language channel — claiming to conduct DDoS attacks against countries interfering in Sudanese politics. Within its first six months, the group launched 670 attacks according to Cyberint Research, rapidly establishing itself as one of the most prolific DDoS operations in the threat landscape. The group's stated ideology shifted between Sudanese nationalism, Islamist motivations, anti-Zionist positioning, and pro-Russia alignment — a combination that generated sustained debate among analysts over whether the group was genuinely ideologically driven, a front for Russian information operations, or a financially motivated extortion operation using ideology as cover.

The FBI's investigation, confirmed in the October 2024 indictment unsealing, concluded that Anonymous Sudan was led by Sudan-based individuals — specifically the brothers Ahmed and Alaa Salah — rather than being a Russian state operation. However, the group's documented coordination with KillNet, their targeting patterns consistent with pro-Russia disruption campaigns, their Telegram posts in Russian, and their involvement in the "Darknet Parliament" alongside KillNet and a purported REvil representative suggest ideological alignment with Russian interests regardless of operational origin. The US Attorney described this as a group that "sought to maximize havoc and destruction against governments and businesses around the world."

What distinguished Anonymous Sudan from typical hacktivist operations was the technical sophistication of DCAT. Rather than using a traditional botnet of compromised devices, DCAT leveraged open proxies and rented cloud infrastructure to generate volumetric Layer 7 application-layer attacks that bypassed standard DDoS mitigation services. The tool was commercially offered as a service to other criminal actors, generating revenue alongside the group's own attacks. Alaa Salah was responsible for DCAT's development and infrastructure; Ahmed Salah conducted the attacks and managed Telegram channels that at one point had up to 80,000 subscribers. A PayPal account investigation in July 2023 ultimately identified email addresses linked to the brothers, leading to their March 2024 arrest.

Target Profile

Anonymous Sudan's target selection was ideologically framed but operationally eclectic, mixing geopolitically motivated campaigns with financially motivated extortion against organizations with no obvious political connection to their stated causes.

• Western government agencies: US federal agencies including the Department of Justice, Department of Defense, FBI, and State Department were targeted, framed as retaliation for US foreign policy positions. The indictment's specific counts against Ahmed Salah center on these government agency attacks.
• Healthcare: US hospitals including Cedars-Sinai Medical Center in Los Angeles were targeted in the context of anti-Israel statements — the group posted "Bomb our hospitals in Gaza, we shut down yours too, eye for eye" before the February 2024 Cedars-Sinai attack that diverted emergency patients for eight hours. Ahmed Salah faces potential life imprisonment in part because the Cedars-Sinai attack may be the first time in US history that a cyberattack charge included reckless endangerment of life.
• Major technology platforms: Microsoft Azure, Outlook, and OneDrive suffered weeks of DDoS outages in June 2023 that Microsoft eventually attributed to the group. OpenAI's ChatGPT was targeted in December 2023 following a statement by an OpenAI executive. Riot Games, Tinder, Lyft, PayPal, and X (Twitter) were also targeted.
• Scandinavian and European targets: Anonymous Sudan launched its first campaign against Scandinavian Airlines in February 2023 following a Quran-burning incident in Stockholm, extorting the airline with demands to stop DDoS attacks. The European Investment Bank was attacked in June 2023. Universities in the UK — Cambridge and Manchester — were targeted in February 2024.
• African and Middle Eastern governments: The Kenyan government was targeted in July 2023 in retaliation for Kenya's position in Sudan's civil war. In January and February 2024, the group claimed to have disrupted internet services in Chad and Djibouti over their relations with the Rapid Support Forces (RSF). Israeli infrastructure was targeted in November 2023.
• Pro-Russia campaign targets: Anonymous Sudan participated in pro-Russia hacktivist campaigns coordinated with KillNet and Türk Hack Team, attacking organizations in countries supporting Ukraine. The joint "Darknet Parliament" statement in June 2023 threatened European banking infrastructure including SWIFT and SEPA systems.

Tactics, Techniques & Procedures

Anonymous Sudan's TTP set was dominated by a single primary capability — DDoS — executed with technical sophistication that went significantly beyond commodity attack tools. The group's ability to bypass enterprise DDoS mitigation services was its defining technical trait.

mitre id	technique	description
T1498.001	Network DoS — Direct Network Flood	DCAT (Distributed Cloud Attack Tool) — also called Godzilla, Skynet, and InfraShutdown — generated volumetric Layer 7 application-layer DDoS attacks using open proxies and rented cloud infrastructure rather than a traditional botnet of compromised devices. This approach made attack traffic appear to originate from legitimate cloud providers, complicating mitigation.
T1498.002	Reflection Amplification / HTTP Floods	Microsoft documented three DCAT attack types: HTTPS flood attacks distributing millions of requests across globally distributed source IPs, cache bypass attacks bypassing CDN caching by requesting unique content with each request, and Slowloris attacks holding connections open to exhaust server connection pools. Each method targeted different defensive layers, requiring organizations to counter all three simultaneously.
T1583.004	Acquire Infrastructure — Cloud Servers	DCAT used rented cloud infrastructure and virtual private servers rather than compromised endpoints. This model reduced operational security risk (no victim machines to trace back), enabled rapid scaling, and made traffic appear to originate from legitimate cloud hosting providers including major platforms — bypassing IP reputation-based DDoS mitigation.
T1583.008	Acquire Infrastructure — Open Proxies	Open proxies formed a core component of DCAT's attack network alongside rented cloud servers. By routing attack traffic through open proxies distributed globally, the tool further obfuscated attack origin and distributed the traffic load across a broader set of source addresses than pure cloud infrastructure would allow.
T1583.006	Acquire Infrastructure — API Exploitation	CrowdStrike documented the group's ability to quickly identify and exploit vulnerable API endpoints — specifically those that, when overwhelmed with requests, would render services inoperable. This targeted API-level disruption was particularly effective against cloud services like Microsoft Azure and OpenAI's ChatGPT, where individual API endpoints lacked the same DDoS protection as primary web endpoints.
T1566	Phishing / Social Engineering — Extortion Demands	Anonymous Sudan combined DDoS attacks with financial extortion, demanding payments to cease attacks. Demands included $1 million from Microsoft, $3 million from Scandinavian Airlines (later revised to $10 million in a second campaign), and leveraging check-host.net availability monitoring as proof-of-disruption in Telegram negotiations with clients and targets.
T1588	Obtain Capabilities — DDoS-as-a-Service	DCAT was commercially offered as a service to other criminal actors via Telegram, with pricing and capability advertisements posted publicly. Indictment communications revealed the operators actively negotiated with clients — one message stated "I am carrying out an organized attack on the United States. We can target the airport." The DaaS model created a revenue stream alongside the group's own ideologically framed campaigns.
T1594	Search Victim-Owned Websites / OSINT	The group used open-source tools including check-host.net to verify and publicly demonstrate the effectiveness of attacks in real time, posting availability monitoring results on Telegram to validate claims and maintain credibility with clients and followers. GitHub was used for code development — the group also attacked GitHub in January 2024 after the platform's use in their operations.

Known Campaigns

Selected high-profile operations across the group's 14-month active period, illustrating the breadth of targeting and the evolution from ideological campaigns to commercially motivated extortion.

Tools & Malware

Anonymous Sudan's operational capability was almost entirely centered on a single custom-built tool — DCAT — rather than a broad malware ecosystem. The tool's sophistication came from its infrastructure model and attack variety rather than code complexity.

• DCAT — Distributed Cloud Attack Tool (Godzilla / Skynet / InfraShutdown): The group's signature custom DDoS platform, developed by Alaa Salah. Used rented cloud servers and open proxies rather than compromised endpoints as its attack infrastructure. Generated Layer 7 application-layer attacks via three methods: HTTPS flood (millions of globally distributed requests overwhelming backend processing and memory), cache bypass (unique requests bypassing CDN caching forcing origin server processing), and Slowloris (persistent connection exhaustion). The tool included an API enabling client access for the DaaS offering. Source code and infrastructure were seized by the FBI in March 2024.
• Skynet Botnet: An early version or component of the DCAT infrastructure, referenced separately in FBI affidavits from DCAT. Used open proxies for attack traffic routing. Amazon employees who examined Skynet Botnet attack data against Amazon customers provided evidence cited in the criminal complaint.
• Telegram channels: The group's primary command, control, and communications infrastructure — at peak reaching 80,000 subscribers. Used to announce attacks, post proof-of-disruption links from check-host.net, negotiate with extortion targets, advertise DaaS pricing, and coordinate with allied hacktivist groups. Messages were posted in Arabic, English, and Russian. Ahmed Salah managed these channels and was identified by FBI investigators through his alias WilfordCEO, which he confirmed during an FBI interview in March 2024.
• check-host.net: A legitimate internet resource availability monitoring service that Anonymous Sudan used to verify and publicly demonstrate the success of DDoS attacks in real time — posting links as proof to Telegram followers and DaaS clients that targeted services were genuinely unreachable.

Indicators of Compromise

Given that Anonymous Sudan's primary attack type was DDoS, traditional host-based IOCs do not apply. Detection is primarily network-level, behavioral, and infrastructure-focused.

Mitigation & Defense

Anonymous Sudan's DCAT was specifically engineered to bypass standard DDoS mitigation. Defenses effective against commodity attack tools were less effective against DCAT's cloud-sourced, multi-method approach. The following controls reflect what worked and what did not.

• Layer 7 DDoS protection — not just Layer 3/4: DCAT targeted the application layer, bypassing network-level volumetric defenses. Effective protection requires Web Application Firewall (WAF) solutions with behavioral analysis capable of distinguishing HTTPS flood traffic from legitimate users. Rate limiting at the application layer — not just network layer — is essential.
• CDN cache behavior hardening: DCAT's cache bypass method exploited predictable CDN caching logic by generating requests with unique parameters that forced origin server processing. Configure CDN cache rules to aggressively cache content regardless of query string parameters for public-facing content, reducing the proportion of requests that reach origin servers during a cache bypass attack.
• API rate limiting and endpoint hardening: CrowdStrike identified DCAT's exploitation of vulnerable API endpoints as a key success factor. Implement rate limiting on all public API endpoints. Endpoints without business justification for high-volume access should have strict per-IP and per-session request limits, with anomaly detection alerting on request volume spikes.
• Slowloris connection timeout controls: Configure web servers to enforce aggressive connection timeout policies — dropping connections that have not completed their request within a defined window. Default timeout values on Apache, Nginx, and IIS are often too permissive for Slowloris resistance. Reverse proxy or load balancer layer timeouts provide an additional defense layer.
• IP reputation and cloud provider range filtering: DCAT used rented cloud infrastructure, meaning attack traffic came from IP ranges belonging to legitimate cloud providers. While blocking entire cloud provider ranges is impractical for most services, behavioral analysis can identify anomalous request patterns from cloud IP ranges and apply targeted rate limiting.
• DDoS response planning and upstream ISP coordination: Microsoft's eventual successful mitigation of DCAT attacks involved coordination with upstream providers. Organizations in sectors targeted by Anonymous Sudan should maintain pre-negotiated DDoS scrubbing arrangements with ISPs and CDN providers before an attack begins — reactive negotiation during an active multi-day DDoS campaign is significantly more difficult.
• Telegram monitoring for pre-attack indicators: Anonymous Sudan consistently announced targets and posted proof links on Telegram. Threat intelligence teams monitoring pro-Russia and hacktivist Telegram channels often had advance warning of targeting — sometimes hours before attacks began. Integrating open-source Telegram threat intelligence into SOC workflows provides actionable early warning for this threat category.

Sources & Further Reading

Attribution and references used to build this profile.

• BleepingComputer — US Disrupts Anonymous Sudan DDoS Operation, Indicts Two Sudanese Brothers (2024)
• The Record — Sudanese Brothers Charged for Anonymous Sudan Attacks (2024)
• Dark Reading — Anonymous Sudan Unmasked as Leader Faces Life in Prison (2024)
• CrowdStrike — DOJ Indicts Hacktivist Group for DDoS Attacks (2024)
• BleepingComputer — Microsoft Confirms Azure, Outlook Outages Caused by DDoS Attacks (2023)
• Flashpoint — Unmasking Anonymous Sudan: Timeline of DDoS Attacks, Affiliations, and Motivations
• SecurityWeek — Anonymous Sudan DDoS Service Disrupted, Members Charged by US (2024)
• Wikipedia — Anonymous Sudan (comprehensive attack timeline)
• BankInfoSecurity — US Indicts Sudanese Brothers for Anonymous Sudan Attacks (2024)