Cyber Threat Actor: Anonymous Catalonia

Anonymous Catalonia is a hacktivist group that operates under the alias Anonymous Catalonia and is based in Spain. The group came to public attention through a distributed denial‑of‑service attack on the website of Banco de España in August 2018, which they claimed responsibility for via social media. They identify themselves as part of the broader Anonymous collective and use the #OpCatalonia hashtag to label their activities. Their known location is Spain, and they have no publicly disclosed ties to any state or criminal organization.

The group’s targeting has focused on Spanish government institutions, including the central bank, the Constitutional Court, and the economy and foreign ministries. Their strategic objective appears to be disruption as a form of protest, specifically against the detention of Catalan independence leaders, as stated in their own communications. They employ DDoS attacks to render public‑facing websites intermittently inaccessible, aiming to convey a political message rather than to cause financial gain or espionage. The attacks are described as symbolic, with the group noting that the central bank’s core functions remained unaffected because it does not provide online banking services.

Observed tactics, techniques, and procedures involve the use of rented DDoS infrastructure to generate traffic floods, a method they describe as common among hacktivists seeking temporary disruption. They publicize successful operations by posting the #TangoDown hashtag on Twitter and providing proof of service outage. No malware families, initial access vectors, or specific tooling beyond the DDoS service are referenced in the available sources. Attribution to any state sponsor or criminal consortium has not been established publicly. The most notable campaign associated with the group is the #OpCatalonia series, which includes the Banco de España incident and earlier attacks on the Constitutional Court and ministry websites in August 2018.