Anonymous Sudan

Profile narrative

Anonymous Sudan, also tracked as Storm‑1359 by Microsoft, operates under the aliases Anonymous Sudan and Storm‑1359 and has been identified as originating from Sudan. Investigative reports from Swedish cybersecurity firm Truesec describe the group as most likely created as part of a Russian information operation intended to harm and complicate Sweden’s NATO application, and the actor has openly associated itself with the pro‑Russian hacker collective Killnet. Trustwave researchers have noted indications that Anonymous Sudan is financially motivated, citing an attempt to sell data stolen from the French flag carrier Air France, while the group’s own statements blend political grievances with extortion demands, such as the $3 million payment it sought from Scandinavian Airlines to halt DDoS activity. Public messages have cited UK support for Israel and actions in Gaza and Yemen, U.S. involvement in Sudanese affairs, Quran‑burning incidents in Scandinavia, and Israel’s celebration of the occupation of Palestine as justifications for attacks, showing a mix of ideological and monetary motives.

The actor’s primary technique is distributed denial‑of‑service flooding, initially relying on a cluster of sixty‑one paid servers hosted at IBM/Softlayer in Germany whose traffic was routed through open proxies to disguise the true source; after those servers were taken down following a Truesec report, the group announced a shift to using botnets and encouraged followers to adopt them. Telegram serves as the main platform for claiming responsibility, sharing screenshots of disrupted services, issuing extortion notes, and communicating with victims. In addition to DDoS, the actor has compromised social‑media accounts through phishing, as demonstrated by the hijacking of Israel’s President Herzog’s Telegram account, and has exploited platform features such as the Facebook collaboration tool to take over accounts. No specific malware families are mentioned in the sourced material, and the activity is limited to service disruption and account takeover rather than persistent intrusion or data‑destructive malware.

Reported operations illustrate a broad targeting pattern across governmental, financial, health, media, transportation and education sectors in multiple regions. The group disrupted internet services at several UK universities, including the University of Cambridge, via a DDoS attack on the Janet Network, and knocked the U.S. Treasury’s Electronic Federal Tax Payment System and Stripe’s payment dashboard offline. It caused repeated outages of Microsoft Outlook.com, targeted Scandinavian Airlines’ website and mobile app before issuing a $3 million extortion demand, and disrupted Danish hospitals and airport websites in reaction to Quran‑burning protests. During Israeli Independence‑Day and Quds‑Day periods, it struck Israeli banks, universities and the cyber‑security firm Check Point, and it affected Kenya’s eCitizen government services portal and the Associated Press news website. These actions demonstrate a focus on high‑visibility services that can be disrupted to convey political messages or to extract financial concessions.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 23 sources.