Cyber Threat Actor: Sudoh4k3rs

Sudoh4k3rs is a hacker group that operates under the alias Sudoh4k3rs. Open‑source reporting indicates the group is based in Portugal. The group identifies itself on social media as a collection of hacktivists. It states that its motivation is to oppose what it describes as corrupt governments in Portugal and elsewhere. Sudoh4k3rs claims its actions are intended to serve the public interest.

The group’s known activity focuses on academic and governmental targets within Portugal. On 27 February 2015 Sudoh4k3rs breached the network of the University of Lisbon’s Institute of Social Sciences. Intruders obtained administrative passwords for the institute’s website and subsequently published them online. The password leak was accompanied by a statement that further cyber attacks would be directed at governmental and academic entities. The group linked the continuation of its campaign to the release of seven individuals who had been arrested for alleged connections to Anonymous Portugal. By demanding the detainees’ freedom, Sudoh4k3rs sought to use disruption as a lever to achieve a political objective.

The intrusion was carried out by gaining unauthorized access to the university’s systems during the early hours of the attack date. Once inside, the actors extracted credentials that provide administrative control over the site. The leaked credentials were then posted publicly as part of the pressure tactic. Communication with the public and the authorities was conducted through the group’s Facebook page. No specific malware families, exploit tools, or initial‑access vectors are described in the available source material.

Sudoh4k3rs presents itself as independent of any state sponsor and has not been publicly tied to a criminal consortium. The group references the earlier hacktivist collective Anonymous Portugal but asserts that it is a separate entity. Reporting notes that one of the detained individuals is Rui Cruz, the founder of the tugaleaks site, which is described as a Portuguese analogue to Wikileaks. The police operation that led to the arrests was designated C4R3T0S and involved twenty‑four house searches and the confiscation of numerous computer systems. Fourteen additional people were named arguidos (suspects) in the same investigation. Anonymous Portugal is said to have been active since 2011 and to have conducted prior attacks on ministries, police forces, banks and religious institutions, leaking confidential data in those incidents.

The 2015 attack on the Institute of Social Sciences represents the only publicly documented operation attributed to Sudoh4k3rs. This operation is notable for its use of password leakage as a means to demand the release of detained activists. The group’s statement warned of continued actions against governmental and academic targets until the detainees were freed. No further campaigns, tools or infrastructure have been publicly reported for Sudoh4k3rs after the 2015 incident. The available information limits the profile to the facts outlined above, with no speculation about size, sophistication or future intent.