Cyber Incident Victim: TV 2
Date:
Mar 2023
Location:
Denmark
Summary
A prominent Danish media organization experienced a temporary disruption due to a DDoS attack claimed by the hacktivist group Anonymous Sudan. Technical teams promptly restored access after briefly blocking foreign traffic, with services stabilizing the following day. The group, which alleges Sudanese origins but is widely suspected by cybersecurity experts to have Russian ties, cited Quran burnings by a Danish-Swedish individual as motivation. However, analysts assessed this justification as a probable false flag to conceal geopolitical objectives. Anonymous Sudan has previously targeted Danish and Swedish critical infrastructure, including hospitals, universities, airports, and media platforms. Similar attacks in Sweden affected comparable sectors, reflecting a broader pattern of disruption against Scandinavian entities.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On the evening of March 10, 2023, Danish media organization TV 2 experienced a distributed denial-of-service (DDoS) attack targeting its online platforms, TV2.dk and TV 2 PLAY. The attack briefly overloaded the systems, causing temporary inaccessibility for users. Shortly afterward, an entity identifying itself as the hacker group Anonymous Sudan claimed responsibility via its Telegram channel, where it uploaded an image showing TV 2 Play as unavailable. This group had previously launched similar attacks against Danish and Swedish organizations over a six-week period, including hospitals, airports, universities, and public authorities. TV 2’s technical teams responded swiftly by blocking international access to stabilize services, restoring functionality by the following morning (March 11) for all users. Anonymous Sudan justified its broader campaign against Denmark and Sweden—without directly addressing why TV 2 specifically was targeted—as retaliation for Quran burnings by Danish-Swedish activist Rasmus Paludan, though security analysts dismissed this motive as a probable false flag.
The attack did not result in prolonged disruption, and TV 2 confirmed no data breaches or permanent infrastructure damage. While Anonymous Sudan claimed Sudanese origins and communicated with TV 2 in Arabic, cybersecurity experts like Trusec Group’s Marcus Murray questioned this attribution, citing technical and operational evidence suggesting Russian involvement. Another analyst, Steffen Friis of Vipre Security Group, noted parallels with Russian disinformation campaigns aimed at exploiting regional tensions. Anonymous Sudan’s prior operations included attacks on Danish hospital websites, airport systems, and academic institutions, mirroring its Swedish-targeted disruptions to airports, hospitals, and media outlets. TV 2’s communications team emphasized the rapid containment of the incident and restoration of normal operations. No further interaction occurred between the broadcaster and the group beyond its initial claim.