Anonymous Sudan — Hacktivist Profile

Anonymous Sudan surfaced in January 2023 and ran roughly a year of high-volume denial-of-service campaigns before US authorities dismantled its infrastructure; Truesec dated the first wave, against Swedish targets, to 23 January 2023 and found no real connection between the crew and the older Anonymous collective whose name it adopted. The operators presented themselves as religiously motivated hacktivists acting on behalf of Sudan, but CyberCX and other researchers assessed the group as Russia-aligned, and it repeatedly staged joint operations with the pro-Russian Killnet network. Microsoft, which tracks the actor as Storm-1359, blamed it for the application-layer floods that took parts of Microsoft 365 and the Azure portal offline in June 2023; later victims ranged from OpenAI's ChatGPT and Scandinavian Airlines to healthcare providers. A US indictment unsealed in October 2024 charged two Sudanese brothers with operating the paid attack platform prosecutors called the Distributed Cloud Attack Tool, alleging more than 35,000 attacks in a single year, among them an eight-hour outage in the emergency department at Cedars-Sinai Medical Center. The Justice Department said the tool was disabled in March 2024, and the brand is tracked as inactive since that takedown.

Also tracked as

LameDuck, Storm-1359

IntelFusions coverage (1)

Tools & malware

Vendor research

Countries linked to this actor

Read the full analysis on IntelFusions