The US charges two Sudanese brothers with running Anonymous Sudan, a cyberattack-for-hire gang allegedly responsible for 35,000 DDoS attacks in a single year
Government says two brothers targeted big U.S. corporations, a hospital and an Israeli defense system in a mostly ideologically driven operation.
Washington PostJoseph Menn
Context & Ripple Effects
The case follows a 2023 investigation that described Anonymous Sudan as a self-styled hacktivist group and reported researchers’ ties to Russia; the new charges shift that story from public attribution to named alleged operators. Earlier reporting on the group’s disputed ties and targets makes the identification of two Sudanese brothers consequential.
It also extends a recurring U.S. enforcement approach to DDoS infrastructure: in 2022, the DOJ seized 48 alleged booter-service websites and charged six people. This case applies that playbook to an operation alleged to have paired attack-for-hire capability with ideological targeting.
First-order effects
The two accused brothers face U.S. criminal charges tied to the alleged operation, while Anonymous Sudan’s alleged activity is formally connected to attacks on U.S. companies, a hospital, and an Israeli defense system.
The charges give affected organizations and defenders a detailed official allegation against a group previously discussed primarily through researcher attribution.
Second-order effects
DDoS-for-hire operators and the services that enable them face renewed enforcement risk, reinforcing the precedent set by prior booter-site seizures and operator charges.
Organizations targeted for political or geopolitical reasons may treat ostensibly hacktivist DDoS campaigns as potentially organized criminal services, not solely as spontaneous protest activity.
Third-order effects
If cases continue to identify operators behind branded hacktivist campaigns, the boundary between ideological cyber activity and commercial cybercrime will become a more central enforcement and attribution question.
The pattern favors a security model in which disruption of attack-service operators complements defensive mitigation, though charges alone do not establish how durable that deterrent will be.
The trend: DDoS enforcement is increasingly focused on tracing public-facing hacktivist brands back to the people and service operations alleged to sustain them.
Beyond big companies, the brothers are accused of attacking Cedars-Sinai, the Israeli Red Alert rocket attack warning system the day of the Hamas attack, and government sites in the U.S. and elsewhere. While they also served customers, the group was driven by ideology.
Akamai's Security Intelligence and Response Team (SIRT) is proud to be part of the Big Pipes working group that assisted in the takedown of Anonymous Sudan. Read our blog post to learn more about the SIRT and our involvement in the takedown. https://www.akamai.com/... [video]
Scoop: Anonymous Sudan, an extraordinary cyberattack for hire gang, has been taken down by the U.S. and unnamed other governments after in-depth investigations by U.S. companies that lost millions to the gang's work. GIFT LINK in reply.
I faced a lot of backlash for this article and interview with Anonymous Sudan last year as everyone was convinced they were “The Russians” in-spite of the evidence I'd collected. Looks like they told me the truth. https://www.bbc.com/...
US has charged two men with running Anonymous Sudan, hackers who disrupted ChatGPT, Microsoft, Israel's missile alert system among hundreds of targets. One faces a max life sentence for his attacks on hospitals with alleged intent to kill. That's a first. https://www.wired.com/..…
Today US DOJ unsealed an indictment against two Sudanese men accused of orchestrating the Anonymous Sudan hacktivist group. This is a huge win for the good guys and I'm proud of the @CrowdStrike CAO team for their part supporting this effort! https://www.crowdstrike.com/ ...
Two Sudanese nationals indicted for alleged role in Anonymous Sudan cyberattacks on hospitals, government facilities, and other critical infrastructure in Los Angeles and around the world https://www.justice.gov/...