In recent cyber attacks, major entities such as Microsoft Outlook, UPS, and Scandinavian Airlines found themselves targeted by the notorious group, Anonymous Sudan. Despite the group portraying itself as an anti-Western pro-Islam collective, experts suggest it may be a pro-Kremlin initiative aimed at advancing a Russian agenda.
The success of Anonymous Sudan’s distributed denial-of-service (DDoS) attacks disrupted Scandinavian Airlines’ website and took down Microsoft 365, including Teams and Outlook. Although purported to be a hacker group originating from Sudan, evidence points to it being a “Made in Russia” project with substantial financial backing.
According to Mattias Wåhlén, a threat intelligence expert at Truesec, Anonymous Sudan is likely being orchestrated by someone with connections to the Russian government or those around the Russian leadership. The group’s alignment with the Kremlin’s narrative and its association with Killnet, another pro-Russian DDoS group, further supports this theory.
Anonymous Sudan first appeared as a Russian-speaking Telegram channel in January, adopting its name from a 2019 hacking operation by the original Anonymous collective. Despite initial attempts to capitalize on outrage related to Quran desecration, there’s no conclusive link between Anonymous Sudan and Sudan itself.
The group’s sudden shift to posting primarily in Russian and English, adopting Arabic later, raised suspicions. It became apparent that Anonymous Sudan aligns with Russia, refraining from attacking Russian sites even when incidents like Quran burning occur within the country. The group’s alliance with Killnet and their joint establishment of the “Darknet Parliament” for coordinated attacks solidifies the connection.
Anonymous Sudan’s attack methods primarily involve DDoS attacks on “soft targets,” employing layer four attacks such as SYN flood attacks. Despite the group’s focus on the pro-Russian narrative, it remains unclear who is behind Anonymous Sudan. Cybersecurity experts speculate that the group’s activities, communication patterns, and affiliations point towards a link with the Russian state, suggesting that the hacktivist façade may serve as a smokescreen to disrupt Western organizations.
