Who is behind “Anonymous VNLBN”?

In early 2025, a previously unknown hacker collective named Anonymous VNLBN burst onto the scene, targeting Vietnamese government infrastructure and critical services. Since then, this enigmatic group has left cybersecurity experts, governments, and researchers scrambling to understand who they are and what drives them.

This article uncovers the mystery behind Anonymous VNLBN, their origins, motivations, methods, and the damage they’ve caused in just a few months.

What Is Anonymous VNLBN?

Anonymous VNLBN presents itself as a hacktivist group inspired by the well-known Anonymous movement. However, this new group claims to be more focused on Vietnamese institutions, using the tagline “Commando Army,” which hints at either nationalistic pride or an attempt to instill fear through military-style rhetoric. They first appeared online around March 14, 2025, primarily operating through Telegram. Within weeks, they amassed several hundred followers, showcasing screenshots of downed websites and making statements filled with sarcasm and political undertones. Their messaging often mocked public institutions, claiming victories like “entire provinces offline” and “servers permanently dead.”

How Many Attacks Have They Carried Out?

From March to early July 2025, Vietnam has been hit by a wave of cyberattacks. In total, there have been over 170 documented cyber incidents, and roughly 150 of those have been attributed directly to Anonymous VNLBN. Their attacks were not random. They specifically targeted over 35 organizations and nearly 160 websites, many of which belong to Vietnam’s provincial government departments. Most attacks occurred after March 23, and the intensity reached its peak on April 2 with over 30 attacks in a single day.

Government and Public Services: Prime Targets

Anonymous VNLBN has shown a clear focus: disrupting public life in Vietnam by targeting crucial government services.

Some of the most heavily affected sectors include:

• Justice and Law Portals: 8 out of 13 official justice department websites from western Vietnamese provinces were hit.

• Healthcare Services: Regional health departments in provinces like Trà Vinh and Cà Mau went offline for extended periods.

• Electricity and Energy: Multiple energy providers under EVNSPC were taken down, affecting electricity services in areas such as Vĩnh Long and Đồng Tháp.

• Embassy Websites: Vietnam’s embassy in China also came under attack.

These disruptions not only paralyzed public access to essential services but also attempted to shake the population’s trust in government infrastructure.

Part of a Bigger Hacktivist Network?

Although their name suggests a Vietnamese focus, Anonymous VNLBN has shown signs of being part of a wider international hacktivist movement. Their Telegram group uses phrases referencing collective defense, similar to NATO’s Article 5 clause, suggesting coordination with other global hacker factions. Reports show the group has claimed responsibility for attacks on websites in the U.S., France, and Israel, which may be attempts to gain recognition or align with other global cyber collectives.

Role in Asia’s Growing Hacktivist Surge

The emergence of Anonymous VNLBN fits into a broader pattern of cyber activism that has been growing across Asia in 2025. During escalating tensions between India and Pakistan, several hacker groups launched cyber offensives, and Anonymous VNLBN was among them. They joined the likes of Red Wolf Cyber, Keymous+, Islamic Hacker Army, and Sylhet Gang to claim responsibility for DDoS attacks on Indian infrastructure. In May 2025, India saw an average of seven DDoS attacks claimed every hour, indicating the scale and coordination involved in these digital campaigns.

Attack Techniques Used by Anonymous VNLBN

Anonymous VNLBN relies heavily on Distributed Denial-of-Service (DDoS) tactics to crash websites and public servers.

Here are some of the known techniques:

• UDP and HTTPS Floods: Massive traffic is sent to overload web servers.

• Form POST Attacks: Web forms are flooded to clog backend systems.

• Use of Open-source Tools: They reportedly use publicly available DDoS platforms like MegaMedusa and other botnets.

Additionally, their propaganda strategy includes mocking messages and meme-like visuals, which adds psychological warfare to their attacks—often ridiculing institutions for being “unprepared” or “incompetent.”

Why Are They Doing This?

Unlike financially motivated hackers, Anonymous VNLBN appears to be ideologically driven. Their primary goal seems to be sowing distrust in government systems and creating public fear. By attacking healthcare, legal services, and energy providers, they aim to demonstrate the fragility of essential services. Their language also suggests anti-Western sentiments, and their alliance-building across hacktivist channels implies that they are trying to build a more organized and possibly militarized version of Anonymous in Southeast Asia.

Who Could Be Behind It?

So far, no individual or group of individuals has been publicly identified. But cybersecurity analysts believe:

• The core team could be Vietnamese or have deep regional knowledge based on the highly targeted attacks on provincial sites.

• They might be supported by international actors, either through direct collaboration or ideological alignment.

• Their tactics and rapid scale-up suggest involvement of experienced threat actors, not just hobbyist hackers.

This hybrid identity—part local, part global—makes Anonymous VNLBN more dangerous, as they combine regional awareness with international coordination.

What’s the Impact?

The damage caused by Anonymous VNLBN goes beyond just taking down websites. Their campaign has:

• Interrupted access to government services, affecting legal cases, healthcare appointments, and electricity supply.

• Created panic among citizens, especially in rural and western provinces.

• Prompted government response, including hardening digital defenses and seeking international cybersecurity cooperation.

As a result, Vietnam’s cybersecurity agencies have had to shift focus toward defensive posture—moving from passive monitoring to active counter-response.

What’s Next?

The rise of Anonymous VNLBN is a warning sign. This group, though relatively new, has already demonstrated capabilities that rival larger, more established hacker collectives.

Here’s what we may expect going forward:

• More cross-border attacks, especially during geopolitical tensions in Asia.

• Increased hacktivist collaboration under shared ideologies or agendas.

• Governments tightening digital security, firewalls, and hosting defenses.

• Possibly more AI-integrated tools being used by these groups to enhance attack success.

Final Thoughts

Anonymous VNLBN may have started as a niche group targeting Vietnam, but their rapid evolution into a regional cyber threat cannot be ignored. Their campaigns, messaging, and choice of targets indicate that their agenda is both political and disruptive. As governments worldwide begin to grasp the seriousness of digital threats, groups like Anonymous VNLBN will likely face more resistance. But if 2025 has taught us anything, it’s that cyber warfare has gone grassroots, and the next big threat may come from a Telegram group just a few weeks old.