Behind the DDoS Attacks on X (Twitter) and the Mystery of Anonymous Sudan

A hacking group, self-identified as Anonymous #Sudan, orchestrated a Distributed Denial-of-Service (DDoS) attack on X, formerly known as Twitter, affecting over a dozen countries on a fateful Tuesday morning. Their objective: to apply pressure on Elon Musk to launch his Starlink service in Sudan. Reports of technical issues flooded in from the United Kingdom, the United States, and various other corners of the globe, totaling around 2,700 incidents.

During the two-hour outage, Anonymous Sudan leveraged Telegram to taunt Elon Musk regarding his recent rebranding of X, humorously noting that the bird logo on the platform hadn’t changed yet.

This is not the first time Anonymous Sudan has made headlines with its cyber activities. Previously, they temporarily incapacitated Microsoft’s Outlook email service, Reddit, and Archive of Our Own, as reported by the Evening Standard.

Despite their name, cybersecurity experts suggest that Anonymous Sudan operates from Russia and is managed by a network of cybercriminals. Initially claiming Sudanese origins when they emerged in January, the group’s affiliation with Russia came to light. TrueSec, a cybersecurity firm, dismissed their Sudanese ties and pointed to associations with Russian hacktivist collectives such as KillNet and UserSec.

The evidence supporting their Russian origins includes their extensive presence on Telegram, a messaging app favoured among Russian hackers. They initially attempted to provide proof of their Sudanese origins, including links to videos with Arabic dubbing, but gradually shifted their messaging strategy. It is plausible that some individuals from Sudan may now be handling their messaging, but their content continues to align closely with Kremlin narratives.

Hacktivism today revolves more around funding than technical skills, with individuals or entities paying for DDoS attacks through commercial services. The critical question remains: Who funds Anonymous Sudan? The focus of this financing could be traced back to Russia, with indications that someone within the Russian government or close to the President could be bankrolling their operations.

Aside from the DDoS attacks on Outlook, Reddit, and Archive of Our Own, Anonymous Sudan is believed to have targeted countries like Australia, Scandinavia, and Israel in recent years. The group’s modus operandi seems to have shifted from being dismissed as a Kremlin-run cyber team to possibly being a small group of Sudanese criminal hackers.