In just over a year, Anonymous Sudan managed to create the image of a much larger and more technically sophisticated cyber operator than the available open-source evidence would suggest. The group targeted Microsoft services, ChatGPT, PayPal, government institutions, financial and healthcare organizations, and transportation infrastructure. Yet its core may have consisted of only a handful of individuals.

In our new OSINT report, we trace the development of Anonymous Sudan from its emergence in January 2023 to the effective cessation of its activity following a U.S. law enforcement operation in March 2024.

The group initially presented itself as a pro-Islamic hacktivist movement and justified its attacks as defending Muslim interests. Over time, however, its target selection increasingly overlapped with the broader anti-Western and pro-Russian hacktivist environment. Anonymous Sudan publicly interacted with Killnet and, in 2023, joined Killnet and a group presenting itself as the revived REvil in announcing a campaign against the Western financial system. At the same time, the available open-source evidence is insufficient to establish direct control by Russian state structures.

Anonymous Sudan’s technical model is equally revealing. The group had its own DDoS tool, DCAT, but its operations did not depend on zero-day vulnerabilities or sophisticated intrusions into victim networks. Its main advantage was the ability to scale relatively accessible L7 DDoS attacks through rented servers, cloud infrastructure, and a network of open proxies.

Its motivation also evolved. Political and religious rhetoric was gradually accompanied by an increasingly explicit commercial component: DDoS extortion, attacks sold as a service, and a public price list.

The report examines Anonymous Sudan’s infrastructure, MITRE ATT&CK techniques, external links, monetization model, technical capabilities, and vulnerabilities.

The Anonymous Sudan case demonstrates how a small group can generate disproportionate operational impact without state-level cyber capabilities — provided it has sufficient infrastructure, resources, and the ability to scale its attacks.