The Trustwave SpiderLabs research team has been tracking a new threat group calling itself Anonymous Sudan, which has carried out a series of Distributed Denial of Service (DDoS) attacks against Swedish, Dutch, Australian, and German organizations purportedly in retaliation for anti-Muslim activity that had taken place in those countries.
However, a deeper dive into the group indicates a very strong possibility that Anonymous Sudan is a sub-group of the Pro-Russian threat actor group Killnet, a group with which Anonymous Sudan has publicly aligned itself.
SpiderLabs cannot confirm that the group is based in Sudan, nor if any of its members are from that nation, but based on the evidence available, it seems quite likely that Anonymous Sudan is a Killnet project, possibly including some Eastern European members.
Most of the information available on Anonymous Sudan comes from the group’s Telegram channel, which was created on January 18, 2023, just days before it launched its first attack. Here the group claimed it conducted the attacks are conducted in response to anti-Muslim activities that have taken place in the target nations and in support of Russian hackers who, in turn, support Sudan.
Anonymous Sudan concentrates on specific targets for short periods, generally a day, but in some cases for extended periods of time.
Figure 1. Message showing Anonymous Sudan’s support of Russian hackers
It is important to note that the larger Anonymous Operations has disavowed any connection with Anonymous Sudan on that organization’s Telegram channel.
Anonymous Operations is the Telegram channel for the broader Anonymous group. According to the group’s website: Anonymous is a collective of online and offline activists who engage in direct action, hacktivism, and other subversive digital and physical actions. The group was founded on the imageboard 4chan in 2003. Anonymous has no formal leadership or membership, instead operating as a decentralized network of individuals with similar interests.
Figure 2. Anonymous Operations denies affiliation with Anonymous Sudan.
There are numerous clues left behind by Anonymous Sudan pointing toward the group being associated in some manner with Killnet. The primary indicator is that Anonymous Sudan’s preferred attack vector is DDoS attacks, the attack type that Killnet has conducted. Other circumstantial evidence pointing toward a Russian connection is that the Anonymous Sudan Telegram posts are mostly in Russian (with some in English), and the targets are all nations that support Ukraine in its fight against Russia.
However, Killnet seemed to confirm its connection to Anonymous Sudan when the collective posted screenshots from Anonymous Sudan on Killnet’s Telegram channel, as shown in Figures 9, 10, and 11.
One of Killnet’s primary missions is supporting Russia in conjunction with the invasion of Ukraine and the group has in fact, attacked Ukraine’s supporters.
At this time, SpiderLabs has found only minimal evidence that Anonymous Sudan is financially motivated, and that comes from a few advertisements suggesting that Anonymous Sudan was attempting to sell data stolen from Air France.
Whether Anonymous Sudan is a front for or just acting in conjunction with Killnet may be moot. SpiderLabs believes the DDoS attacks have the potential to be quite serious.
Anonymous Sudan’s attacks can disrupt government operations, health facilities, and airport services, which could lead to serious consequences. The group has taken credit for a number of attacks and has posted threats against a wide range of targets.
The following is a breakdown of the attacks claimed by Anonymous Sudan.
The group’s first activity targeted Swedish governmental and business resources as a response to the act of burning the Quran in Stockholm. Sweden has given hundreds of millions of dollars in military aid to Ukraine, including advanced artillery and air defense weapons.
Figure 3. Jan 18, 2023, Attacks on Sweden start 5 days after the creation of the group.
Figure 4. Jan 23, 2023. Anonymous Sudan taking responsibilities on attacking Swedish websites.
The next day, the group concentrated on attacks against the Dutch government infrastructure supposedly in retaliation to the burning of the Quran in Enschede, a city in the Netherlands. The Netherlands government has also donated to Ukraine.
Figure 5. Jan 24, 2023. The gang targeting the Dutch government’s websites.
Anonymous Sudan often provides check-host.net links to prove that the DDoS attacks were successful.
France is also on Anonymous Sudan’s radar with the group promising to strike that nation for anti-Islamic activity. Like the other targets of attack, France has been a major supplier of financial aid and military equipment to Ukraine.
Figure 6. March 14, 2023. Anonymous Sudan declared attacks against France.
In rare cases, the group is involved in other than DDoS attacks. For example, Anonymous Sudan is trying to sell information that was obtained from the Air France website.
Figure 7. March 19, 2023. Anonymous Sudan purports to access Air France data.
Figure 8. March 19, 2023. Anonymous Sudan offers the French airline data for sale.
As proof of the Air France attack, Anonymous Sudan published data containing emails and passwords. While reviewing the emails, we found that some of them were mentioned in earlier leaks.
The next attack was the first of several to officially connect Anonymous Sudan with Killnet. It took place in late January 2023, with the Telegram post saying Anonymous Sudan assisted Killnet in its attack against the Federal Intelligence Service of Germany (Bundesnachrichtendienst). Germany has been an ardent supporter of Ukraine.
Figure 9. Jan 25, 2023. Anonymous Sudan claims to attack Federal Intelligence Service of Germany.
The next attack performed in coordination with Killnet targeted PayPal as you can see in Figure 10.
Figure 10. Feb 3, 2023. Killnet with other gangs, including Anonymous Sudan, claims to DDoS Paypal’s website.
In the following posts Anonymous Sudan claimed a successful DDoS attack on the cybersecurity firm Radware’s website. Radware is an Israeli security vendor which provides multiple services, including DDoS protection. Israel has also offered aid to Ukraine.
Figure 11. Feb 7, 2023. Killnet and Anonymous Sudan, claims to take down the website of Israeli security vendor Radware.
One of the group’s most recent threats is leveled against Australia, some of which the group claims will involve Killnet. On March 24, it posted threats against a wide variety of Australian organizations, including airports, universities, and healthcare facilities. Australia is also supporting Ukraine.
Figure 12. March 24, 2023. Anonymous Sudan claims to attack Australian hospitals.
Figure 13. March 24, 2023. Anonymous Sudan claims to attack Australian Airports.
Additional attacks are planned by Anonymous Sudan for the week of March 27th and are also coordinated with Killnet. In the following post they provide a timeline for these attacks:
Figure 14. Anonymous Sudan threatens to attack Australian universities.
Figure 15. March 25, 2023. Anonymous Sudan provides a timeline for the attacks against Australian Targets.
Anonymous Sudan recently claimed to target Denmark after Rasmus Paludan, a political activist who holds Danish and Swedish citizenship, burned the Quran in Denmark.
Figure 16. Anonymous Sudan adds Denmark to its targets.
Anonymous Sudan has been extremely active taking credit for attacks via its Telegram channel, but details concerning the true reasoning behind its efforts remain murky. It has publicly aligned itself with the Russian group Killnet, but for reasons only its operators know, prefers to use the story of defending Islam as the reason behind its attacks.
A new activity for Anonymous Sudan is the stealing and selling of data as evidenced in the Air France attack. While this might appear to be an evolution of the group’s attack types, DDoS attacks currently remain the norm. Only time will tell whether Anonymous Sudan will continue with their customary style of attack or if the group will incorporate more nefarious means of attack.
