US disables Anonymous Sudan infrastructure linked to DDoS attack spree

A federal grand jury on Wednesday unsealed charges and announced a prior operation to disrupt Anonymous Sudan, a prolific hacktivist group that was linked to some of the biggest DDoS attacks in the world, including a 2023 attack against Microsoft.

Federal officials indicted two Sudanese nationals, Ahmed Salah Yousif Omer, 22 and Alaa Salah Yusuuf Omer, 27, on charges of conspiracy to damage computers. Ahmed Salah was also charged with three counts of damaging protected computers.

In March, the FBI and U.S. Attorney’s Office, pursuant to a warrant, disabled and seized a DDoS tool the group used to conduct attacks against the U.S. State Department, the Department of Defense, the FBI, Microsoft, Riot Games, Cedars-Sinai Medical Center in Los Angeles and other organizations. The group also allegedly sold the DDoS tool to other threat actors.

“The FBI’s seizure of this powerful attack tool successfully disabled the attack platform that caused widespread damage and destruction to critical infrastructure and networks across the world,” Rebecca Day, special agent in charge of the FBI Anchorage field office, said in a statement. “With the FBI’s mix of unique authorities, capabilities and partnerships, there is no limit to our reach when it comes to combating all forms of cybercrime and defending global cybersecurity.”

Since early 2023, Anonymous Sudan operators and their customers used a distributed cloud attack tool to launch more than 35,000 attacks across the globe, including more than 70 attacks against targets in the Los Angeles area, officials said.

The victims included numerous government agencies, hospitals, network service providers and technology platforms, including Microsoft, Riot Games, Cedars-Sinai Medical Center and government agencies, including the U.S. State Department, Department of Defense and websites for the state of Alabama, according to the DOJ.

Microsoft in June 2023 linked Anonymous Sudan to a series of attacks targeting Azure, OneDrive and Outlook. A February 2024 attack against Cedars-Sinai forced patients to be rerouted to other facilities, according to the indictment.

A spokesperson for Cedars-Sinai declined to comment citing the ongoing criminal matter.

Numerous private entities assisted in the investigation, including Cloudflare, Akamai SIRT, CrowdStrike, Amazon Web Services, Google, Flashpoint and Microsoft.