- Category
- Hacktivist · Political or nationalist, often disruption and leaks.
- Origin
- Russia(medium confidence)
- Motivation
- Denial of service
- Sources
- 4 sources carry it
- Identifier
- GINC-APT-0484 · anonymous-sudan
RussiaWhat it is
Since January 23, 2023, a threat actor identifying as "Anonymous Sudan" has been conducting denial of service (DDoS) attacks against multiple organizations in Sweden. This group claims to be "hacktivists," politically motivated hackers from Sudan. According to Truesec’s report, the threat actor has nothing to do with the online activists collectively known as Anonymous.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Microsoft
- storm-1359
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Targets
- Countries
- Denmark, Sweden
Tools
The tools and malware families the sources tie to it.
- Archelaus Beta
- CrossRat
- Cyber Eye RAT
- CyberGate
- FLASHFLOOD
- GraphicBooting
Sources
- Malpedia malpedia.caad.fkie.fraunhofer.de