In December 2023, Anonymous Sudan launched a sustained series of DDoS attacks against OpenAI’s ChatGPT, resulting in the service being taken offline. This action was a response to comments made by Tal Broda, an executive at OpenAI, who publicly expressed support for the Israel Defense Forces’ missile strikes in Gaza. Broda had posted messages on the platform X, including one over an image of destruction in Gaza, where he encouraged the IDF to continue their actions and, in another post, denied the existence of Palestine.
Anonymous Sudan stated on Telegram that they would persist in targeting ChatGPT until Tal Broda was dismissed from his position and the platform changed its stance, which they perceived as dehumanizing towards Palestinians. Despite their ideological claims, Akamai’s Seaman notes that the group’s objectives are not solely political. Evidence suggests they have commercial motives as well, as they have offered their DDoS infrastructure, known as Godzilla or Skynet, for rent to other hackers for a fee of $2,500 per month. This indicates that their attacks, which appear politically motivated, may also serve as marketing for their business interests.
Seaman adds that the group seemed to leverage the publicity from these attacks to market their services. While there is a clear ideological aspect, particularly in the context of the group’s anti-Israel and pro-Palestinian stance following October 7, understanding the full scope of their victim targeting might be exclusive to those behind the attacks.
Additionally, Anonymous Sudan has also targeted entities in Ukraine, in apparent collaboration with pro-Russian hacker groups like Killnet. This led to speculation in the cybersecurity community that Anonymous Sudan might be a Russia-affiliated operation using a Sudanese identity as a guise. However, allegations against Ahmed and Alaa Omer suggest that the group is genuinely of Sudanese origin. Despite its name, the group does not appear to be connected to the original Anonymous hacker collective, which has been mostly inactive for around a decade.
Anonymous Sudan has gained notoriety through its innovative and effective technical methods. Its DDoS operations employ virtual private servers acquired through fraudulent means to conduct attacks. These high-powered servers, typically provided by cloud service companies, are used to carry out layer 7 attacks, which overload web servers with numerous website requests, as opposed to lower-level data request floods typical of past DDoS attacks. Users of Anonymous Sudan’s DDoS services deploy these layer 7 requests jointly, sometimes utilizing multiplexing or pipelining techniques, to impose multiple bandwidth demands simultaneously until the targeted servers become inoperative.
