Russian Group "Anonymous Sudan"
Initiated new DDoS Attacks

Recently, the Russian group “Anonymous Sudan” launched a new series of DDoS attacks on websites belonging to both the public and private sectors. While the impact of these attacks has been limited so far, with some sites only going down for a short period and the majority being unaffected, businesses need to be prepared for potential future attacks.

Who are "Anonymous Sudan"?

Starting from January 23, 2023, various Swedish organisations have been targeted by a threat actor that goes by the name “Anonymous Sudan.” Their modus operandi involves launching DDoS attacks, and the group claims to be politically motivated hacktivists from Sudan.

It was a tough Valentine’s Tuesday for Sweden, more generally. A cyberattack on Scandinavian Airlines (SAS) knocked its website offline and exposed some customer data. Customers who attempted to log into the Scandinavian Airlines mobile app were sent to someone else’s account and had access to their contact information and itineraries, among other things. A cyberattack took its national public television broadcaster, SVT, offline temporarily, and several of its companies, universities and telecom operators were also on the receiving end of cyberattacks. “Anonymous Sudan” took responsibility for both attacks. The Russian-backed UserSec group said on Telegram it assisted Anonymous Sydan in the airline attack.

What is a DDoS Attack?

A DDoS attack, short for Distributed Denial of Service attack, is a type of cyber attack that seeks to overwhelm a targeted server or network with a flood of traffic or requests, rendering it unable to function correctly. In a DDoS attack, the attacker typically uses a network of compromised devices, a botnet, to flood the target with traffic, making it difficult or impossible for legitimate traffic to get through.

DDoS attacks can take many forms, but they all share the same goal of overwhelming the target with traffic or requests. Some common types of DDoS attacks include:

  • Volumetric attacks: These attacks flood the target with a large volume of traffic, overwhelming its bandwidth and making it unable to respond to legitimate requests.
  • Protocol attacks: These attacks target specific protocols or services, such as HTTP or DNS, by sending malformed packets or exploiting vulnerabilities in the protocol.
  • Application layer attacks: These attacks target the application layer of a server, seeking to overwhelm it with requests or exploit vulnerabilities in the application.

Overall, DDoS attacks are a severe threat to organisations of all sizes and types. By understanding the nature of these attacks and taking proactive steps to protect against them, organisations can minimise the risk of disruption and keep their services running smoothly.

If Your Company Falls to a DDoS Attack, What Are Your Next Steps?

If your business falls victim to a DDoS attack like in case of “Anonymous Sudan”, it can be a stressful and confusing experience. However, taking immediate action to mitigate the damage and get your systems back up and running as quickly as possible is essential.

The first step is to identify and confirm the attack, which can be done by monitoring your network traffic and looking for unusual activity patterns. Once the attack has been confirmed, you should contact your hosting provider or internet service provider(ISP) to let them know what is happening and ask for their assistance in mitigating the attack.

Next, consider activating your incident response plan, which should include notifying key stakeholders, such as senior management, IT staff, and any external partners who may be affected by the attack. It’s essential to communicate clearly and regularly with all stakeholders to keep them informed about the situation and any steps being taken to resolve it.

Depending on the severity of the attack, you may need to enlist the help of a specialist DDoS mitigation service or cybersecurity firm. They can help you identify the source of the attack, block malicious traffic, and prevent further damage to your systems.

How to Protect Your Business from DDoS Attacks?

Investing in proper DDoS protection measures is one way to protect your business from a DDoS attack. This can include planning to identify and respond to an attack quickly and implementing measures such as traffic filtering and rate limiting to help prevent the attack from overwhelming your systems.

Another critical step is ensuring that your website or application is designed with security. This can include implementing secure coding practices, regularly patching and updating software, and using encryption to protect sensitive data.

It’s also crucial to have a solid disaster recovery plan in place to quickly restore normal operations and minimise the impact on your business in the event of an attack. This can include having backups of critical data and systems and identifying alternative methods for conducting business if your primary systems are disrupted.

Finally, it’s essential to stay informed about the latest trends and threats in the world of DDoS attacks. This can include monitoring industry news and updates and participating in forums or professional organisations dedicated to cybersecurity and DDoS protection.

By taking these steps, businesses can help protect themselves from the potential impact of DDoS attacks and ensure the continuity of their operations in the face of cyber threats. Organisations investing in proper DDOS protection can withstand these attacks, and organisations that aren’t affected need improvements.

Should we worry if the attacks have a limited practical impact on the targets?

Yes, because this is a psychological campaign to affect the Swedish population and our potential future NATO partner, the Republic of Türkiye, to influence the Swedish NATO application negatively.

The Intersection of Cyberattacks, Religious Sentiments, and Political Motivations

According to a report by The Guardian, a protest organised by a far-right group in Stockholm, Sweden, in January 2023 triggered a religious backlash and was allegedly funded by a journalist with Russian connections. The goal of the funding was apparently to reduce Sweden’s increasing involvement in NATO as “Anonymous Sudan” do.

The protest, which was described as Islamophobic, took place on January 25, 2023, and was reportedly supported financially by Rasmus Paludan, a Russian citizen with alleged ties to the Kremlin. The journalist is said to have funded the far-right group responsible for organising the event. The report also suggests that Paludan has connections to other individuals with links to the Russian government.

The incident has raised concerns among Swedish officials regarding the potential influence of Russia in the country, according to a news article. The report also mentions that the Swedish security service, Säpo, has initiated an investigation into the matter. The incident could also have implications for Sweden’s relationship with NATO, as the country has been a member of the alliance for nearly three decades.

Tensions between Russia and NATO have been fraught since the annexation of Crimea in 2014. The article suggests that this latest incident is part of a broader effort by Russia to destabilise democracies in the West and create discord among NATO allies.

Free Subscription

The most comprehensive Cybersecurity agenda for leading industry executives

Connect and share niched and unique knowledge

Meet our 15-year experience in addressing international cybersecurity challenges

Register for The Conference
25th of May 2023