FBI Disrupted DDoS Group in March
By David Perera (@daveperera)
Two Sudanese brothers are under criminal indictment in the United States for their role in distributed denial-of-service attacks launched against hundreds of targets under the moniker of Anonymous Sudan.
Federal prosecutors unsealed indictments against Ahmed Salah Yousif Omer, 22, and Alaa Salah Yusuuf Omer, 27, who each face one count of conspiracy to damage protected computers.
Younger brother Ahmed Salah faces three additional counts of damaging protected computers. An FBI agent testified that Ahmed Salah was the real person behind the Anonymous Sudan persona of “WilfordCEO,” who handled sales of its DDoS tool to private users.
Federal agents disclosed their disruption of Anonymous Sudan in March. If convicted of all charges, Ahmed Salah could be imprisoned for life, while Alaa Salah would face a statutory maximum sentence of five years.
The indictments settle a long-standing mystery of whether the group truly operated from the east African country – or, as many suspected, was a façade for Russian state-aligned hacktivists.
“The group may share ideologies with, and sometimes appear to act in concert with, Killnet and similar hacktivist groups,” FBI agent Elliott Peterson wrote in an affidavit – referring to pro-Kremlin, Russian-speaking DDoS groups that emerged around the time of Russia’s February 2022 invasion of Ukraine. “My investigation to date has indicated that Anonymous Sudan is in fact led by Sudan-based individuals.”
Among the group’s targets was Cedars-Sinai Health Systems in Los Angeles in an attack lasting several days starting Feb. 16 that forced it to divert emergency patients for several hours. Anonymous Sudan also conducted weeks’ worth of attacks in June 2023 against Microsoft that disrupted Azure and Microsoft 365 services. Employees of the computing giant told the FBI the attacks resulted in millions of dollars of losses.
The group emerged in January 2023 purportedly to carry out retaliation for a Quran-burning incident in Stockholm by a dual Danish-Swedish national far-right politician. Months later, a group member asserted: “We declare cyber war on the United States,” calling the US “our primary target.”
The group said its attack on Cedars-Sinai was retaliation for Israeli fighting the Gaza strip, writing on Telegram, “Bomb our hospitals in Gaza, we shut down yours too, eye for eye.”
Although it kept up a tempo of ideologically charged statements on its Telegram channels, the group also openly advertised financial motivations. It demanded US$1 million from Microsoft to stop the DDoS attacks. In June 2023, it attempted to extort US$3 million from Scandinavian Airlines to stop ongoing attacks.
Despite declaring “war” against the US, Anonymous Sudan targets were spread across the globe. In July 2023, it claimed responsibility for disrupting government services through DDoS attacks in Kenya in a protracted incident that also affected seven hospitals, the largest telecom company and a transport agency. In April, it took responsibility for disrupting a mobile app that provides real-time alert for missile attacks.
Major tech companies also have been targets, with the group causing an outage in August 2023 on social media platform X, formerly Twitter, posting on Telegram that owner Elon Musk should “Open Starlink in Sudan.” In November, it disrupted OpenAI’s ChatGPT service after an executive voiced militant support for Israeli forces in Gaza.
“From an outsider’s perspective, it’s not always clear how or why they chose targets,” said vice president of intelligence at Flashpoint, which has tracked Anonymous Sudan activities Ian Gray,.
A July 2023 attack against PayPal helped lead to the Omer brothers’ real identities. A company investigation identified accounts likely used by Anonymous Sudan actors, leading the FBI to obtain the email addresses associated with the accounts. The FBI said Ahmed Salah confessed to being WilfordCEO during a March 20 interview.
The group didn’t use a traditional botnet composed of compromised routers or internet of things devices. Prosecutors said its tool – which went by the monikers of “Skynet,” “Godzilla” and “InfraShutdown” – consisted of cloud-based servers that forwarded commands to an array of open proxy resolvers. Those resolvers can be used to create reflection attacks that amplify a small amount of internet traffic into an overwhelming load.
The highly public DDoS attacks may have also served as advertising for a money-making proposition for the Omer brothers. FBI agent Peterson haggled with Ahmed Salah over the price of a week’s worth of access to Skynet, testifying that Ahmed Salah as WilfordCEO initially wanted US$700 but settled for US$600 in cryptocurrency. The group’s Telegram channel in February offered rates of US$300 per day to launch up to 100 attacks of 2 terabytes. Another advertisement that month offered three weeks’ worth of access for US$2,000.
“Who wants our power that can down internet in entire countries today?” the group asked in a Telegram post.
Anonymous Sudan ultimately united disparate strands of cybercrime into a unique combination, Gray said. It adopted the iconography of Anonymous hacking collectives, but allied itself with Killnet. It waged ideological attacks, but also offered targets the ability to buy their way out of its crosshairs. “Anonymous Sudan is a new class of cyber adversaries that’s tough for us to put our finger on,” he said.
- Editor’s Note: Updated Oct. 16, 2024 23:36 UTC: This article has been updated throughout.
