Anonymous Sudan Claims DDoS Attacks on AP, Cloudflare, and AO3
Anonymous Sudan, also tracked as Storm-1359, claimed distributed denial-of-service attacks that disrupted parts of The Associated Press, Cloudflare’s website, and Archive of Our Own (AO3). AP said APNews.com and some links suffered technical issues while its mobile apps continued to operate, and Cloudflare confirmed intermittent connectivity problems on www.cloudflare.com but said its products and customer-facing services were unaffected because they run on separate infrastructure. AO3 experienced intermittent 503 Service Unavailable errors as volunteer administrators worked to restore access.
The group framed the operations as part of a broader campaign against U.S.-registered organizations and, in AO3’s case, paired ideological messaging about LGBTQ+ and NSFW content with a $30,000 bitcoin ransom threat to prolong the outage. The incidents fit a wider pattern of high-profile DDoS activity attributed to Anonymous Sudan against targets including Microsoft, X, PayPal, Reddit, Tumblr, Kenya’s digital government portal, and ChatGPT, while multiple researchers and vendors have assessed that the group is likely pro-Russian and shares similarities with Killnet, despite presenting itself as a Sudanese Islamist hacktivist collective.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
4 events from the most recent confirmed update back to the earliest known activity.
Anonymous Sudan disrupts Cloudflare's website
Anonymous Sudan, also tracked as Storm-1359, claimed responsibility for a DDoS attack that caused intermittent connectivity issues on www.cloudflare.com. Cloudflare confirmed the website disruption but said its products and customer-facing services were unaffected because they run on separate infrastructure.
Associated Press website experiences disruption amid Anonymous Sudan claim
Parts of AP's website were disrupted after Anonymous Sudan claimed responsibility for a DDoS attack. The Associated Press acknowledged technical issues affecting APNews.com and some links but said its mobile apps continued to function normally and did not confirm a cyberattack.
Anonymous Sudan issues $30,000 bitcoin ransom demand to AO3
After claiming the AO3 attack, Anonymous Sudan demanded $30,000 in bitcoin and threatened to keep the fanfiction site offline for weeks if payment was not made. AO3 volunteers continued working to restore service during the disruption.
Anonymous Sudan launches DDoS attack on AO3
Anonymous Sudan claimed on Telegram that it had begun a distributed denial-of-service attack against Archive of Our Own (AO3), causing intermittent 503 Service Unavailable errors. The group said the disruption was part of a broader campaign against U.S.-registered organizations.
Sources
3 references tracked. Mallory keeps watching after this page renders.
Anonymous Sudan DDoS attack hits Cloudflare website | brief | SC Media
scmagazine.com
Open sourceAP cyberattack: Has Anonymous Sudan hit Associated Press?
techmonitor.ai
Open sourceFanfic writers targeted by Anonymous Sudan in apparent DDoS attack on Ao3 - Cyber Daily
cybersecurityconnect.com.au
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Anonymous Sudan Claims DDoS Attacks on UAE Entities and Global Online Services
The group calling itself **Anonymous Sudan** claimed responsibility for cyber attacks on UAE entities, adding to a pattern of disruptive operations previously attributed to the actor against major online platforms and services. Earlier incidents tied to the group included outages affecting **Microsoft 365**, **UPS**, **Netflix**, **X**, and **ChatGPT**, with victims reporting service disruptions consistent with **distributed denial-of-service (DDoS)** activity rather than data theft or network intrusion. In the ChatGPT incident, OpenAI said abnormal traffic patterns caused repeated outages, while Netflix also confirmed a temporary disruption that was later resolved. Researchers cited across multiple reports assess that Anonymous Sudan is likely **not a genuine Sudanese hacktivist movement** and instead appears aligned with **Russian interests**, with links frequently drawn to **Killnet** and broader pro-Kremlin influence operations. Analysts said the group’s Russian-language origins, selective targeting, political messaging, and use of costly attack methods such as **SYN flood** and **HTTP-based DDoS** campaigns point to a well-supported disruption actor that blends hacktivist branding with geopolitical narratives, including anti-Western, anti-LGBTQ+, and Middle East conflict themes.
May 25, 2026
Anonymous Expanded Operation Payback From Anti-Piracy Targets to WikiLeaks Backers
Anonymous used **distributed denial-of-service (DDoS)** attacks under the banner of **Operation Payback** to hit anti-piracy groups and related legal entities including the **RIAA, MPAA, BPI, AFACT, BREIN, Websheriff**, and the law firm **Dunlap, Grubb and Weaver**. The campaign escalated after the shutdown of LimeWire, with Anonymous publicly planning another attack on the RIAA and portraying the action as retaliation against copyright enforcement. Earlier attacks also coincided with the takedown of **ACS:Law**, where hundreds of megabytes of internal emails were exposed after the firm was knocked offline. The operation later widened into a pro-WikiLeaks campaign branded **Operation Avenge Assange** after **PayPal, Visa, MasterCard, and Amazon** cut services to WikiLeaks following the publication of US diplomatic cables. Anonymous launched prolonged attacks that disrupted PayPal and targeted other firms seen as censoring WikiLeaks, while police in the UK opened investigations, monitored threats against government sites, and examined the use of the **Low Orbit Ion Cannon** by participants. The campaign showed how Anonymous evolved from anti-piracy retaliation into politically motivated online disruption aimed at organizations viewed as restricting access, speech, or digital distribution.
May 25, 2026
Anonymous Used LOIC DDoS Campaign to Hit RIAA and Payment Sites
Anonymous organized **distributed denial-of-service (DDoS)** attacks under its **Operation Payback** banner, using the **Low-Orbit Ion Cannon (`LOIC`)** tool and publicly coordinating participants through channels including **4chan's `/b/` board** and the operation's website. In one of the campaign's prominent actions, the group targeted the **Recording Industry Association of America (RIAA)**, saying it was protesting what it viewed as abusive copyright enforcement by industry lobbyists and law firms; the RIAA site was reportedly forced offline within minutes, although some related pages remained reachable. The same campaign later expanded to organizations linked to pressure on **WikiLeaks**, with Anonymous supporters redirecting attacks toward **PayPal** and briefly knocking **Moneybookers** offline after deciding against a planned action on **Amazon**. Participants said the Amazon attack was dropped because they lacked sufficient numbers and did not want to disrupt holiday shoppers, while the group also acknowledged internal disagreements and attempted to distance itself from a figure known as **Coldblood** without signaling any broader collapse of the operation.
May 25, 2026