2 brothers from Sudan were charged in the US for their roles in Distributed Denial of Service (DDoS) attacks under the name Anonymous Sudan. The indictment was published on 16 October 2024 and accuses the brothers of attacking hundreds of targets, including large companies and healthcare facilities.
Important findings
- Defendants: Ahmed Salah Yousif Omer (22) and Alaa Salah Yusuuf Omer (27)
- Charges: conspiracy to damage protected computers, additional charges against Ahmed Salah
- Maximum sentence: life sentence for Ahmed Salah, up to 5 years for Alaa Salah
- Targets: Cedars-Sinai Health Systems, Microsoft, government services in Kenya
- Motivation: Ideological attacks and financial blackmail
Background of the attacks
Anonymous Sudan first appeared in January 2023, stating that the group wanted to wage cyberwar against the US in response to an incident in Stockholm in which a Koran was burned. The group has positioned itself as pro-Palestinian and stated that its attacks on facilities in the US were intended in retaliation for Israeli attacks in the Gaza Strip.
The Indictment
Federal prosecutors in the US brought the charges against the brothers. Ahmed Salah is accused of using the identity “WilfordCEO” to sell DDoS tools to private users. FBI agents said the brothers combined ideological and financial motives in a unique way in their attacks.
DDoS attacks in detail
The group’s DDoS attacks were motivated not only by ideology but also by financial gain. They demanded a payment of $1 million from Microsoft to stop the attacks and tried to extort $3 million from Scandinavian Airlines. The attacks caused significant disruption, including:
- Cedars-Sinai Health Systems: Attacks that lasted several days and affected emergency care.
- Microsoft: Weeks of attacks that resulted in millions in losses.
- Kenyan government services: DDoS attacks that affected several hospitals and a large telecommunications company.
Technical aspects of attacks
The group did not use traditional botnets, but relied on cloud-based servers that forwarded commands to open proxy resolvers. This technique allowed them to turn small amounts of data into massive attacks. FBI agents reported that Ahmed Salah admitted during an interview that he was WilfordCEO.
Conclusion
The indictment of the Omer brothers marks a significant step in the fight against cybercrime and shows how complex motivations can be behind DDoS attacks. The investigation has not only uncovered the identity of the attackers, but also clarified the links between ideological and financial goals in cybercrime.
Sources
- US Indicts Sudanese Brothers for Anonymous Sudan Attacks, BankInfoSecurity.
