From cyber threat to political action:The identity and motivations presented by Anonymous Sudan for DDoS attacks

Amid major global conflicts, groups perpetrate Distributed-Denial-of-Service (DDoS) attacks to take direct action and challenge traditional political systems. From 2023 to 2024, Anonymous Sudan launched numerous successful and high-profile DDoS attacks against nations and international businesses, resulting in millions of dollars in damages, drawing global headlines, and culminated in charges not just for criminal hacking, but also for seeking to cause injury or death. DDoS attacks are often analysed through a cybersecurity lens, to offer security solutions to mitigate risk and limit the impact of attacks. However, this may overlook the sociopolitical reasons why groups feel compelled to take such actions. In response, taking a collective action approach, this study investigated how Anonymous Sudan framed their psychological and political motivations on their public Telegram channels (N = 967 posts). Using multi-modal content analysis, we found the primary focus of the posts was to claim attribution for the attacks and provide evidence for these claims. This messaging allowed the group to imbue the attacks with political meaning and frame themselves as strong and significant. However, the need for these communications also reveals the challenges facing groups reliant on the attribution assessments of others, and thereby offers opportunities for developing strategies to counter dangerous actions.