CBS News
2 Sudanese brothers charged with running cyberattack-for-hire gang
A federal grand jury unsealed an indictment against two Sudanese brothers Wednesday, charging them with running “Anonymous Sudan,” one of the most prolific cyberattack-for-hire gangs of all time and allegedly behind tens of thousands of attacks.
Federal prosecutors accused Ahmed Salah Yousif Omer, 22, and Alaa Salah Yusuuf Omer, 27, of carrying out 35,000 denial-of-service attacks against hundreds of organizations in just one year, taking down websites and other networks as part of an ideologically motivated extortion scheme affecting thousands of customers.
According to prosecutors, the pair targeted a long list of high-profile victims worldwide and across the U.S., including Microsoft, ChatGPT, PayPal, X, Yahoo, airports, the Pentagon, the Department of Justice, Alabama’s state government, as well as at least one hospital: Cedars-Sinai in the Los Angeles area.
The group held a “Sudanese nationalist ideology,” Martin Estrada, the U.S. attorney for the Central District of California, said in a press conference on Wednesday, charging customers $600 or less to launch major attacks.
“Anonymous Sudan sought to maximize havoc and destruction against governments and businesses around the world by perpetrating tens of thousands of cyberattacks,” Estrada said. “This group’s attacks were callous and brazen — the defendants went so far as to attack hospitals providing emergency and urgent care to patients,” he added.
The group also targeted governmental and private organizations in the Netherlands, Bahrain, United Arab Emirates, Chad, Israel and the U.K.
According to federal prosecutors, Ahmed Salah allegedly created the DDoS attack infrastructure of Anonymous Sudan and then posted messages on Telegram taking credit for the attacks. Alaa Salah allegedly provided computer code and programming support.
A grand jury indictment charged the pair with one count of conspiracy to damage protected computers. Ahmed Salah was also charged with three counts of damaging protected computers.
If convicted of all charges, Ahmed Salah faces a maximum sentence of life in prison related to the attack on Cedars-Sinai hospital, which endangered patients’ lives, according to the indictment. Alaa Salah would face a maximum sentence of five years, if convicted.
Estrada said that if found guilty, it would mark the first cybercrime conviction tied to physical harm in the U.S.
Anonymous Sudan’s attack on Cedars-Sinai Medical Center in February shuttered emergency services temporarily, causing incoming patients to be redirected to other medical facilities for approximately eight hours.
According to the indictment, Anonymous Sudan operated several Telegram channels, posting “information about their attacks, their DDoS tools and pricing, and their victims,” and boasted as many as 80,000 subscribers at one time. The group’s operations resulted in more than $10 million in damages to victims in the U.S.
Federal prosecutors allege that since early 2023, the brothers have used the group’s Distributed Cloud Attack Tool (DCAT) to conduct devastating and often dayslong DDoS attacks. DDoS attacks — or “distributed denial of service” — barrage websites with traffic, rendering them unusable.
“The FBI’s seizure of this powerful DDoS tool successfully disabled the attack platform that caused widespread damage and disruptions to critical infrastructure and networks around the world,” said Special Agent in Charge Rebecca Day of the FBI Anchorage Field Office, in a statement. “With the FBI’s mix of unique authorities, capabilities, and partnerships, there is no limit to our reach when it comes to combating all forms of cybercrime and defending global cybersecurity.”
According to Estrada, both brothers were arrested abroad in March and have been in custody since then, though the U.S. attorney declined to name the country holding them or comment on potential extradition.
Watch CBS News
Be the first to know
Get browser notifications for breaking news, live events, and exclusive reporting.
There is a new wave of calls for Congress to return to Washington to respond to the growing costs of Hurricanes Helene and Milton. Multiple members of Congress from hurricane-ravaged states have issued new calls for the U.S. House and Senate to respond to the depletion of funds from the U.S. Small Business Administration disaster loan fund.
“It’s unacceptable that Congress remains in recess while families and businesses across North Carolina and beyond are in urgent need of assistance,” said Rep. Wally Nickel, a first-term Democrat from North Carolina.
Nickel said, “In the aftermath of Hurricane Helene, our communities are struggling to recover and our small businesses are desperate for support as they work to rebuild. Their recovery efforts are stalled without additional funding.”
Congress has returned home through the middle of November, as the entire U.S. House and nearly a third of the Senate face reelection races. Congressional leaders have defied calls for action on the loan funds before the election.
The U.S. Small Business Administration announced Tuesday that it had exhausted the available funds in its disaster loan program, which is used by businesses and homeowners who are affected by natural disasters. According to CBS News reporting earlier this month, the agency had issued warnings to legislators that the hurricanes risked draining needed funds and urged Congress to swiftly approve more money.
The agency said, “Until Congress appropriates additional funds, the SBA is pausing new loan offers for its direct, low-interest, long-term loans to disaster survivors.” The agency said it will continue to urge victims to apply for loans “given assurances from Congressional leaders that additional funding will be provided upon Congress’s return in November.”
Sen. Rick Scott, a Florida Republican, said he has urged Senate leaders to reconvene as soon as possible after assessments of damage and the needs of agencies, including the Small Business Administration. In a statement posted on social media, Scott said he has spoken with the Small Business Administration to discuss the needs of his constituents.
Rep. Jared Moskowitz, a Florida Democrat and former state emergency manager, told CBS News, “Thousands of applications are coming in each day for disaster loans following Hurricane Helene and Milton. Congress knew this fund was running low as we left for recess during hurricane season, and we failed to be proactive. We shouldn’t be waiting until mid-November to come back to D.C. and fix this.”
Speaker Mike Johnson’s office did not immediately return a request for comment about Congress returning early to address Small Business Administration funding. On “Face the Nation” Sunday, Johnson addressed questions about whether Congress should return early to respond to calls to bolster funding for the Federal Emergency Management Agency.
Johnson said, “Congress can’t meet and just send money on a guess or an estimate of what the damages are. The way supplemental disaster funding is provided is that, you know, the state sends in actual needs. It’s assessed by Congress and then handed out that way. But again, remember, they have billions, tens of billions of dollars that were already sent to FEMA, one day before Helene made landfall. So they have plenty of resources.”
Watch CBS News
Be the first to know
Get browser notifications for breaking news, live events, and exclusive reporting.