Anonymous Fénix DDoS and volunteer-recruitment campaign
Campaign
Summary
Hide ▲
Show ▼
Anonymous Fénix escalated its DDoS campaign by recruiting volunteers, increasing disruption risk for government and public-institution domains across Spain and parts of South America. The operation began in April 2023 and peaked after the late October 2024 Valencia floods. The group used X and Telegram to spread anti-government messaging and draw in participants. That mix of recurring attacks, propaganda, and enlistment points to a coordinated campaign rather than isolated activity.
Related Happenings
Outsider Telegram-run smishing campaign targeting Americans
Campaign
H score53
First: 12.06.2026 21:59
Last: 12.06.2026 21:59
Sources 1
About this happening:
The **Outsider Enterprise** happening is a **phishing-as-a-service** campaign tied to a **Chinese cybercrime network** that used **AI** and distributed phishing kits to impersonat...
Outsider Telegram-run smishing campaign targeting Americans
CampaignAbout this happening: The **Outsider Enterprise** happening is a **phishing-as-a-service** campaign tied to a **Chinese cybercrime network** that used **AI** and distributed phishing kits to impersonat...
Latest development: 14.06.2026 17:36
The FBI, working with Google and Black Lotus Labs, dismantled Outsider Enterprise, a Chinese phishing-as-a-service operation that used AI and distributed phishing kits to impersonate trusted brands in texts sent through AT&T, T-Mobile and Verizon. The takedown included seizures of administration servers, a Shopify e-commerce storefront, a testing account, around $100,000 USDT and a Telegram bot linked to the service, while Google pursued civil action and coordinated with carriers to block fraudulent messages.
North Korean Drift contributor targeting campaign
Campaign
H score37
First: 06.04.2026 19:35
Last: 06.04.2026 19:35
Sources 1
About this happening:
A **North Korean** targeting campaign against **Drift Protocol contributors** ran for at least **six months** before the later theft, increasing the attackers' access and credibil...
North Korean Drift contributor targeting campaign
CampaignAbout this happening: A **North Korean** targeting campaign against **Drift Protocol contributors** ran for at least **six months** before the later theft, increasing the attackers' access and credibil...
Iranian MOIS Telegram malware campaign targeting opposition groups
Campaign
H score32
First: 23.03.2026 11:45
Last: 23.03.2026 11:45
Sources 1
About this happening:
The **FBI** warned that **Iranian MOIS-linked hackers** are using **Telegram C2** and **social engineering** to deliver **Windows malware** against journalists, dissidents, and ot...
Iranian MOIS Telegram malware campaign targeting opposition groups
CampaignAbout this happening: The **FBI** warned that **Iranian MOIS-linked hackers** are using **Telegram C2** and **social engineering** to deliver **Windows malware** against journalists, dissidents, and ot...
Spanish Civil Guard arrests Anonymous Fénix members
Law Enforcement
H score21
First: 23.02.2026 23:59
Last: 23.02.2026 23:59
Sources 1
How related:
Spanish authorities have arrested four alleged members of a hacktivist group believed to have carried out cyberattacks targeting government ministries, political parties, and various public institutions.
About this happening:
Spanish authorities **arrested four alleged Anonymous Fénix members**, escalating a **cybercrime enforcement action** tied to **DDoS attacks** against ministries, political partie...
Spanish Civil Guard arrests Anonymous Fénix members
Law EnforcementHow related: Spanish authorities have arrested four alleged members of a hacktivist group believed to have carried out cyberattacks targeting government ministries, political parties, and various public institutions.
About this happening: Spanish authorities **arrested four alleged Anonymous Fénix members**, escalating a **cybercrime enforcement action** tied to **DDoS attacks** against ministries, political partie...
Chinese-language money alliance reshapes ransomware ecosystem operations
Threat Actor Meta
H score23
First: 16.02.2026 12:30
Last: 16.02.2026 12:30
Sources 1
About this happening:
**Trafficking-linked crypto payments** are increasingly routed through **Telegram-based CMLN services**, **scam compounds**, and **online casinos**, expanding the scale and resili...
Chinese-language money alliance reshapes ransomware ecosystem operations
Threat Actor MetaAbout this happening: **Trafficking-linked crypto payments** are increasingly routed through **Telegram-based CMLN services**, **scam compounds**, and **online casinos**, expanding the scale and resili...
Timeline
-
23.02.2026 23:59 2 articles · 4mo ago
Spanish authorities disclose Anonymous Fénix DDoS campaign and arrests
Initial DisclosureSpanish authorities say four alleged members of Anonymous Fénix, a hacktivist group that claimed affiliation with Anonymous, carried out DDoS attacks against government ministries, political parties, and public institutions in Spain and South America while using X and Telegram to spread anti-government messaging and recruit volunteers. Investigators say the campaign began in April 2023, increased from September 2024, peaked after the Valencia floods in late October 2024, and was followed by arrests of the group's administrator, moderator, and two additional active operatives; courts also ordered seizures of the group's X and YouTube accounts and the closure of its Telegram channel.
Show sources
- Spain arrests suspected hacktivists for DDoSing govt sites — www.bleepingcomputer.com — 23.02.2026 23:59
- Spain arrests suspected hacktivists for DDoSing govt sites — www.bleepingcomputer.com — 23.02.2026 23:59