Loading story…
Spain’s Guardia Civil arrested four alleged members of the hacktivist group Anonymous Fénix for suspected distributed denial-of-service (DDoS) attacks against government ministries, political parties, and other public institutions. Authorities said the group emerged as an Anonymous offshoot in 2023 and used X and Telegram to publicize its activity and recruit participants, with operations intensifying after the 2024 DANA floods, when the group blamed public authorities for the disaster and claimed responsibility for attacks on public administration websites.
Investigators previously identified the group’s leadership—described as an administrator and a moderator—who were arrested in May 2025, and said evidence from that phase led to two additional suspects characterized as among the most active members, detained in Ibiza and Móstoles (Madrid). Under court order, law enforcement also seized control of the group’s online presence, including its X profile and YouTube account, and shut down its Telegram channel; police indicated some attempted attacks against government websites were successful but did not publicly name the affected institutions.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
Following the investigation and arrests, a court ordered the seizure of the group's X and YouTube accounts, and authorities shut down its Telegram channel. The action disrupted the group's public communications and recruitment infrastructure.
Spanish authorities later arrested two more alleged Anonymous Fénix members described as the most active participants, in Ibiza and Móstoles. Reporting indicates these detentions occurred earlier in February 2026.
In May 2025, Spain's Guardia Civil arrested two suspected key members of Anonymous Fénix in Alcalá de Henares and Oviedo. Authorities identified them as the group's alleged administrator and moderator, or leaders.
After the late-October 2024 DANA storm and flash floods in Valencia, Anonymous Fénix allegedly escalated attacks on public administration websites, blaming authorities for the tragedy. Some government website attacks were reported to have succeeded.
Authorities said the group's attacks against Spanish ministries, political parties, public institutions, and some South American targets intensified from September 2024. The campaign involved DDoS attacks alongside online propaganda and recruitment.
Spanish authorities said the hacktivist group Anonymous Fénix began operating in April 2023. The group used X and Telegram to spread anti-institution messaging, repost news, and recruit participants for hacktivist activity.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
5 references tracked. Mallory keeps watching after this page renders.
sentinelone.com
Open sourcescworld.com
Open sourcego.theregister.com
Open sourcehelpnetsecurity.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Spanish National Police, working with international partners, dismantled a cybercrime organization accused of stealing and laundering about **€140 million** through fake investment platforms, **business email compromise (BEC)**, CEO fraud, invoice fraud, and man-in-the-middle attacks. Investigators said the group operated an industrial-scale laundering network tied to more than **800 bank accounts**, **120 business accounts**, **19 companies**, and **67 money mules**, with confirmed links to over **€94 million** in transactions and another **€61 million** connected to 2024 CEO fraud activity. Authorities arrested **four suspects** in Spain, Portugal, and Panama during an operation supported by **Europol** and **Interpol**. Raids in Spain and Portugal led to the seizure of computers, smartphones, and other digital devices allegedly used in the schemes, while police froze **€3 million** in criminal proceeds for potential victim restitution. Officials said the network’s main operators were taken into custody and the laundering infrastructure was effectively dismantled, though the investigation into its wider international links remains ongoing.
Jul 16, 2026
The FBI escalated its investigation into **LulzSec** and affiliated **Anonymous** hackers by seizing server racks from a Reston, Virginia data center used by Swiss host DigitalOne, knocking multiple unrelated websites and services offline. According to reporting, agents were pursuing one customer but removed three equipment enclosures that may have held systems for many other clients, disrupting sites including **Curbed Network**, **Instapaper**, and **Pinboard** even though they were not identified as targets. U.S. officials said the operation was part of an active, broader inquiry supported by other agencies and international cybercrime partners. The enforcement push widened with arrests and searches tied to suspected members on both sides of the Atlantic. British authorities arrested a teenager on suspicion of hacking, while reports also described the arrest in London of a leading LulzSec figure and FBI raids on homes of suspected Anonymous participants in the United States, including a search in Hamilton, Ohio linked to the online alias `m_nerva`. Reporting said investigators drew on evidence connected to Ryan Cleary, who was charged under the UK Computer Misuse Act, as authorities worked to identify participants in the group after a string of high-profile intrusions and internal leaks exposed tensions inside LulzSec.
Jun 29, 2026
Spanish police, with FBI support, arrested a man in Palencia suspected of supporting the pro-Russia hacktivist groups **Cyber Army of Russia Reborn** (`CARR`) and **Z-Pentest`, authorities said. Investigators believe the suspect had close ties to the groups, may have carried out attacks on behalf of **NoName057(16)**, and was linked to cyber operations targeting critical national infrastructure in countries backing Ukraine. Police searched his home, seized computer equipment and cryptocurrency storage devices, and froze a wallet suspected of holding proceeds tied to cybercrime. Authorities also said the suspect helped a Ukrainian `CARR` member flee toward Russia through Poland and Belarus after an FBI tip-off in August 2025. The arrest forms part of wider US-European efforts to identify and disrupt politically motivated pro-Russia cyber actors, including **Operation Riptide** and the FBI’s **Operation Red Circus**. Officials have not publicly identified the suspect or disclosed specific charges, and the investigation remains ongoing.
Aug 14, 2026