Spain Detains Two Suspected Anonymous Members for DDoS Attacks: Hacktivist Cell Dismantled
Published
Key Takeaways
- Arrests Made: Spanish authorities have detained two individuals believed to be members of the hacktivist group "Anonymous Fénix" in connection with a series of cyberattacks.
- Cyber Attacks: The group is accused of launching Distributed Denial-of-Service (DDoS) attacks against government ministries, political parties, and public institutions.
- Motive: The attacks were reportedly a form of protest, with the group holding the government responsible for the tragic DANA floods that occurred in 2024.
Spanish authorities have confirmed the Anonymous arrests, detaining two individuals allegedly affiliated with "Anonymous Fénix," a splinter cell of the global hacktivist collective. The suspects are accused of orchestrating a campaign of cyberattacks against state infrastructure following catastrophic DANA floods in 2024.
The arrests, conducted by the Guardia Civil, took place last week in Ibiza and Móstoles, Madrid.
DDoS Attacks on Public Institutions
The primary tactic employed by Anonymous Fénix involved DDoS attacks on public institutions. The Guardia Civil said several attempts to access government websites were successful.
The operation was coordinated through social media platforms, primarily X (formerly Twitter) and Telegram, where the group recruited participants and disseminated its ideology. However, Fénix's social media presence was relatively small.Â
Following the arrests, Spanish authorities have seized the group's X profile, Telegram channel, and a YouTube account.Â
Hacktivism Landscape
While Anonymous has seen its global influence wane from its peak, splinter groups continue to emerge, justifying its cyberattacks as a form of protest. Two group leaders were arrested in Alcalá de Henares, Madrid, and Oviedo, Asturias, in May 2025, when Anonymous defaced the GlobalX airline website linked to U.S. deportation flights.
In July 2025, the infrastructure of pro-Russian hacktivists NoName057(16) that focused on striking NATO allies was dismantled in a global crackdown.
Last month, a hacker leaked the alleged data of three Spanish Transport Ministry officials after the Adamuz train crash.
Related
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular