The U.S. Department of Justice unsealed a federal indictment charging Sudanese operators of the Anonymous Sudan syndicate, while an international law enforcement coalition dismantled the group’s “Godzilla” and “InfraShutdown” distributed denial-of-service (DDoS) infrastructure. Responsible for over 35,000 attacks globally, the platform compromised high-bandwidth virtual private server (VPS) fleets across commercial cloud hosting providers, routing traffic through tens of thousands of dynamically rotating open proxies to obfuscate origin IP addresses and bypass upstream scrubbing centers.

The infrastructure executed high-concurrency Layer 7 HTTPS request floods generating millions of requests per second to exhaust application thread pools and TLS caches, while simultaneously launching 600 Gbps volumetric Layer 4 UDP reflection and TCP SYN-ACK floods. In-the-wild barrages crippled emergency triage systems at Cedars-Sinai Medical Center and disrupted Microsoft 365, Azure, and OpenAI services. Under Operation PowerOFF, the FBI seized command-and-control servers and API databases alongside mitigations coordinated with Akamai, Cloudflare, CrowdStrike, and Microsoft.

Why it matters:

• Bullet 1 — Technical & Architecture Risk: Cloud-hosted DDoS platforms combining multi-million RPS Layer 7 floods with distributed open-proxy routing defeat conventional IP-reputation filtering and volumetric scrubbing, directly starving application compute threads and backend databases.
• Bullet 2 — Strategic & Defender Imperative: Defenders must deploy behavioral rate limiting and cryptographic challenge handshakes (such as managed proof-of-work) at CDN edges, implement strict ingress throttling on TLS negotiation endpoints, and establish verified multi-provider failover routing.