Emerging Hacktivist Threats in Africa: A Critical Analysis

Introduction

In early 2026, Africa has witnessed a significant surge in hacktivist cyber operations, posing critical threats to the continent's digital infrastructure. Groups such as Anonymous Sudan and Dark Storm Team have been at the forefront of these activities, targeting government agencies, critical infrastructure, and private sector entities.

Anonymous Sudan

Active since mid-January 2023, Anonymous Sudan has conducted over 35,000 distributed denial-of-service (DDoS) attacks against various targets, including government agencies, universities, and hospitals. While the group claims to act on pro-Palestinian ideological grounds, their operations have also involved extortion attempts. In October 2024, U.S. authorities indicted two Sudanese brothers, Ahmed and Alaa Omer, for operating Anonymous Sudan, leading to the seizure and disabling of the group's DDoS tools and infrastructure. (en.wikipedia.org)

Dark Storm Team

Formed in late 2023, Dark Storm Team is a pro-Palestinian hacktivist group that has employed tactics similar to pro-Russian groups like Killnet. The group has launched large-scale DDoS campaigns and ransomware attacks targeting NATO countries, Israel, and the United States. Notably, Dark Storm Team claimed responsibility for a cyberattack on X (formerly Twitter) on March 10, 2025, causing multiple outages. (en.wikipedia.org)

SiegedSec

SiegedSec, also known as the "Gay Furry Hackers," was a black-hat hacktivist group active from early 2022 until its dissolution in July 2024. The group was responsible for several high-profile cyberattacks, including breaches of NATO, the Idaho National Laboratory, and Real America's Voice. In November 2023, SiegedSec collaborated with Anonymous Sudan to breach Israeli telecommunications company Cellcom, and a week later, they targeted critical infrastructure within Israel. (en.wikipedia.org)

OpNigeria

OpNigeria is a collective of hacktivist groups, including LiteMods, WhiteRabbitGang, and YounesAnonymous, formed by members of Anonymous. The group gained prominence during the EndSARS movement in Nigeria in 2020, hacking multiple Nigerian government websites and banks to support the protests. (en.wikipedia.org)

BQT.Lock Cyberattack Group

Emerging in mid-2025, BQT.Lock is a ransomware group operating from the Middle East, led by Karim Fayad. The group blends financial extortion with ideological motives linked to Hezbollah and Iranian state-linked cyber activities. BQT.Lock employs a ransomware-as-a-service (RaaS) model, targeting entities aligned with geopolitical adversaries, including Israeli infrastructure and Gulf states. (en.wikipedia.org)

Cyber Jihad Movement

Established in June 2025, the Cyber Jihad Movement is a Sunni Islamist hacking group affiliated with Al-Qaeda. The group has engaged in DDoS attacks and website defacements, targeting U.S. institutions and European governments. In August 2025, the group pledged allegiance to Al-Qaeda and has since coordinated cyber operations in support of conflicts involving Iran, Afghanistan, and Pakistan. (en.wikipedia.org)

Conclusion

The landscape of hacktivist cyber operations in Africa is evolving, with groups like Anonymous Sudan and Dark Storm Team leading the charge. Their activities underscore the need for enhanced cybersecurity measures and international cooperation to mitigate the risks posed by these actors. Ongoing monitoring and analysis are essential to understand the motivations and tactics of these groups, enabling the development of effective countermeasures.

Highlights:

• African authorities dismantle massive cybercrime and fraud networks, recover millions, Published on Thursday, August 21
• Cybercrime: 14 arrests, thousands of illicit cyber networks disrupted in Africa operation, Published on Thursday, August 17