Anonymous Fénix Hackers Arrested after DDoS Attacks on Spanish Government Websites

Spanish authorities have dismantled a hacktivist group that targeted government institutions with Distributed Denial-of-Service (DDoS) attacks.

Key takeaway

• Spanish authorities arrested four core members of hacktivist group Anonymous Fénix.
• The group launched DDoS attacks against ministries, political parties and public institutions.
• Activity escalated after the 2024 Valencia DANA floods, which the group used to justify attacks.
• Law enforcement seized the group’s X, YouTube, and Telegram accounts.

What happened?

The group, which calls itself Anonymous Fénix, was responsible for numerous attacks against ministries, political parties, and agencies, usually justified as politically motivated. 

The Guardia Civil arrested four core members of Anonymous Fénix in an operation across Madrid, Oviedo, Ibiza and Móstoles. Investigators initially identified the group’s administrator and moderator, then tracked two additional members. 

Authorities also seized the group’s X (formerly Twitter) and YouTube accounts and shut down its Telegram channel.

Who is Anonymous Fénix?

Anonymous Fénix operated as a Spanish hacktivist group that claimed affiliation with the broader international “Anonymous” movement. 

The group began its activities in April 2023 and quickly established a presence on social media. Members bombarded X and Telegram with anti-government messaging and used the platforms to coordinate digital actions and even to recruit volunteers. 

The group intensified its operations in September 2024 and increased its activity after the DANA floods in Valencia. They blamed the authorities for the tragedy and used the crisis to justify coordinated attacks against public administration websites.

How does a DDoS work?

Attackers use DDoS attacks to flood a website or online service with massive traffic, rendering it inaccessible. Instead of stealing data, attackers overwhelm infrastructure, although it’s not unheard of for attackers to use the cover of a DDoS attack to penetrate an organization's network undetected. 

When a DDoS campaign succeeds:

• People can no longer access government websites
• Government services stall
• Emergency communications slow or even stop

Even if the outage is only temporary, such attacks can cause widespread disruption, especially during emergencies, which is why they are a key weapon of hacktivist groups.

FAQ

What is Anonymous Fénix?

Anonymous Fénix was a Spanish hacktivist group that carried out DDoS attacks against government institutions and claimed affiliation with the Anonymous movement.

What is a DDoS attack?

A DDoS attack overwhelms a website or service with excessive traffic, preventing legitimate users from accessing it.

Did Anonymous Fénix steal data?

Authorities reported service disruptions caused by DDoS attacks.

Why did the group escalate activity after the floods?

The group blamed authorities for the Valencia tragedy and used the event to justify targeting public administration websites.

Can private companies become targets?

Yes. Hacktivist groups frequently target corporations tied to political events, controversial policies or high-profile crises.