Who are Anonymous and why are they fighting alongside Ukraine?

Hacking group Anonymous has declared a cyberwar on Russia in response to its attack on Ukraine. But who are Anonymous, and what interest do they have in siding with Ukraine?

Now easily distinguishable by a white mask with a grin, Anons are members of a decentralized international collective of tech activists and hackers. As they would claim, Anonymous is no one and everyone at once, with anyone being able to sign their hacking effort under the coalition’s name.

Their targets have included governments, state organizations, tech giants, and big enterprises. Perhaps most famous for their politically and socially motivated cyberattacks, they are viewed by many as “digital superheroes,” who serve their own justice – especially when law enforcement fails to do so.

“In the new video Vibes made, Anonymous represents extrajudicial justice, the superhero entering to right what the normal course of the law cannot—an idea that can seem deeply appealing now that the ordinary enforcers of justice—the police—appear to some to be the source of the crime,” Dale Beran writes for The Atlantic.

The group is believed to have originated in 2003 on the message board 4chan, which gave the name “Anonymous” to all users who decided not to specify their usernames. Mostly teenagers, users would gather together in virtual chats to discuss modern politics.

Small-scale hacks started off as coordinated pranks and raids on online games and chat rooms. But by 2008, the group began choosing more serious targets, such as the Church of Scientology. At the same time, their signature Guy Fawkes masks, used as an inspiration by David Lloyd in V for Vendetta, became a symbol of Anonymous and their rebellion against the abusers of power.

The anti-oppression coalition

Over time, many people have been arrested over affiliation with Anonymous in the US, the UK, India, Spain, the Netherlands, Turkey, and other countries. The group has drawn the attention of the FBI and various governments following a series of high-profile cyberattacks.

In 2010, Anonymous targeted PayPal, Visa, Amazon, and Mastercard for cutting off WikiLeaks donations.

Later in 2011, they successfully launched DDoS attacks on eight Tunisian government's websites during the Tunisian revolution. Continuing with their support for the Arab Spring, they’ve leaked the passwords of the email addresses, as well as emails, of hundreds of Middle Eastern governmental officials and targeted Egyptian government websites during the Egyptian revolution.

Many attacks were to follow: from hacking the Syrian Defense Ministry website and placing a pro-democracy flag on it to joining Nigeria’s People's Liberation Front and the Naija Cyber Hacktivists.

While not all deeds of the collective always had a positive outcome (for example, in 2014, they outed a wrong man for the police shooting of Michael Brown in 2014’s Missouri protests,) they earned them a reputation of fighters for justice.

Fight for Ukraine

On February 24th, the hacktivist collective announced that they’re officially in cyberwar against the Russian government following the invasion of Ukraine.

Since then, they have leaked the database of the Ministry of Defence and the Ministry of Economic Development of Russia, taken down many state websites, including government.ru, hacked Russian state TV channels, and intercepted Russian military communications.

“Anonymous has ongoing operations to keep .ru government websites offline,, and to push information to the Russian people so they can be free of Putin's state censorship machine. We also have ongoing operations to keep the Ukrainian people online as best we can,” the collective shared in a tweet.

While most Russian organizations remained silent about the nature of attacks, Russia Today (RT) – the state-run TV channel that Anonymous referred to as “the Russian propaganda station” – has attributed DDoS attacks on its website to the group.

“After a statement by Anonymous, RT’s websites became the subject of massive DDoS attacks from some 100 million devices, mostly based in the U.S. Due to the attacks there might be temporary website access limitations for some users, yet RT is promptly resolving these issues,” an RT spokesperson told Motherboard in an email.

On the other hand, Roscosmos has denied claims that a series of disruptive attacks by the affiliates of Anonymous led to Russian officials losing control over their “spy satellites.” Originally, the NB65 hacking group claimed to have shut down the Control Center of the Russian Space Agency. The Director-General of Roscosmos, Dmitry Rogozin, called the information of “petty swindlers” to be false, previously stating that the Russian space industry is effectively protected from cyberattacks.

Since the conflict is ongoing and many Russian entities are reluctant to disclose cyberattacks, it can be complicated to verify their source and accuracy. However, many experts suggest that it is indeed in line with the collective’s previous deeds and capabilities.

“It can be difficult to directly tie this activity to Anonymous, as targeted entities will likely be reluctant to publish related technical data. However, the Anonymous collective has a track record of conducting this sort of activity and it is very much in line with their capabilities,” Jamie Collier, a consultant at US cybersecurity firm Mandiant, told The Guardian.

But what’s next? As hackers also join the Russian forces – such as the Conti ransomware group that sided with Putin – it looks like we’ll find ourselves not only in a state-led cyberwar, but also in a conflict reflecting private interests and personal values. Cyberwarfare is rather different from a traditional war in the sense that independent hacktivist groups often have as many – if not more – skills and resources to cause real disruption.

In today’s world, as some experts believe, cyberattacks are not some distinct digital incidents that have no physical effect anymore – they’re a part of a real war happening on the ground.

“We have long theorized that cyberattacks are going to be part of any nation-state’s arsenal and I think what we’re witnessing for the first time frankly in human history is cyberattacks have become the weapon of first strike,” Hitesh Sheth, CEO of Vectra AI, told CNBC.