Spanish Government Ministries, Spanish Political Parties and Spanish Public Institutions: Spanish police arrest suspected Anonymous members over DDoS attacks on government sites

Spanish Police Dismantle Anonymous Fénix in Crackdown on DDoS Attacks

In May 2025, Spanish authorities arrested four key members of the hacktivist group Anonymous Fénix, following a series of DDoS attacks targeting government ministries, political parties, and public institutions. The Guardia Civil identified and detained the group’s administrator and moderator in Alcalá de Henares (Madrid) and Oviedo (Asturias), later apprehending two additional suspects in Ibiza and Móstoles (Madrid).

Active since April 2023, Anonymous Fénix operated primarily on X (formerly Twitter) and Telegram, where they disseminated anti-government content and targeted institutions in Spain and several South American countries. Their attacks intensified after the 2024 DANA storm a catastrophic weather event that caused severe flooding and fatalities in Valencia with the group publicly blaming authorities for the disaster.

Under a court order, police seized control of the group’s X profile and YouTube account, while also dismantling their Telegram channel. The arrests mark a significant disruption of the hacktivist collective’s operations.

Source: https://www.helpnetsecurity.com/2026/02/23/spain-guardia-civil-arrests-anonymous-fenix-ddos-attacks/

Spanish Government Ministries TPRM report: https://www.rankiteo.com/company/ministry-of-justice-of-spain

Spanish Political Parties TPRM report: https://www.rankiteo.com/company/spanish-ministry-of-education-culture-and-sport

Spanish Public Institutions TPRM report: https://www.rankiteo.com/company/spanish-ministry-of-education-culture-and-sport

"id": "minspa1771962969",
"linkid": "ministry-of-justice-of-spain, spanish-ministry-of-education-culture-and-sport",
"type": "Cyber Attack",
"date": "2/2026",
"severity": "100",
"impact": "6",
"explanation": "Attack threatening the economy of geographical region"

{'affected_entities': [{'industry': 'Public Sector',
                        'location': 'Spain',
                        'name': 'Spanish Government Ministries',
                        'type': 'Government'},
                       {'industry': 'Public Sector',
                        'location': 'Spain',
                        'name': 'Spanish Political Parties',
                        'type': 'Political Organization'},
                       {'industry': 'Public Sector',
                        'location': 'Spain, South American countries',
                        'name': 'Public Institutions',
                        'type': 'Government'}],
 'attack_vector': 'Network Flooding',
 'date_detected': '2023-04-01',
 'date_publicly_disclosed': '2025-05-01',
 'date_resolved': '2025-05-01',
 'description': 'In May 2025, Spanish authorities arrested four key members of '
                'the hacktivist group *Anonymous Fénix*, following a series of '
                'DDoS attacks targeting government ministries, political '
                'parties, and public institutions. The Guardia Civil '
                'identified and detained the group’s administrator and '
                'moderator in Alcalá de Henares (Madrid) and Oviedo '
                '(Asturias), later apprehending two additional suspects in '
                'Ibiza and Móstoles (Madrid).',
 'impact': {'brand_reputation_impact': 'Negative impact on targeted '
                                       'institutions',
            'operational_impact': 'Disruption of services',
            'systems_affected': 'Government ministries, political parties, '
                                'public institutions'},
 'investigation_status': 'Resolved',
 'motivation': 'Hacktivism, Anti-government sentiment',
 'post_incident_analysis': {'corrective_actions': 'Arrests, dismantling of '
                                                  'communication channels',
                            'root_causes': 'Hacktivist motivation, perceived '
                                           'government failure during DANA '
                                           'storm'},
 'references': [{'source': 'Guardia Civil'}],
 'regulatory_compliance': {'legal_actions': 'Arrests under court order'},
 'response': {'containment_measures': 'Arrest of key members, seizure of '
                                      'social media accounts',
              'law_enforcement_notified': 'Yes',
              'remediation_measures': 'Dismantling of Telegram channel, X '
                                      'profile, and YouTube account'},
 'threat_actor': 'Anonymous Fénix',
 'title': 'Spanish Police Dismantle Anonymous Fénix in Crackdown on DDoS '
          'Attacks',
 'type': 'DDoS Attack'}