Recommended Free Tools
Microsoft attributed the early-June 2023 service disruptions to layer-7 DDoS attacks tracked as Storm-1359. Anonymous Sudan is connected to the attacks through public responsibility claims and a later U.S. Department of Justice affidavit—not by name in Microsoft’s technical incident post. The affidavit describes alleged Sudan-based operators, but its account is an investigative allegation, not a settled court finding.
What happened to Microsoft’s cloud services?
Microsoft said traffic surges against some of its services began in early June 2023 and temporarily affected availability. In its June 16, 2023, post, the Microsoft Security Response Center (MSRC) said it was tracking the ongoing distributed denial-of-service (DDoS) activity as Storm-1359. A DDoS attack overwhelms a service with traffic or connections so legitimate users may have trouble reaching it; in this case, Microsoft described activity aimed at disrupting services and attracting publicity.
As an Amazon Associate I earn from qualifying purchases.
ENISA’s November 2023 retrospective describes a June 7 attack on Azure application-layer infrastructure, with service degradation and minor disruptions, partial disruption over several days, and an extortion attempt. That account gives a more specific description of the incident’s timing and effects than Microsoft’s advisory, which characterized the impacts more generally as temporary availability problems.
How Anonymous Sudan is linked to the attacks
Storm-1359 and Anonymous Sudan are not interchangeable labels. Storm-1359 is Microsoft’s tracking name for the activity it analyzed. Microsoft’s public MSRC post does not name Anonymous Sudan. A contemporaneous Microsoft spokesperson was reported as identifying the group, and a later DOJ affidavit connects Anonymous Sudan to numerous DDoS attacks, including attacks affecting Microsoft services.
#1 Best Overall
| Attribution framing | Who uses it | What it describes | What it establishes |
|---|---|---|---|
| Storm-1359 | Microsoft | A tracked actor associated with the DDoS activity | Microsoft’s technical account of the attacks and their methods; the MSRC post does not identify the actor as Anonymous Sudan. |
| Anonymous Sudan | The group’s public identity and the DOJ affidavit’s account | A group that claimed responsibility for, or was identified as conducting, numerous attacks | The affidavit’s investigative allegations about the group, operators and tool; it is not a final judicial finding. |
What the DOJ affidavit says about the group
The DOJ affidavit describes an investigation drawing on source code, administrator logs, online accounts, email and other records. It says the group and its associated DDoS tool appeared to be operated primarily by Ahmed and an additional co-conspirator, and that the investigation indicated Sudan-based leadership. These are the affiant’s investigative conclusions, not facts established by a final judgment.
The affidavit also records competing claims about the group’s identity and affiliations. Media and threat-research accounts had suggested Russian state sponsorship, while Anonymous Sudan claimed an affiliation with Killnet. The affiant’s account points to Sudan-based leadership but allows that the group may share ideology with, or sometimes act in concert with, Killnet and similar groups. Those possibilities do not establish Russian state control.
Rank #2
The tool was variously called “Godzilla Botnet,” “Skynet Botnet” and “InfraShutdown.” The affidavit alleges that administrators also sold DDoS services to criminal actors and that logs showed more than 100 users, including administrators and customers. That figure is an investigative assertion in the 2024 affidavit, not an independently audited count. It also means that references to “hackers” can blur two different alleged roles: the tool’s operators and customers who allegedly used the service.
How the attacks worked
Microsoft described three layer-7 techniques. Layer 7 is the application layer—the part of the system that handles requests for web pages and other services—so attacks at this layer consume resources needed to serve legitimate users. A disruption attack is not, by itself, evidence that attackers accessed data.
- HTTP(S) floods: Large volumes of handshakes and requests put pressure on application-serving resources. Microsoft described an observed pattern reaching a “high load (in the millions)” of HTTP(S) requests; this is a description of an attack pattern, not an incident-wide request total.
- Cache bypass: Requests are made to go through the frontend to origin servers instead of being served from cache, increasing the load reaching the underlying service.
- Slowloris-style connections: Connections hold server resources open by slowly or incompletely receiving responses.
Microsoft assessed that the activity likely drew on virtual private servers, rented cloud infrastructure, open proxies, botnets and DDoS tools. This describes the resources Microsoft said the activity likely used; it does not identify every system or person involved.
What was affected—and what is known about customer data?
The DOJ affidavit says Microsoft employees described attacks primarily in June 2023 affecting internet-based services, including Outlook 365 and other services hosted in Azure. It recounts employee interview statements about disruption at a Los Angeles-region Microsoft data center and other locations, as well as losses of “millions of dollars.” The loss description is not a public audited figure, and the affidavit does not establish a precise incident-wide cost or total number of affected users.
On customer data, Microsoft’s MSRC statement was: “We have seen no evidence that customer data has been accessed or compromised.” That is Microsoft’s reported finding; the availability disruption should not be presented as proof of a data breach.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What defenses Microsoft recommends
Microsoft said it hardened its layer-7 defenses, including by tuning Azure Web Application Firewall (WAF). Its guidance describes mitigations to apply as appropriate to a service’s traffic and risk—not guarantees that an attack will have no effect.
Quick Recap
- Use application-layer protection such as a WAF.
- Enable the WAF bot protection managed rule set.
- Block malicious IP addresses identified in the attack.
- Apply geographic restrictions or rate limits where suitable for the service.
- Write custom rules to block or rate-limit traffic matching known attack signatures.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
