Spanish police arrest suspected Anonymous members over DDoS attacks on government sites

Spanish police (Guardia Civil) arrested four members of the hacktivist group Anonymous Fénix over DDoS attacks targeting ministries, political parties and public institutions.

Police raid (Source: Guardia Civil)

Police identified the organization’s leadership, including its administrator and moderator, who were arrested in May 2025 in Alcalá de Henares (Madrid) and Oviedo (Asturias). Evidence gathered during that phase of the investigation led authorities to two additional suspects described as the most active members. They were detained earlier this month in Ibiza and Móstoles (Madrid).

According to a police statement, “the group began operating in April 2023 and was particularly active on the social networks X and Telegram, where they spread news and information against Spanish institutions and those of different South American countries.”

Activity peaked following the 2024 DANA storm, a severe weather event that caused widespread flooding and casualties in the Valencia region. The attackers then targeted multiple public administration websites and publicly blamed authorities for the tragedy.

Acting under court order, authorities took control of the group’s X profile and YouTube account and dismantled its Telegram channel.