Suspected Anonymous members detained in Spain over post-flood DDoS blitz
(2026/02/23)
- Reference: 1771849590
- News link: https://www.theregister.co.uk/2026/02/23/anonymous_arrests_spain/
- Source link:
Spanish police say four self-proclaimed members of Anonymous are in custody after allegedly carrying out several cyberattacks on public authorities in the wake of the 2024 DANA floods.
Guardia Civil officers arrested two of Anonymous Fénix's "most active members" last week in Ibiza and Móstoles, Madrid. These bring the total to four, following the arrest of two group leaders in Alcalá de Henares, Madrid, and Oviedo, Asturias, in May 2025.
[1]
Suspected Anonymous Fénix member arrested in Spain. Image courtesy of Guardia Civil
All four were detained for carrying out distributed denial-of-service (DDoS) attacks on government ministries, political parties, and public institutions, which they claimed were "responsible for the tragedy" of the floods.
DANA floods
Referred to in Spanish as DANA (Depresión Aislada en Niveles Altos), the floods of 2024 were caused by cold high-altitude, low-pressure systems that led to heavy rainfall and storms.
In October 2024, a DANA event struck various regions in Spain, such as Albacete, Almería, and Málaga, but hit the coastal city of Valencia the hardest.
More than 230 people died as a result of the intense floods that ripped through regions of the country, 229 of which were recorded in Valencia. Some [2]reports suggest that around a third of children in the city still experience fear whenever they hear rainfall.
Many Spaniards blamed the government for its poor handling of the disaster, claiming that the authorities were not adequately prepared to handle such a crisis.
The police declined to name any of the four members, but a court order allowed the seizure of Anonymous Fénix's X profile and YouTube account, and officials closed its Telegram account.
After spinning up as an Anonymous offshoot in 2023, the group was most active on X and Telegram, reposting news about the natural disaster. By 2024, it was using the platforms to recruit members to join its hacktivism.
The scale of Anonymous Fénix's operation was not large if its social media following is anything to go by. Its X account had fewer than 700 followers and Telegram channel subscribers numbered in the dozens, [3]reported Spanish newspaper El País, which saw the channels before they were pulled offline.
[4]
Guardia Civil did not specify any of the public institutions that were attacked, but said several of the attempts on government websites were successful.
[5]AWS says more than 600 FortiGate firewalls hit in AI-augmented campaign
[6]Attacker gets into France's database listing all bank accounts, makes off with 1.2 million records
[7]PayPal app code error leaked personal info and a 'few' unauthorized transactions
[8]ShinyHunters demands $1.5M not to leak Vegas casino and resort chain data
Originating around 2003 on 4chan, Anonymous and its adoption of Guy Fawkes masks quickly became synonymous with hacktivism.
The disparate group of global volunteers helped establish Anonymous as a leading hacktivist group, thanks in large part to successful attacks on the likes of [9]Sony and [10]PayPal , a long-running campaign against [11]Scientology , and in the early years, large-scale pranks on websites like [12]Habbo Hotel .
[13]
Its presence today is diminished compared to its heyday, although splinter groups like Fénix still pop up occasionally. ®
Get our [14]Tech Resources
[1] https://regmedia.co.uk/2026/02/23/anonymous_fenix_arrest.jpg
[2] https://www.bbc.co.uk/news/articles/cx2dp775nd1o
[3] https://elpais.com/espana/2026-02-22/cuatro-detenidos-por-lanzar-ciberataques-masivos-a-partidos-e-instituciones-tras-la-dana.html
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aZyHvcf-Pt9WePe5SnYhmgAAABI&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://www.theregister.com/2026/02/23/aws_fortigate_firewalls/
[6] https://www.theregister.com/2026/02/22/french_bank_hack/
[7] https://www.theregister.com/2026/02/20/paypal_app_code_error_leak/
[8] https://www.theregister.com/2026/02/20/shinyhunters_wynn_resorts/
[9] https://www.theregister.com/2011/05/04/sony_implicates_anonymous/
[10] https://www.theregister.com/2011/07/19/anonymous_hacking_arrests/
[11] https://www.theregister.com/2010/01/27/scientology_ddos_guilty_plea/
[12] https://www.youtube.com/watch?v=eksS4OnR1PI
[13] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aZyHvcf-Pt9WePe5SnYhmgAAABI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[14] https://whitepapers.theregister.com/
Guardia Civil officers arrested two of Anonymous Fénix's "most active members" last week in Ibiza and Móstoles, Madrid. These bring the total to four, following the arrest of two group leaders in Alcalá de Henares, Madrid, and Oviedo, Asturias, in May 2025.
[1]
Suspected Anonymous Fénix member arrested in Spain. Image courtesy of Guardia Civil
All four were detained for carrying out distributed denial-of-service (DDoS) attacks on government ministries, political parties, and public institutions, which they claimed were "responsible for the tragedy" of the floods.
DANA floods
Referred to in Spanish as DANA (Depresión Aislada en Niveles Altos), the floods of 2024 were caused by cold high-altitude, low-pressure systems that led to heavy rainfall and storms.
In October 2024, a DANA event struck various regions in Spain, such as Albacete, Almería, and Málaga, but hit the coastal city of Valencia the hardest.
More than 230 people died as a result of the intense floods that ripped through regions of the country, 229 of which were recorded in Valencia. Some [2]reports suggest that around a third of children in the city still experience fear whenever they hear rainfall.
Many Spaniards blamed the government for its poor handling of the disaster, claiming that the authorities were not adequately prepared to handle such a crisis.
The police declined to name any of the four members, but a court order allowed the seizure of Anonymous Fénix's X profile and YouTube account, and officials closed its Telegram account.
After spinning up as an Anonymous offshoot in 2023, the group was most active on X and Telegram, reposting news about the natural disaster. By 2024, it was using the platforms to recruit members to join its hacktivism.
The scale of Anonymous Fénix's operation was not large if its social media following is anything to go by. Its X account had fewer than 700 followers and Telegram channel subscribers numbered in the dozens, [3]reported Spanish newspaper El País, which saw the channels before they were pulled offline.
[4]
Guardia Civil did not specify any of the public institutions that were attacked, but said several of the attempts on government websites were successful.
[5]AWS says more than 600 FortiGate firewalls hit in AI-augmented campaign
[6]Attacker gets into France's database listing all bank accounts, makes off with 1.2 million records
[7]PayPal app code error leaked personal info and a 'few' unauthorized transactions
[8]ShinyHunters demands $1.5M not to leak Vegas casino and resort chain data
Originating around 2003 on 4chan, Anonymous and its adoption of Guy Fawkes masks quickly became synonymous with hacktivism.
The disparate group of global volunteers helped establish Anonymous as a leading hacktivist group, thanks in large part to successful attacks on the likes of [9]Sony and [10]PayPal , a long-running campaign against [11]Scientology , and in the early years, large-scale pranks on websites like [12]Habbo Hotel .
[13]
Its presence today is diminished compared to its heyday, although splinter groups like Fénix still pop up occasionally. ®
Get our [14]Tech Resources
[1] https://regmedia.co.uk/2026/02/23/anonymous_fenix_arrest.jpg
[2] https://www.bbc.co.uk/news/articles/cx2dp775nd1o
[3] https://elpais.com/espana/2026-02-22/cuatro-detenidos-por-lanzar-ciberataques-masivos-a-partidos-e-instituciones-tras-la-dana.html
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aZyHvcf-Pt9WePe5SnYhmgAAABI&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://www.theregister.com/2026/02/23/aws_fortigate_firewalls/
[6] https://www.theregister.com/2026/02/22/french_bank_hack/
[7] https://www.theregister.com/2026/02/20/paypal_app_code_error_leak/
[8] https://www.theregister.com/2026/02/20/shinyhunters_wynn_resorts/
[9] https://www.theregister.com/2011/05/04/sony_implicates_anonymous/
[10] https://www.theregister.com/2011/07/19/anonymous_hacking_arrests/
[11] https://www.theregister.com/2010/01/27/scientology_ddos_guilty_plea/
[12] https://www.youtube.com/watch?v=eksS4OnR1PI
[13] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aZyHvcf-Pt9WePe5SnYhmgAAABI&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[14] https://whitepapers.theregister.com/
Always liked the mask.
And Guido Fawkes was Irish/Spanish apparently. As well as being a mercenary.
Commenting as AC for obvious reasons.——>