They claimed authorities were responsible for the tragedy
Em Espanha, as autoridades desmantelaram a liderança do Anonymous Fénix, um coletivo de hackers que durante quase três anos usou ferramentas digitais para contestar instituições governamentais, intensificando os ataques após a tragédia das cheias de Valência. Quatro homens foram detidos em operações coordenadas entre maio de 2024 e fevereiro de 2026, numa investigação que envolveu múltiplos organismos judiciais e os serviços de criptologia do Estado. O caso recorda-nos que a fronteira entre o ativismo digital e a perturbação deliberada de serviços públicos é cada vez mais disputada — e cada vez mais vigiada.
- Durante quase três anos, o Anonymous Fénix lançou ataques sistemáticos contra ministérios, partidos políticos e infraestruturas digitais em Espanha e na América do Sul.
- A tragédia das cheias de Valência em 2024 serviu de pretexto para a escalada mais agressiva do grupo, que invadiu sistemas de administração pública e justificou os ataques culpando o Estado pela catástrofe.
- A Guardia Civil conduziu detenções em duas fases — primeiro o administrador e o moderador, depois os dois atacantes mais ativos — desmantelando progressivamente a estrutura de comando.
- Os perfis do grupo no X, YouTube e Telegram foram bloqueados ou removidos por ordem judicial, cortando os canais de recrutamento e coordenação.
- Persiste a incerteza sobre a dimensão real das operações e se os quatro detidos representam o núcleo duro do grupo ou apenas uma camada de uma estrutura com redundâncias.
As autoridades espanholas detiveram quatro líderes do Anonymous Fénix, um coletivo de hackers que desde abril de 2023 atacava instituições governamentais em Espanha e na América do Sul através das plataformas X e Telegram. A Guardia Civil anunciou as detenções numa operação faseada: o administrador e o moderador do grupo foram capturados em maio do ano anterior, em Alcalá de Henares e Oviedo; a informação recolhida permitiu identificar e deter dois membros adicionais — os atacantes mais prolíficos — em Ibiza e Móstoles, em meados de fevereiro.
Durante mais de um ano, a atividade do grupo manteve-se relativamente contida. Em setembro de 2024, porém, o Anonymous Fénix lançou uma campanha de recrutamento para ampliar os seus ataques de negação de serviço distribuída — os chamados DDoS —, que inundam sistemas com pedidos excessivos até os tornar inacessíveis. Quando as cheias devastaram Valência no final de 2024, o grupo aproveitou a tragédia para intensificar os ataques a sítios governamentais, apresentando-os como retaliação legítima contra um Estado que consideravam responsável pelo desastre.
A investigação foi coordenada entre o Ministério Público para o Cibercrime, a Procuradoria de Madrid e o Tribunal de Primeira Instância de Madrid, com apoio técnico do Centro Criptológico Nacional. Como resultado, toda a presença digital do grupo foi sistematicamente eliminada por ordem judicial. O que permanece em aberto é a verdadeira dimensão das operações — quantos sistemas foram comprometidos, se houve danos duradouros — e se as quatro detenções representam o fim do Anonymous Fénix ou apenas um revés numa estrutura com capacidade de se reconstituir.
Spanish authorities moved against the leadership of Anonymous Fénix, a hacking collective that had spent nearly three years launching digital assaults on government institutions across Spain and South America. The Guardia Civil announced the arrests on a Sunday in late February, having methodically dismantled what amounted to a distributed network of activists operating under the Anonymous banner.
The investigation began with the capture of two men—the group's administrator and moderator—taken into custody in May of the previous year from locations in Alcalá de Henares, outside Madrid, and from Oviedo in Asturias. The intelligence gathered from those arrests proved crucial. It led investigators to identify two additional members, the most prolific attackers within the organization, whom they arrested in mid-February from Ibiza and Móstoles, also in the Madrid region.
Anonymous Fénix had started operating in April 2023, using X and Telegram as their primary platforms to broadcast grievances against Spanish institutions and various government bodies across South America. For more than a year, their activity remained relatively contained. But in September 2024, the group shifted into a higher gear, launching a recruitment campaign to enlist volunteers willing to participate in coordinated cyberattacks against significant digital infrastructure. The timing would prove consequential.
When a devastating storm struck Valencia in late 2024, the group saw an opening. They intensified their assault on government websites, successfully penetrating multiple public administration systems. In their messaging, they framed the attacks as justified retaliation, claiming that state authorities bore responsibility for the disaster and its aftermath. The storm became both a catalyst and a justification for their most aggressive campaign.
The technical weapon they wielded was the distributed denial-of-service attack, or DDoS—a method that floods a target system with an abnormal volume of requests, overwhelming its capacity to function. The effect is temporary but disruptive: legitimate users cannot access services, and the targeted institution must work to restore normal operations. Anonymous Fénix directed these attacks at ministry websites, political party servers, and various public institutions.
The investigation was coordinated across multiple Spanish judicial bodies: the Prosecutor's Office for Cybercrime, the Madrid Prosecutor's Office, and the Madrid Court of First Instance. The National Cryptological Center, Spain's signals intelligence agency, provided technical support. As a result of the operation, the group's presence on digital platforms was systematically erased. Their X profile was judicially blocked, their YouTube channel removed, and their Telegram group shut down. The infrastructure through which they recruited, coordinated, and communicated had been dismantled.
What remains unclear is the full scope of their operations—how many attacks succeeded, how many systems they penetrated, and whether they caused lasting damage beyond temporary service disruptions. The arrests represent a significant blow to the group's structure, but whether they signal the end of Anonymous Fénix or merely a temporary setback depends on whether the organization had redundancies in place, or whether the four arrested members were truly the core of the operation.
Notable Quotes
The group justified their attacks on government websites by claiming authorities were responsible for the Valencia tragedy— Guardia Civil statement
The Hearth Conversation Another angle on the story
Why did this group choose to attack after the Valencia storm specifically? Was it opportunism or something deeper?
It seems like both. They'd been building toward something since September, recruiting and escalating. But the storm gave them a narrative—a way to frame attacks as political rather than purely destructive. They could say they were holding power accountable.
And the platforms they used—X, Telegram, YouTube—those weren't hidden. They were operating in plain sight.
Exactly. They weren't trying to hide. They were trying to be seen, to recruit, to build a movement. That visibility is what made them vulnerable. Every message, every recruitment post, every claim of responsibility left a trail.
The DDoS attacks themselves—how serious were they really? Did they cause real harm?
They disrupted services temporarily, which matters if you're a citizen trying to access government resources during a crisis. But they're not destructive in the way a data breach is. They're more like a digital sit-in—disruptive theater with a political message.
So arresting four people and shutting down their accounts—does that actually stop the movement?
It stops this iteration of it. But Anonymous as a concept is decentralized. These four were the organized core, the ones recruiting and coordinating. Without them, the infrastructure collapses. Whether it rebuilds depends on whether there's appetite for it elsewhere.