Lorraine Williamson
The Guardia Civil’s dismantling of the core of the Spanish hacktivist group Anonymous Fénix is being presented as a cybercrime operation. It is that — but it also points to a wider problem: how quickly online anger after a national crisis can be redirected into coordinated digital attacks on public services.
According to the Guardia Civil, officers have now detained the four main members of the group, accused of carrying out cyberattacks against ministries, political parties, and public institutions. The force says the arrests happened in phases, with two detentions in May 2025 (Alcalá de Henares and Oviedo) and two more this month in Ibiza and Móstoles.
Why this matters beyond the hacker label
What makes this case more significant than a routine takedown is the alleged timing and escalation pattern.
The Guardia Civil says the group became especially active after the Valencia DANA, when it allegedly intensified attacks on public administration websites while claiming institutions were “responsible for the tragedy”. That framing matters because it shows how a real-world disaster can become a trigger for digitally organised retaliatory activism.
In other words, this was not only about technical disruption. It was also about narrative, recruitment, and visibility.
The alleged method was simple — and that is part of the problem
Authorities say the group relied on distributed denial-of-service (DDoS) attacks, designed to flood systems with traffic so legitimate users cannot access them normally. The Guardia Civil’s description stresses that the aim was temporary disruption, not necessarily deep system intrusion.
That is important because DDoS attacks are often easier to replicate or coordinate than more sophisticated intrusions. For public bodies, even short outages can create confusion, erode trust, and strain emergency communications — especially during politically tense moments or after major incidents.
From Telegram and X to recruitment and operational growth
The official account of the investigation says Anonymous Fénix began operating in April 2023 and used X and Telegram heavily, initially pushing anti-institutional content related to Spain and parts of South America. From September 2024, the Guardia Civil says the group escalated further, including a volunteer recruitment drive aimed at attacking high-value domains.
That progression follows a pattern seen in other online extremist or quasi-activist ecosystems: social channels first build identity and grievance, then shift into mobilisation.
What the investigation achieved beyond arrests
The case is not only about detentions. The Guardia Civil says a court ordered the intervention of the group’s X profile and YouTube account, and that its Telegram channel has been shut down.
That matters operationally. In cases like this, removing communications channels can be as significant as individual arrests because it disrupts propaganda, recruitment, and coordination all at once.
The force also said the investigation involved the Centro Criptológico Nacional (CCN) and was coordinated with specialist prosecutors and the Madrid court system, underlining how seriously Spanish authorities are treating politically motivated cyber disruption.
The takeaway
For readers in Spain, the takeaway is not only that four alleged members were arrested. It is that public institutions are now dealing with a more blended threat: part cyber nuisance, part political messaging, part social-media mobilisation.
The alleged attacks did not need to permanently breach systems to have an impact. Temporary disruption of official websites can still become a headline, a propaganda win, and a recruitment tool if the group controls the online narrative around it.
The bigger question after the arrests
The operation appears to have neutralised the core of Anonymous Fénix, and some coverage says the group’s activity dropped sharply after the first arrests.
But the more important question is whether similar groups can reappear under a new name the next time a major political or social crisis hits. If the model is grievance + social channels + volunteer DDoS coordination, the barrier to imitation may be lower than many people assume.
Spain’s next cyber challenge may be less about elite hackers — and more about fast-moving digital mobs
That is why this case matters. The arrests close one chapter, but they also show how quickly public anger can be turned into coordinated online disruption when platforms, messaging, and timing line up