In February 2022, hours after Russian tanks rolled into Ukraine, a tweet appeared from a familiar account bearing the white mask logo. “The Anonymous collective is officially at war with the Russian government.” Within days, Russian government websites went dark. TV broadcasts were hijacked with anti-war messages. Confidential databases were leaked. For the first time, Anonymous was operating in a live warzone, a conflict that was both physical and digital.
We are no longer watching history. We are interfering with it.
What had begun as a loosely organized online protest movement had entered a new arena: cyberwarfare. And yet, unlike state-backed hacking units, Anonymous still had no headquarters, no chain of command — only a shared outrage, amplified by networks of volunteer hackers and digital activists worldwide.
The return of the legion
- Russian government ministries
- Propaganda media networks
- Corporate giants like Gazprom and Rosneft
- Satellite data systems linked to the invasion
The leaks were messy, sometimes unverifiable, but the psychological effect was immediate. Russian officials scrambled to contain information warfare on multiple fronts. Western media hailed the “return” of Anonymous.
But the truth was more complex. This wasn’t a revival of the original Anonymous of the 2010s. It was an evolution: a decentralized, digital insurgency made up of thousands of small actors, some ideologically driven, others opportunistic.
Key Anonymous Operations in the Ukraine–Russia Conflict
- February 24, 2022: Hours after Russia’s invasion of Ukraine, a tweet declares: “The Anonymous collective is officially at war with the Russian government.” Government portals in Moscow, the Kremlin, and the Duma are hit by massive DDoS waves.
- March 2022: OpRussia begins: Anonymous leaks 360,000 files from the Russian Ministry of Culture and Roskomnadzor (media regulator). Multiple TV networks are hijacked mid-broadcast to display anti-war messages. The group claims to have hacked VTB Bank and Gazprom servers.
- April 2022: Anonymous-affiliated teams (notably Network Battalion 65) publish data from the Russian Central Bank. 1.2 TB of emails from Russian state companies are leaked via DDoSecrets.
- May–August 2022: GhostSec joins operations, targeting Russian transportation and energy networks. Anonymous hacks the Russian Space Research Institute website posting a message mocking the invasion.
- Late 2022 – 2023: Activity becomes fragmented; some Anonymous factions shift focus to Iran, Myanmar, and internet freedom campaigns. Analysts note Anonymous’ transformation into a distributed volunteer cyber army rather than a single movement.
A weapon of narrative
Modern warfare isn’t fought only with missiles; it’s fought with narratives. Anonymous became part of this information battleground. Their defacements and leaks weren’t merely technical disruptions; they were acts of symbolic warfare, designed to shape perception.
By exposing documents, interrupting propaganda, and flooding the web with counter-messaging, Anonymous inserted itself into the geopolitical conversation. It blurred the lines between cyber activism, cyber espionage, and influence operations.
Governments — especially in Russia and China — accused Western intelligence agencies of “weaponizing hacktivism.” Western commentators, meanwhile, debated whether Anonymous was still a movement of conscience or now a convenient front in a digital proxy war.
The new Anonymous: a decentralized cyber militia
Unlike traditional hacktivist collectives, modern Anonymous offshoots often resemble volunteer cyber militias. They collaborate on encrypted channels, crowdsource targets, and share open-source intelligence tools.
Among the spinoffs:
- GhostSec, initially part of Anonymous, later pivoted to counterterrorism hacking.
- NB65 (Network Battalion 65), claimed responsibility for several attacks against Russian infrastructure in 2022.
- AnonSec, TeamOneFist, and other factions that mix political motives with opportunistic hacks.
Each uses the mask, the slogans, and the style of Anonymous, but not always the same ethics. The once-unified idea of “hacktivism for justice” now fragments across ideological lines: anarchist, nationalist, environmental, even religious. Anonymous has become open-source warfare. Anyone can fork the code.
State actors and the shadow game
The age of cyberwar has created an ecosystem where states, corporations, and independent actors coexist in a constant state of low-grade conflict. In this murky landscape, attribution is almost impossible.
Was that DDoS on a ministry site an act of Anonymous or a state agency hiding behind their brand? Did a leak serve public transparency, or was it foreign intelligence under a mask? This plausible deniability is part of Anonymous’ enduring strategic value. It’s both a symbol of rebellion and a smokescreen, useful for activists and governments alike.
The disinformation dilemma
Ironically, Anonymous, once hailed as a truth-seeker, now navigates a world built on disinformation. The same decentralized nature that made it resilient also makes it unreliable. Dozens of “Anonymous” accounts spread propaganda, fake ops, and deepfake videos, muddying the group’s credibility.
The result is a paradox: Anonymous is everywhere, and yet no one knows which version is real. The collective has become both an actor and a mythological weapon in global information warfare.
A new digital battlefield
Anonymous now embodies a new kind of digital guerrilla. It doesn’t occupy territory, but it can disrupt, humiliate, and expose. It operates at the intersection of protest and power, between moral outrage and geopolitical strategy.
The movement that once trolled the Church of Scientology now influences the narrative of global conflicts. And even if the original Anons have long since logged off, their idea, that collective digital resistance can confront systemic power, continues to evolve.
Anonymous was never meant to last. It was meant to spread.