| Formation | March 2022 |
|---|---|
| Founder | "Killmilk" |
| Type | Hacker group,cyberwarfare organization |
| Purpose | Pro-RussiaDDoS andcyberattacks |
| Headquarters | Unknown (allegedlyRussia) |
Region served | Globally |
| Membership | Unknown |
Founder | Allegedly "Killmilk" |
| Remarks | Linked to attacks on critical infrastructure |
Killnet is a pro-Russiahacker group known for itsDoS (denial of service) and DDoS (distributed denial of service) attacks towards government institutions and private companies in several countries during the2022 Russian invasion of Ukraine. The group is thought to have been formed sometime around March 2022.
TheFive Eyes intelligence alliance issued a warning about attacks on critical infrastructure by Russian-aligned groups, including Killnet, in April 2022.[1][2]
Killnet were behind attacks on Romanian government websites from 29 April 2022 to 1 May 2022.[3]
Followingexplosions in unrecognizedTransnistria, theInformation and Security Service of the Republic of Moldova reported that the pro-Killnet hacking group had launched a series of cyberattacks from abroad against websites of Moldovan official authorities and institutions. This was days after the attack on Romanian websites.[4]
Killnet claimed responsibility for attacks onCzech state institution web sites in April 2022.[5]
The websites of the Istituto Superiore di Sanità and the Automobile Club of Italy were attacked on Friday 14 May 2022. The Italian Senate website was attacked and blocked for an hour in the same attack.[6] On 29 May 2022, they announced an "irreparable damage" attack on Italy scheduled for the following day. On 30 May 2022, it attacked Italy and managed to block a few websites, while the attack on the CSIRT site was unsuccessful. The attack was not as devastating as predicted. Killnet later complimented the CSIRT for their defensive work, mocking the government to raise a few thousand dollars to the team for their work.
Killnet hackers are suspected of having made an attempt to block theEurovision Song Contest website during Ukraine's performance at the2022 contest with a DDoS attack, which was blocked by the Italian state police, however, the group denied on theirTelegram channel that their attack had failed. They subsequently attacked the state police site emphasizing how they blocked the attack on Eurovision and not the same.[6] Following the attack, they threatened to attack 10 European countries, including Italy.[6]
The group claimed responsibility for the DDoS attacks against Lithuanian network infrastructure.[7][8][9] They said that the cyber attack on Lithuania was in retaliation for it stopping transit of goods to Russia's Kaliningrad exclave.[7][8][9]
The group targeted Norwegian organizations through various DDoS attacks on 28 June 2022. TheNational Security Authority of Norway believed no private data was compromised.[10][11]
Killnet targetedLatvia'spublic broadcaster in the largest cyberattack in the country's history. The broadcaster said the attack was repelled.[12]
On 1 August 2022, the group and its founder called "Killmilk" claimed responsibility for a cyber-attack on the American defence corporationLockheed Martin, as a retaliation for theHIMARS systems supplied by U.S. to Ukraine. The group said that the Lockheed Martin “is the actual sponsor of world terrorism" and that "is responsible for thousands and thousands of human deaths." Shortly before the attack, the group announced it will carry out a new type of cyber-attack, different from theirDoS andDDoS cyber-attacks carried out before. Killmilk said the attack targeted Lockheed Martin's production systems as well as informations about the company’s employees for them to be “persecuted and destroyed around the world!”.[13]
Several US airport websites were attacked on 10 October 2022.[14]
On 6 September 2022, Killnet announced that it had attacked 23 websites of four ministries and agencies, including e-Gov, a portal site for administrative information administered by theDigital Agency, and eLTAX, a local tax website administered by theMinistry of Internal Affairs and Communications, as well as the social network service "mixi".[15][16] On September 7, they also posted a videodeclaring war on theJapanese government and announced that they had attacked theTokyo Metro andOsaka Metro.[17][18] At a press conference on the same day,Chief Cabinet SecretaryHirokazu Matsuno explained that no information had been leaked as a result of this attack at this time. As for Killnet's involvement, he stated, "We are aware that they are hinting at a criminal act, but we are still confirming the cause of the failure, including the relevance.[16]
According to the Twitter post published by the threat research firm CyberKnow, Killnet and their founder, Killmilk threatened that they would attack theGeorgian government if it continues to work against the Russian Federation.[19]
On 26 January 2023, the GermanFederal Office for Information Security (BSI) announced that a wide-ranging DDoS attack against various agencies and companies in Germany was taking place since the night before.[20] According to the BSI, websites from airports were particularly affected, as well as those of companies in the financial sector and those of the federal and state administrations.[20] The attacks had been announced in advance by Killnet, supposedly as retaliation for the German government's decision to sendLeopard 2 battle tanks to Ukraine.[21]
In October 2023 they initially refused to abide byICRC rules for hackers, but later agreed to.[22][23]
In November 2023Gazeta.Ru named a man they claimed was Killmilk, the leader of Killnet.[24] This follows claims that he had started targeting the Russian Federation.[24]
Part of theRusso-Ukrainian war (2022–present) | |||||||||||||||||||||||||||
| Overview |
| ||||||||||||||||||||||||||
| Military engagements |
| ||||||||||||||||||||||||||
| War crimes | |||||||||||||||||||||||||||
| Reactions |
| ||||||||||||||||||||||||||
| Impact |
| ||||||||||||||||||||||||||
| Key people |
| ||||||||||||||||||||||||||
| Related | |||||||||||||||||||||||||||
