Who Is Russian Hacker Group Killnet?

In April 2021, Five Eyes issued a warning about the possible cyber threats that could happen amid Russia's invasion of Ukraine. Five Eyes is the intelligence alliance group of five countries — United States, United Kingdom, New Zealand, Canada, and Australia — that monitors electronic communications. The alert also noted the public threats and pledges from cybercrime groups that support Russia (via CISA).

Sometime in March 2022, the pro-Russia hacking group, Killnet, emerged. As reported by Digital Shadows, the name Killnet originated from a tool used for carrying out DDoS (Distributed Denial of Service) attacks. A DDoS attack floods and overwhelms a target server with online traffic, which prevents users from connecting to websites and accessing services. Killnet has carried out a series of attacks since April 2022. "Killnet's aim is to make Europeans pay for their unequivocal support of Ukraine and punish Western governments for their anti-Russian sentiment," researcher Stefan Soesanto said about the hacktivist group, as noted by Politico.

Killnet's mission is to stop anti-Russian nations to stop the "aggression" against the Kremlin. The group believes that the nations that provide support to Ukraine are adding more to the aggression. As reported by Politico, many Russians support Killnet and deem what they are doing as heroic acts. In May 2022, Killnet released a video wherein they declared war on 10 countries, namely, the U.S., the UK, Ukraine, Poland, Estonia, Lithuania, Romania, Latvia, Italy, and Germany.

According to Digital Shadows, Killnet is comprised of what they call their "special forces." Some of them are volunteers who carry out DDoS attacks, and they often recruit members to join. Killnet also has a number of squads that are tasked to carry out DDoS attacks on specific countries. Members of the group have specific rules to follow, one of them banning the attack on countries in the CIS (Commonwealth of Independent States) organization.

Killnet has launched a series of attacks since April 2022, the first of which targeted Romanian government sites, followed by Moldovan and Czech Republic websites. In May, the group performed a DDoS attack on several Italian websites, including the National Institute of Health and the Ministry of Defense (via Sysdig). Even the Eurovision Song Contest became a target. According to Euro News, Killnet carried out a cyberattack on the competition after Russia was banned from the contest. Fortunately, the attempt was blocked and the attack didn't push forward.

In August 2022, Killnet carried out a cyberattack on Lockheed Martin, a security and defense company that provided weaponry to Ukraine. As reported by the Eurasian Times, the group called Lockheed Martin the "actual sponsor of world terrorism." In October, several U.S. airport websites were targeted. Websites were inaccessible to users, but according to CNN, no flights were disrupted because of the cyberattack.