KillNetKillnet CollectiveBlack SkillsWe Are Killnet
Attribution
Pro-Russia hacktivist collective; not formally attributed to a Russian state agency, though multiple vendors assess ideological and probable indirect ties to Russian interests. Anonymous Sudan, publicly aligned with Killnet in 2023, is assessed by several researchers to likely be a Russia-linked front rather than a genuine Sudanese group.
Origin
Russia
First seen
2022-01
Last active
2024
Motivation
Ideological/nationalist hacktivism and political signaling in support of Russia; disruption and psychological effect against NATO, Ukraine-aligned and Western targets, with later attempts at financial/reputational monetization via a 'private military hacking company' brand.
Attribution confidence
medium
MENA targeting
Israel
Sectors
Government
Why it mattersState-sponsored / APT actor, medium confidence, documented targeting Israel (Government sector).
What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.
No open hunts or recent alerts tracked against this actor right now.
←2023 State of The Threat – A Year in ReviewreportORKL2023-09-29
←2023-05-30 - Void Rabisu’s Use of RomCom Backdoor Shows a Growing Shift in Threat Actors’ GoalsreportORKL2023-06-04
Uses
→Acquire Infrastructure: Web ServicestechniqueATT&CK mapping
→Endpoint Denial of Service: Service Exhaustion FloodtechniqueATT&CK mapping
→
Coverage robustness · vs this actor
How evasion-resistant our detection coverage is against Killnet's techniques — Summiting the Pyramid scores analytics (1 brittle – 5 robust); the actor inherits through its TTPs. This is a detection-engineering metric, not an attribution signal — see Attribution for confidence.
Techniques with a robust rule
0%
Techniques with any detection
1 / 9
Mean robustness (of covered)
2
Useful?
Network Denial of Service: Reflection Amplification