apt

Killnet

dormant · last signal 1y agoAttribution: ModeratePlausible and partly corroborated — some gaps or single-source elements.

APT / State-sponsored

KillNetKillnet CollectiveBlack SkillsWe Are Killnet

Attribution

Pro-Russia hacktivist collective; not formally attributed to a Russian state agency, though multiple vendors assess ideological and probable indirect ties to Russian interests. Anonymous Sudan, publicly aligned with Killnet in 2023, is assessed by several researchers to likely be a Russia-linked front rather than a genuine Sudanese group.

Origin

Russia

First seen

2022-01

Last active

2024

Motivation

Ideological/nationalist hacktivism and political signaling in support of Russia; disruption and psychological effect against NATO, Ukraine-aligned and Western targets, with later attempts at financial/reputational monetization via a 'private military hacking company' brand.

Attribution confidence

medium

MENA targeting

Israel

Sectors

Government

Why it mattersState-sponsored / APT actor, medium confidence, documented targeting Israel (Government sector).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

Associated with

Related to

Anonymous SudanactorTechnique overlap
Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroffactorTechnique overlap
ShadowSyndicate infrastructure illuminationreportORKL2025-08-01
2023 State of The Threat – A Year in ReviewreportORKL2023-09-29
2023-05-30 - Void Rabisu’s Use of RomCom Backdoor Shows a Growing Shift in Threat Actors’ GoalsreportORKL2023-06-04

Uses

Acquire Infrastructure: Web ServicestechniqueATT&CK mapping
Endpoint Denial of Service: Service Exhaustion FloodtechniqueATT&CK mapping

Indicators

No indicators linked yet

IOC extraction runs nightly against new reporting on this actor. Check back after tomorrow's corpus refresh.

Useful?