apt

Killnet

dormant · last signal 1y agoAttribution: ModeratePlausible and partly corroborated — some gaps or single-source elements.

APT / State-sponsored

KillNetKillnet CollectiveBlack SkillsWe Are Killnet

Attribution

Pro-Russia hacktivist collective; not formally attributed to a Russian state agency, though multiple vendors assess ideological and probable indirect ties to Russian interests. Anonymous Sudan, publicly aligned with Killnet in 2023, is assessed by several researchers to likely be a Russia-linked front rather than a genuine Sudanese group.

Origin

Russia

First seen

2022-01

Last active

2024

Motivation

Ideological/nationalist hacktivism and political signaling in support of Russia; disruption and psychological effect against NATO, Ukraine-aligned and Western targets, with later attempts at financial/reputational monetization via a 'private military hacking company' brand.

Attribution confidence

medium

MENA targeting

Israel

Sectors

Government

Why it mattersState-sponsored / APT actor, medium confidence, documented targeting Israel (Government sector).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

Associated with

Related to

Anonymous SudanactorTechnique overlap
Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroffactorTechnique overlap
ShadowSyndicate infrastructure illuminationreportORKL2025-08-01
2023 State of The Threat – A Year in ReviewreportORKL2023-09-29
2023-05-30 - Void Rabisu’s Use of RomCom Backdoor Shows a Growing Shift in Threat Actors’ GoalsreportORKL2023-06-04

Uses

Acquire Infrastructure: Web ServicestechniqueATT&CK mapping
Endpoint Denial of Service: Service Exhaustion FloodtechniqueATT&CK mapping

Observed techniques

9 distinct

Rows marked inferred are OSINT-extracted enrichment for actors without a MITRE Group ID — treat as analyst assessment, not authoritative ATT&CK attribution.

Technique	Name	Tactic	Observed use
T1498.001 ↗inferred	Network Denial of Service: Direct Network Flood	Impact	Microsoft observed KillNet healthcare DDoS as 53% UDP floods and 44% TCP floods at 250K-5M pps from ~22,000 bot sources, with large-scale source-IP spoofing and vector switching to evade mitigation
T1498.002 ↗inferred	Network Denial of Service: Reflection Amplification	Impact	Microsoft reported 29% of KillNet-attributed attacks were DNS amplification, alongside UDP spoof floods
T1499.002 ↗inferred	Endpoint Denial of Service: Service Exhaustion Flood	Impact	Microsoft observed layer-7 HTTP request floods against victim websites; Cyfirma documents affiliate Phoenix using simple HTTP GET floods at millions of requests/sec
T1499.001 ↗inferred	Endpoint Denial of Service: OS Exhaustion Flood	Impact	Microsoft observed TCP SYN and ACK floods and layer-7 attacks that hold many TCP connections open to deplete memory/state resources
T1591 ↗inferred	Gather Victim Org Information	Reconnaissance	Flashpoint assesses KillNet selects targets opportunistically off the news cycle (Eurovision/Italy May 2022, Lithuania June 2022) rather than strategically; Microsoft describes recruitment of OSINT specialists for targeting

Useful?

Regional co-occurrence · associated techniques

Honesty note

Regional co-occurrence is association, not prediction. These techniques appeared alongside Killnet's activity across the tracked MENA roster — a TIE-style association computed on our corpus (not CTID's model), not a prediction of the next move. Ranked by support-adjusted lift (over-representation among actors like this one vs. the roster base rate, damped when few actors back it), so neither a merely-common technique nor a tiny-sample coincidence floats to the top. A hunting lead only; never recorded as observed. ICS techniques are excluded.

T1583.001assoc T1059.005assoc T1102.002assoc T1090assoc T1583.003assoc T1074.001assoc T1555.003assoc T1132.001assoc

Killnet

Observed techniques

Regional co-occurrence · associated techniques

Countermeasures · D3FEND