Killnet Group Targeting Ukraine Supporters with DDoS Attacks

guest · Sep 8, 2022

September 8, 2022

The Russia-Ukraine conflict has produced a monumental shift in the threat landscape. It’s motivated state-sponsored groups around the world to try to capitalize on the conflict.
In this blog, we'll examine Killnet. It's one such state-sponsored group that's acting on Russia's behalf.
Click to expand...

A Survey of Killnet's Activity
Killnet began its pro-Russian wartime effort on March 1, 2022, when it released the following video on Twitter: [...]
Since then, it's mainly used distributed denial-of-service (DDoS) attacks to carry out its goals. These attacks have targeted entities supportive of Ukraine. Additionally, they have often functioned as a response to a perceived action that's hindered Russia's wartime efforts.

Let's take a look at some recent examples of Killnet's attacks.
Click to expand...

France
On March 3, Killnet used a DDoS attack to bring down "En-marche.fr," the website of the leading political party in France. 24 News Responder wrote [...]
Lithuania
Near the end of June, Infosecurity Magazine reported on Killnet having struck several Lithuanian government websites. The group released a video explaining that they had launched the attack as a response to Lithuania's sanctions against Russia for having invaded Ukraine.
Click to expand...

The United States
One of Killnet's first attacks against a U.S. target occurred in March. According to Newsweek, the attack involved an attempt to crash the website for the Bradley International Airport. Killnet released a message at the time explaining that "when the supply of weapons to Ukraine stops, attacks on the information structure of your country will instantly stop."

Three months later, Flashpoint shared that Killnet had claimed responsibility for an attack against the website of the U.S. Congress.
Killnet has since threatened to target other U.S. entities. Chief among them is Lockheed Martin, an operation which HackRead explains might have resulted in the theft of employee data.
Click to expand...

guest · Sep 8, 2022

Japan Government Websites Hit By Cyber-Attacks, Killnet Suspected
By Alessandro Mascellino @a_mascellino - September 7, 2022

The Russia–affiliated hacking group Killnet claimed responsibility for a series of cyber–attacks against Japanese companies and 20 websites across four government ministries.

In particular, the country's government is reportedly looking into whether problems to the aforementioned sites were caused by a denial-of-service (DDoS) attack, according to Chief Cabinet Secretary Hirokazu Matsuno.
Click to expand...

Japan's digital agency also said its e–Gov administrative portal was experiencing login problems to some services on Wednesday but did not specify the cause.

"We are aware that the [Killnet] hacker group suggested it was behind the attacks, but at the moment, we are still investigating the cause of the failures, including the group's involvement," Matsuno added.
The minister also said that while the government websites could not be accessed on Tuesday evening, they were restored on the same day.
Click to expand...

According to Sergey Shykevich, threat intelligence group manager at Check Point Software, however, it is likely that Killnet was behind these attacks.

"Killnet's reasoning for these attacks is due to Japan's support of Ukraine in the ongoing Russia–Ukraine war, as well as a decades–long dispute over the Kuril Islands, which both sides claim sovereignty over," Shykevich told Infosecurity Magazine.
Further, the cybersecurity expert said organizations in countries being attacked by Killnet must be vigilant of the risks, as the group uses various tools to achieve its goals, including data theft and disruptive attacks.
Click to expand...

The alleged attacks against Japanese state websites follow a recent wide–scale attack by Killnet on sites in Italy, Lithuania, Estonia, Poland and Norway.
Click to expand...

guest · Nov 24, 2022

Pro-Russian group Killnet claims responsibility for DDoS attack that has taken down the European Parliament site
By Pierluigi Paganini - November 23, 2022

The Pro-Russia group of hacktivists Killnet claimed responsibility for the DDoS attack that today took down the website of the European Parliament website.

The European Parliament is under a sophisticated cyberattack. A pro-Kremlin group has claimed responsibility,” said parliament’s president, Roberta Metsola. “Our IT experts are pushing back against it and protecting our systems. This, after we proclaimed Russia as a State-sponsor of terrorism. My response: #SlavaUkraini (Glory to Ukraine).”
The Director General for Communication and Spokesperson of the European Parliament, Jaume Dauch, also confirmed the attack via Twitter.
Click to expand...

In October, the pro-Russia hacktivist group ‘KillNet‘ claimed responsibility for massive distributed denial-of-service (DDoS) attacks against the websites of several major airports in the US. The DDoS attacks have taken the websites offline, users were not able to access them during the offensive.

KillNet has previously targeted many other countries that condemned the Russian invasion of Ukraine, including Italy, Romania, Estonia, Lithuania , and Norway.
Click to expand...

guest · Jan 26, 2023

Cyberattacks Target Websites of German Airports, administration bodies and banks
By AFP - January 26, 2023

The websites of German airports, public administration bodies and financial sector organizations have been hit by cyberattacks instigated by a Russian “hacker group”, authorities said Thursday.
Click to expand...

The Federal Cyber Security Authority (BSI) had “knowledge of DDoS attacks against targets in Germany”, a spokesman told AFP.

The attacks were aimed “in particular at the websites of airports”, as well as some “targets in the financial sector” and “the websites of federal and state administrations”, the spokesman said.
The attack had been “announced by the Russian hacker group Killnet”, the BSI spokesman said.
Click to expand...

Attacks on public administrations were “largely repelled with no serious impacts”, the BSI said.

The interior ministry for southwestern Baden-Wuerttemberg state acknowledged “nationwide” DDoS attacks since Wednesday evening against websites, including those of public administration and the regional police.
Germany is on high alert for cyberattacks in the wake of Russia’s war in Ukraine.
Click to expand...

guest · Jan 31, 2023

Pro-Russia group Killnet targets US healthcare with DDoS attacks
By Pierluigi Paganini - January 31, 2023

The Pro-Russia group Killnet launched a series of DDoS attacks against US healthcare organizations and hospitals. The group announced the attacks on its Telegram channel, calling for action against the US government healthcare.
Click to expand...

At the time of this writing, many of the above websites are not reachable.

Healthcare organizations are critical infrastructure and cyber attacks represent a serious threat to them. Even if DDoS attacks are considered low-level offensives, we cannot exclude that pro-Russia groups in the future could launch more sophisticated attacks that can cause serious damage.
Click to expand...

We have also to consider that the group could extend its current offensive to healthcare of western countries that are supporting Ukraine.
Click to expand...

FanJ · Jan 31, 2023

Yes, same as I posted yesterday in the other thread:
https://www.wilderssecurity.com/threads/why-healthcare-security-matters.378153/page-67#post-3129641

guest · Feb 1, 2023

Dutch, European Hospitals ‘Hit by Pro-Russian Hackers’
By AFP - February 1, 2023

Dutch cyber authorities said Wednesday that several hospital websites in the Netherlands and Europe were likely targeted by a pro-Kremlin hacking group because of their countries’ support for Ukraine.
Click to expand...

The UMCG hospital in the northern Dutch city of Groningen, one of the largest in the country, saw its website crash in a cyberattack on Saturday.

“European hospitals including in the Netherlands have most likely been hit by the pro-Russian hacking group Killnet,” said the Dutch National Cyber Security Centre (NCSC).
“This group announced DDoS attacks on among other things, hospitals (in countries) helping Ukraine in its war against Russia,” it said.
Click to expand...

Although reports say that Killnet threatened to target some 31 hospitals throughout the Netherlands, so far only the UMCG seems to have been affected.

“Currently the DDoS attacks are successfully mitigated and the impact of the attacks is limited,” the NCSC said.
Hospitals in Britain, Germany, Poland, Scandinavia and the United States were also said to be targeted.
Click to expand...

FanJ · Feb 1, 2023

Although reports say that Killnet threatened to target some 31 hospitals throughout the Netherlands, so far only the UMCG seems to have been affected.
Click to expand...

No. The hospitals in the Dutch cities Leiden and Maastricht were also affected.

guest · Feb 7, 2023

Here's a list of proxy IPs to help block KillNet's DDoS bots
By Jessica Lyons Hardcastle - February 6, 2023

A free tool aims is helping organizations defend against KillNet distributed-denial-of-service (DDoS) bots and comes as the US government issued a warning that the Russian cybercrime gang is stepping up its network flooding attacks against hospitals and health clinics.
Click to expand...

At current count, the KillNet open proxy IP blocklist lists tens of thousands of proxy IP addresses used by the Russian hacktivists in their network-traffic flooding events. SecurityScorecard's threat researchers developed the list following their ongoing investigation into Killnet and other network-spamming miscreants.

"DDoS attacks are relatively unsophisticated but can still cause serious damage, especially when they affect hospitals," the security firm wrote in a recent blog about KillNet.
Click to expand...

Additionally, as Akamai noted in a recent blog, KillNet attackers do their homework before selecting targets. "Recent events have shown that healthcare is likely to continue as a prime target," it said, adding that these attacks usually focus on organizations that aren't well protected .

The health-care industry had the most DDoS attacks on the Akamai platform in 2022, excluding "leading verticals" including digital commerce, according to the provider.
Click to expand...

Log in or Sign up

Killnet Group Targeting Ukraine Supporters with DDoS Attacks

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

FanJ Updates Team

guest Guest

FanJ Updates Team

guest Guest

Log in or Sign up

Killnet Group Targeting Ukraine Supporters with DDoS Attacks

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

FanJ Updates Team

guest Guest

FanJ Updates Team

guest Guest

Useful Searches