This is an evolving post and will likely be updated over time. Online “community” or “criminal gangs” etc. can be fluin and dynamic, thinking of them in rigid structures and trying to compare them to “In Real Life (IRL)” organisationas directly doesn’t really work. They work generally in a collective fashion. No masters and no slaves etc.

“Hacker” Groups

I don’t really like to use the term “hacker” in this sense, perhaps hacktivist or criminal groups is the right fit, however, words aside there is the question: Who is KILLNET, are they a threat and who are they a threat to?

Who is KILLNET?

KILLNET was suposedly formed as a resonse to the IT ARMY of Ukraine (Ukraine Cybe Army) (formed late Feb) which is odd given the first post from KILLNET was on January the 23rd and IT ARMY of UKRAINE setup their telegram on Feb 26th.

The number of “members” of KILLNET is probably hard to determine, in their “main” telegram channel they have over 60K members. This isn’t really that many though.

There’s also the fact it’s split into killnet hacking and Legion Russia, and then further into other subgroups.

High Level Assessment

Given how “easy” attribution and monitoring threats in cyberspace is (NOT) it’s hard to say:

• Who operated the group
• Who is active in the group
• What their capabilities are at a given point in time

However I’ve put together a high level summary view based on what i’ve seen so far.

Group Name	KILLNET
Estimated Skill Level	Low
Estimated Capability Level	Low
Risk Estimate	Low
Historic Impact Estimate	Low
Country/Regional Alignment	Russia
General Cyber Threat Assessment level	Low (if you aren’t in the target bracket and/or if you have CDNs/DoS Protections)
Known for	Denial of Service (DoS)
Alternate Names/Pseudonyms	“Cyber Army of Russia”
Website	killweb.io
Currently Targetting	Romania
Broadly Targeting	Countries supporting Ukraine/The West/NATO
Possible Future Targets	Italy (based on telegram posts), POLAND
Assessment Confidence	Low-Moderate
Summary	The pottential for impact could be high for a specific org if they are targetted and have not taken steps to put in place DoS protections. The nature of these style of groups means the capability and skill levels can be significantl varied and dynamic. It should be noted that the risk level to your organisation may signifcantly vary based on geography, political alignment, nature of business and the infrastrctuure, capabilities and controls you have in place to mitigate DoS etc.

The groups noise level vs confirmed impact leads me to believe currently this group is not a significant threat to organisations. Whilst there appears to be intent and motivation, I would be surprised given the inception date and the lack of “confirmed” activity outside of claimed denial of service that this group pose a significant threat beyond any other generic hacktivist or criminal organisation at this time. Clearly that may change, online groups can just as easily change tactics and personnel due to their fluid nature.

Their MO appears to be DoS against very specific orgs, if you are a likely candidate for “targeting” it would be prudent to take measures against the DoS and ensure you have adequate controls and practised proceedures in place to absorb, mitigate or respond to a DoS attack.

Who are KILLNET?

KILLNET appears to be a loosely grouped together PRO RUSSIAN group of actors.

What have they done?

They have claimed to have conducted Denial of Service (DoS) Attacks.

Have they had any real negative impact?

Currently the only real significant impact I’ve seen is they are in mainstream newspapers. They don’t appear to be highly effective from achieving cyber impact.

That being said the romanian security directorate has issued guidance:

dnsc.ro

They have claimed to attempt to cause disruption to the EUROVISION song contest, but this failed (oh no! anyway!):

https://www.euronews.com/culture/2022/05/16/eurovision-2022-russian-hackers-targeted-contest-say-italian-police

Russian hackers declare war on 10 countries after failed Eurovision DDoS attack | IT PRO

Italian police block Russian hackers during Eurovision | News | IBC

this seems entirely not news worthy, but that’s just well my opinion!

There is an incident or two in Romania:

Romanian government says websites attacked by pro-Russian group – The Record by Recorded Future

Now this looks like DoS:

https[:]//tp.]me/Legion_Russia pic.twitter.com/3sIeCshN5h

— MrR3b00t | #StandWithUkraine #DefendAsOne (@UK_Daniel_Card) May 18, 2022

The https://dnsc.ro/ site isn’t currently online from the UK (will check from Romania soon) so that might indicate some impact (or another event!)

Who are they aligned to?

• Their telegram channel is written in the Russian language.
• Their messaging is PRO Russian.

When did they appear?

Their telegram channel was created on January 23^rd 2022

Links

https://t.me/killnet_channel

https://t.me/s/killnet_hacking

https://t.me/s/Legion_Russia

Twitter

https[:]//twitter.com/KILLNET_LEGION

Possible Affiliates

https://t.me/cyberwar_world/

https://t.me/s/stopnatorf

https://t.me/s/CyberArmyofRussia_Reborn

Capability Level

The reason why i’ve currently rated the capability/skill as low is for a number of reasons:

1. They don’t appear to be equiping “members” in an adanced manner
2. A number of the attempted DoS “attacks” have failed
3. Currently I’ve not seen evidence of custom tooling
4. The volume of members does not appear to be high

Contrast this with the Ukraine Cyber Army which has 350 Thousand Telegram channel members, deploys custom tooling to aid it’s members and who have had demonstrable impact on it’s targets.

On May 17th 2022 they are advertising for Programmers, members to perform DDoS and Pentesters (everyone in CYBER has a skills gap right!):

DoS IoC Analysis

We are conducting metadata analysis on public IOCs from a limited successful Denail of Service (4 hoours downtime) reportedly by KILLNET. A quick analysis using Greynoise and IPINFO shows that some of these appear to be beniign, some are known “bad” in greynoise etc. Outside of that we can see evidence of traffic from proxies and “unknown” IPs at a scale that appears to line up with the DoS position.

The romain goverment site is now geofenced for internal romaining traffic only.

The DoS sources appear to be from ~11K IPs, we have not yet enriched all of these however a sample from a clust of IPS shows that a proxy network was leveraged which resides in: AS36352

This is currently listed as: COLOCROSSING

COLOCROSSING do not appear to have a great reputation in the community and are beleived to have been reported to have been hosting infrastrcuture that may have been used in previous DoS attacks.

This hosting provider and AS has historic evidence of abuse. An example of that is here: DraftKings Continues Pursuit of DDoS Attackers – Flushdraw.net

As such it’s probably not a bad idea to block traffic from this AS.

Sample Evidence

Targets

According to this article:

The Killnet group threatens to cyberattack nearly 300 other sites in Romania – HotNews.ro

The list of targeted sites so far is:

realitatea.net

tvdiaspora.ro

etnictv.ro

dibitv.ro

mioritatv.ro

orizont.tv

ercis.ro

romaniatv.net

b1tv.ro

antena3.ro

tvgo.orange.ro

kanald.ro

tvgo.orange.ro

digi24.ro

tvrplus.ro

alephnews.ro

smartv.media

alephbusiness.ro

agro-tv.ro

primatv.ro

netstreaming.eu

nasul.tv

trinitas.tv

credo.tv

sperantatv.ro

alfaomega.tv

a7tv.ro

angelustv.ro

stirileprotv.ro

mooz.tv

radiozu.ro

ercis.ro

btv.ro

inedittv.ro

live.novapress.ro

ogradatv.com

profit.ro

jobtv.ro

twitch.tv

tezaurtv.ro

qubtv.ro

atomictv.ro

informatiatv.ro

twitch.tv

musceltv.ro

realitateasportiva.net

realitateastar.net

hd365.tv

tvtotal.ro

moldovatv.ro

autenticmediatv.ro

dottotv.ro

tvarad.ro

46.4.14.12/btvlive

dobrogea.tv

liratv.es

intermediatv.ro

curiertv.ro

exclusivtv.ro

rochannel.ro

kisstv.ro

protvplus.ro

privesc.eu

grt.md

trm.md

jurnaltv.md

realitatealive.md

tv8.md

n4.md

tezaur.mlbfan.org

publika.md

zonam.md

btv.md

eacea.ec.europa.eu

isjiasi.ro

isjcj.ro

ismb.edu.ro

edu.ro

ies-info.ro

britishcouncil.ro

isjb.ro

isjtulcea.ro

ise.ro

goethe.de

cylex.ro

ilr.ro

institutlevant.ro

insse.ro

colegiulgoethe.ro

lyceefrancais.ro

isjbrasov.ro

confucius.institute.ubbcluj.ro

edupedu.ro

usm.md

isjilfov.ro

isj.tm.edu.ro

wellbeing-institute.ro

isjdolj.ro

insp.gov.ro

destepti.ro

isjbn.ro

distanta.ro

isjbraila.ro

isjneamt.ro

sper.ro

proteo.cj.edu.ro

isjneamt.ro

univ-ovidius.ro

isj.hd.edu.ro

isj.educv.ro

institutulmontessori.ro

rist.ro

cnred.edu.ro

curtis.edu

edumanager.ro

iquads.ro

bari.mae.ro

iiccmer.ro

ices.acadiasi.org

lliacademy.ro

uad.ro

seminarulcaransebes.ro

scoala-sanitara-fundeni.ro

animv.ro

itsybitsy.ro

snspa.ro

deceit.site

sov.ro

mai.gov.ro

acttm.ro

brasovcity.ro

magazinulmilitar.ro

legislatie.just.ro

roarmy.adlunap.ro

scoalapolitie.ro

armataromaniei.ro

defense.ro

m.defenseromania.ro

rumaniamilitary.ro

military-shop.ro

military-surplus.ro

kaki.ro

m-force.ro

dpa.ro

navy.ro

armyacademy.ro

edu.ro

cybercommand.ro

mta.ro

camaraziimilitari.ro

armata-buzau.ro

armatasalvarii.ro

roaf.ro

geomil.ro

resboiu.ro

arhivelenationale.ro

echipamentemilitare.ro

mae.ro

forter.ro

sie.ro

afahc.ro

smmmsfa.ro

amazon.com

brcmn.ro

monitoruloficial.ro

historia.ro

spp.ro

romarm.ro

idr.ro

asap-romania.ro

bg15mc.ro

anmb.ro

careerromania.autoliv.com

clujarm.ro

dedeman.ro

kaufland.ro

auchan.ro

romania-auchan.ro

mega-image.ro

carrefour.ro

lidl.ro

issasupermarket.ro

profi.ro

penny.ro

supermercato.ro

metro.ro

posta-romana.ro

tribunalulbucuresti.ro

app-romania.ro

finantarepartide.ro

europarl.europa.eu

portal.just.ro

rezultatevot.ro

partidulnouaromanie.ro

proromaniaonline.ro

partidulverde.ro

pntcd.ro

pmponline.ro

surplus.ro

monitorulpartidelor.ro

romania.europalibera.org

ppusl.ro

udmr.ro

per.ro

partidul-pdu.ro

ctr.ro

pd.ro

eppgroup.eu

roaep.ro

nouadreapta.org

inovarepublica.ro

rotld.ro

lapartidlehliu.ro

activenews.ro

spitalgorj.ro

salvaticopii.ro

sanador.ro

hosptm.ro

spitalul-cantacuzino.ro

spitalulmonza.ro

reginamaria.ro

suub.ro

spitalultirda.ro

spitalcampina.ro

spitalulfilantropia.ro

spitalbarlad.ro

spitalul-elias.ro

stanleybet.ro

pariurix.ro

casino.com.ro

bogdancazino.ro

supercasino.ro

casinoonline.com

universuljuridic.ro

cora.ro

top-casino.ro

cazinoro.com

casino.org

unibet.ro

casino-netbet.com

trivago.ro

turistinfo.ro

romania-directbooking.ro

travelminit.ro

hotelsara.ro

anahotels.ro

continentalhotels.ro

ssr.ro

romania-actualitati.ro

romaniaradio.ro

virginradio.ro

europafm.ro

radiozu.ro

digifm.ro

guerrillaradio.ro

radioconstanta.ro

sts.ro

mai.ro mai.gov.ro

mapn.ro

gov.ro

politiaromana.ro

ms.ro

mfinante.ro

anaf.ro

jandarmeriaromana.ro

digi24.ro

www.engie.ro

www.orange.ro

protv.ro pntcd.ro

partidulaur.ro

vaccinare-covid.gov.ro

certificatcovid.gov.ro

romania2019.eu

mitropolia-banatului.ro

patriarhiaromana.ro

bcr.ro bnr.ro

raiffeisenbank.ro

bancatransilvania.ro

electricafurnizare.ro

ghiseul.ro

presidency.ro

psd.ro

pnl.ro

It might be interesting to see where that list came from, I’ve not found it in the Telgram channels so far (but i might have missed a sub group).

Summary

As you can see they are definatley not aligned with the WEST. However the volume of members when companred the UA Cyber Army is significantly smaller. The level of sophistication appears much lower as well as the level of tooling and co-ordination.

If you have any intel you want to share please get in touch. This was made during a cup of tea so take it for what it is, I might look at doing this against a range of groups.