Killnet is a pro-Russian hacktivist collective whose distributed denial of service (DDoS) campaigns against governments, hospitals and financial institutions in countries supporting Ukraine were loud, frequent and often exaggerated, but occasionally effective. It emerged in early 2022 and grew into an umbrella of affiliated Telegram channels, including Anonymous Sudan, whose 2023 attacks marked a real jump in capability. This profile explains what Killnet is, how its campaigns worked, why it matters even when its claims outrun its results, and how to prepare. It draws on the US Department of Health and Human Services (HHS) HC3 analyst note, Mandiant research and Microsoft's Azure telemetry, and it is written for network, SOC and incident response teams. For the wider phenomenon, see the Hacktivism Guide.
Key takeaways
- DDoS is the core capability. HHS HC3 describes publicly available DDoS scripts and IP stressers as the basis of most operations, run by leaders with a DDoS-for-hire background.
- Targeting follows Russian policy. Mandiant assesses with high confidence that Killnet's claimed operations mirror Russian strategic objectives, while finding no direct evidence of state direction.
- Claims exceed impact. HHS and Mandiant both warn that Killnet exaggerates; most attacks cause outages of hours to days rather than lasting damage.
- Affiliates raised the ceiling. Anonymous Sudan carried out 63 percent of claimed Killnet DDoS attacks in 2023, according to Mandiant, and disrupted Microsoft services and the European Investment Bank.
- Preparation beats reaction. Upstream DDoS protection, a web application firewall for Layer 7 floods and a rehearsed response plan are the controls that matter.
What it is
Killnet is a self-described hacktivist collective. HHS HC3 dates its activity to at least January 2022 and says its leadership converted a DDoS-for-hire service into a hacktivist operation that year, recruiting and publicising through public channels. After Russia's invasion of Ukraine it focused on countries that support Ukraine, particularly NATO members. Mandiant tracks Killnet from January 2022 and listed 13 associated affiliate groups, each with its own Telegram presence, by mid 2023, with groups regularly created, absorbed or split off. Mandiant assesses with moderate confidence that this churn is partly designed to attract Western media attention.
Killnet does not have a MITRE ATT&CK group entry. Attribution here comes from government and primary vendor research only, and no individual members are named.
| Attribute | Detail | Source |
|---|---|---|
| Type | Pro-Russian hacktivist collective | HHS HC3, January 2023 |
| Active since | At least January 2022 | HHS HC3; Mandiant |
| Primary method | DDoS using public scripts, IP stressers and botnets | HHS HC3 |
| Secondary methods | Data theft, hack-and-leak and claimed website compromises | Mandiant, July 2023 |
| Main targets | Government, healthcare, finance, transport, defence, telecoms in the US and Europe | HHS HC3; Mandiant |
| Scale | More than 500 distinct alleged victims from 1 January to 20 June 2023 | Mandiant |
| State link | Aligned with Russian objectives; no direct evidence of direction; FSB or SVR ties unconfirmed | Mandiant; HHS HC3 |
| Notable affiliates | Anonymous Sudan (from January 2023); Zarya (split October 2022) | Mandiant |
How it works
Killnet campaigns pair technical disruption with publicity. A target list is announced on Telegram, volunteers and botnets generate traffic, and results, real or inflated, are claimed loudly. The technical side maps to ATT&CK impact techniques as follows. This mapping is our analysis of behaviour reported by HHS and Microsoft.
| Attack type | What was observed | ATT&CK v20 | Primary defence |
|---|---|---|---|
| Volumetric floods | UDP floods were 53 percent of healthcare attacks Microsoft saw; many used spoofed sources | T1498.001 Direct Network Flood | Upstream scrubbing or cloud DDoS protection; ISP coordination |
| Reflection and amplification | Reflected amplification made up 52 percent of attacks, including DNS amplification | T1498.002 Reflection Amplification | Upstream filtering; do not run open resolvers yourself |
| Protocol attacks | TCP SYN and ACK floods with packet anomalies, peaking at 1.3 million packets per second in one campaign | T1499.002 Service Exhaustion Flood | SYN protection at the edge; load balancer connection limits |
| Application layer | HTTP floods holding connections open to exhaust memory, or opening many new connections to exhaust CPU | T1499.003 Application Exhaustion Flood | Web application firewall rate limiting and bot challenges; CDN caching |
| Botnets and stressers | One campaign used about 22,000 sources at 250,000 packets per second with legitimate-looking traffic | T1583.005 Botnet | Behavioural baselining rather than static IP blocking |
Campaign timeline
| Date | Event | Source |
|---|---|---|
| January 2022 | Earliest activity tracked by Mandiant and HHS HC3 | Mandiant; HHS HC3 |
| May 2022 | Threats against UK health services after an arrest linked to attacks on Romanian government websites | HHS HC3 |
| October 2022 | Affiliate Zarya announces a rebrand and ends cooperation with Killnet | Mandiant |
| December 2022 | Claimed compromise of a US healthcare organisation serving military members | HHS HC3 |
| January 2023 | Hospital target lists shared publicly; Anonymous Sudan first observed | HHS HC3; Mandiant |
| Early 2023 | Declared campaign focused on NATO | Mandiant |
| June 2023 | Microsoft confirms Azure and Outlook outages caused by Anonymous Sudan DDoS; European Investment Bank sites down after a claimed attack | Mandiant |
Mandiant's reporting covers activity to mid 2023. Hacktivist brands rise, merge and fade quickly, so check current threat intelligence before assuming the collective's present status.
Adapting under mitigation
Microsoft observed Killnet changing attack vectors and adding sources when mitigation took effect, and campaigns that ran for several days while mixing Layer 4 and Layer 7 traffic. Static block lists and single-vector defences fail against this. Protection needs to learn each application's normal traffic and respond to anomalies, which is how cloud DDoS services are designed to work.
Beyond DDoS
Mandiant records data theft and hack-and-leak claims alongside DDoS, including a claimed 2023 compromise of a NATO training site where some leaked documents appeared legitimate. HHS reported a December 2022 claim that Killnet had compromised a US healthcare organisation serving military members. Many such claims cannot be verified, but they mean a Killnet campaign should prompt a check for data exposure as well as availability.
Why it matters
- Healthcare pressure: HHS warned that Killnet was actively targeting the health sector, and in January 2023 lists of hospitals in several countries were circulated as targets. Microsoft saw daily DDoS attacks on healthcare customers rise from 10 to 20 in November 2022 to 40 to 60 in February 2023. See the Threat Actors Targeting Healthcare Guide.
- Capability can jump suddenly: Mandiant called Anonymous Sudan's June 2023 disruption of Microsoft services a significant increase in observed capability, and the European Investment Bank confirmed its sites were down for at least a day after a claimed attack.
- Information operations: Mandiant notes Killnet often attacked countries shortly after Russian officials criticised them. The aim is attention and intimidation as much as downtime, so communications teams belong in the response.
- Cheap to launch, costly to absorb: Microsoft notes DDoS is inexpensive, attention-grabbing and anonymous. Defence cost falls on the target.
Detection and measurement
Watch for early warning and attack onset: monitor Telegram and threat intelligence feeds for your organisation or sector appearing on target lists, alert on sudden rises in requests per second, new connection rates, error rates (HTTP 5xx and 429) and origin CPU or memory, and track traffic from unusual source countries or autonomous systems against baseline.
Useful measures: percentage of internet-facing services behind upstream DDoS protection (target 100 percent of critical services); time from attack onset to mitigation; availability during attack windows; origin IP exposure (critical origins reachable only through the protection layer); and date of the last DDoS response exercise.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.IR-04, DE.CM-01, ID.RA-02, RS.CO-02 | Capacity for availability, network monitoring, threat intelligence intake, stakeholder notification |
| NIST SP 800-53 Rev. 5 | SC-5, SC-7, CP-2, IR-4 | Denial of service protection, boundary protection, contingency planning, incident handling |
| MITRE ATT&CK v20 | T1498.001, T1498.002, T1499.002, T1499.003, T1583.005 | Network and endpoint denial of service, botnet acquisition |
Common misconceptions
- "Hacktivist DDoS is a nuisance, not a risk." Most attacks are short, but hospitals, banks and public services have real costs when sites or portals go down, and affiliates have shown higher capability.
- "If they claimed it, it happened." HHS and Mandiant both warn that claims outpace documented operations. Verify against your own telemetry before briefing executives or the press.
- "Blocking Russian IP addresses stops it." Botnets, spoofed sources and stressers use infrastructure worldwide; Microsoft's top source countries in one campaign included the US.
- "Our firewall handles DDoS." A volumetric flood fills the link before traffic reaches an on-premises firewall. Protection has to be upstream.
- "Killnet is state hacking." Alignment is clear, direction is not proven. Treat it as a politically motivated group whose targeting can change with Russian foreign policy.
Related concepts
Killnet is one of several pro-Russian hacktivist groups. The NoName057 DDoS Hacktivist Group Profile Guide covers a similar operation, and the Pro-Russia Hacktivists Targeting OT Guide covers groups that go after industrial systems. For technical defences, use the DDoS Protection Guide and the RTBH and BGP Flowspec DDoS Mitigation Guide.
Preparing for a Killnet-style campaign
- Understand your services: List internet-facing services, their dependencies (DNS, authentication, payment providers) and the business impact of each going offline, following the NCSC denial of service guidance.
- Put protection upstream: Place critical services behind a CDN or cloud DDoS service, restrict origins to accept traffic only from that service, and agree escalation contacts with your ISP.
- Tune Layer 7 controls: Configure WAF rate limits and bot challenges in log-only mode first, measure false positives against real traffic, then enforce. Keep a documented rollback, such as raising a threshold or disabling one rule.
- Plan the response: Write a DDoS runbook with roles, provider contacts, decision points (when to enable stricter challenges or geo rules) and a communications line. The DDoS Response Playbook gives a structure.
- Test: Run an authorised simulation with your provider and a tabletop that includes a false claim of data theft.
Small organisations can usually rely on a CDN with built-in DDoS protection and a short runbook. Large or high-profile organisations, especially in health, finance and government, should add always-on scrubbing, multi-CDN for critical services and sector threat intelligence sharing.
Practitioner checklist
- Inventory internet-facing services and rank them by business impact of an outage.
- Place every critical service behind upstream DDoS protection and lock origins to that path.
- Enable WAF rate limiting and bot challenges for Layer 7 floods, tested in log-only mode first.
- Monitor threat intelligence and Telegram reporting for your sector appearing on target lists.
- Alert on request rate, connection rate, 5xx errors and origin resource spikes against baseline.
- Keep a DDoS runbook with provider and ISP contacts, decision points and a communications owner.
- Verify any claim of data theft against logs before responding publicly.
- Run a DDoS exercise at least yearly with your protection provider.
Standards and references
- HHS HC3: KillNet Analyst Note
- CISA, FBI and MS-ISAC: Understanding and Responding to Distributed Denial-of-Service Attacks
- NCSC: Denial of Service (DoS) guidance
- Mandiant: KillNet Showcases New Capabilities While Repeating Older Tactics
- Microsoft Security: DDoS attacks against healthcare and KillNet campaigns
- MITRE ATT&CK: Network Denial of Service
- MITRE ATT&CK: Endpoint Denial of Service
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: Hacktivism Guide · NoName057 DDoS Hacktivist Group Profile Guide · DDoS Protection Guide · DDoS Readiness Checklist