3C-INT logo [Cyber]Crime Characterization for Intelligence FREE PREVIEW
You are exploring the Free preview. To unlock full read-only access to all public profiles and in-app notifications, create a free research account. For analyst / premium plans capabilities (editing, advanced tabs, exports), please contact us

Threat Actor Characterization

Back
You’re viewing the read-only version. Sign in for analyst tools (editors, promote draft, file/relations management, etc.)
KillNet

KillNet

ID: 9b3cd18f79d9e1d51728a310139561c332348
Hacktivist Group Collective DDoS Crew Hacktivism
Threat types: Intrusion, Hacking, DDoS, Propaganda, Operational Disruption, Pro-palestine
Russia
Updated: 2026-04-07
Created: 2025-10-17
Progress: 80% Completeness: 76% Freshness: 90%
Operation zone: —
Aliases Limited alias preview
KillMilk KillNet Syndicate Ki************** —
Showing 2 of 3 aliases in free preview.
Actor Network Graph
Open Network Graph
Read-only preview for anonymous visitors. Sign in with a free Research account for full workspace.
MITRE ATT&CK®
confidence: medium-high
Actor Techniques page ATT&CK® Diagram

KillNet is a pro-Russian hacktivist ecosystem primarily associated with coordinated DDoS waves designed to disrupt availability and amplify political messaging. Microsoft’s 2023 analysis highlights KillNet and affiliate activity targeting healthcare with multi-vector DDoS patterns including application-layer resource depletion behaviors. Reporting in 2025 indicates KillNet resurfaced after a period of reduced visibility, with analysts discussing rebranding and potential drift toward for-hire/reputation dynamics. Defenders should prioritize DDoS resilience engineering, rate limiting, multi-region failover, and incident communication readiness over malware-centric controls.


Technique Technique name Tactics Evidence
T1498.001 Direct Network Flood TA0040
  • 2023-03-17 — Layer 7 DDoS patterns targeting web applications described in Microsoft healthcare analysis. · ref
T1498.002 Reflection Amplification TA0040
  • 2023-03-17 — Multi-vector DDoS including TCP/UDP alongside application-layer pressure described by Microsoft. · ref
T1583.006 Web Services TA0042
  • 2025-05-22 — Public reporting indicates reliance on shifting infrastructure and a community-driven model; map cautiously to acquired infrastructure services (INFERENCE). · ref
T1598 Phishing for Information TA0043
  • 2022-05-26 — Hacktivist campaigns rely on public messaging and claims to amplify impact; treat as influence/awareness operations context (INFERENCE). · ref
Strategic Intelligence
Limited preview
Last updated: 2026-02-26T16:48:56+00:00
KillNet — Pro-Russia Hacktivist Collective (War-Support Operations)

Classification: Unclassified / Open Source Intelligence (OSINT) — TLP:WHITE

Full strategic intelligence is available in Analyst and Premium plans.
Executive Analyst Brief for CISO
Saved Limited preview

Executive Analyst Brief for Decision Makers — KillNet


Upgrade to access the full executive brief.
Tip: Hover the section title to learn what’s included in Analyst / Premium plans.
Executive brief now
Saved successfully.
Hunting Playbook
Saved Limited preview

Hunting Playbook — KillNet (DDoS Disruption Playbook)


Upgrade to access the full hunting playbook.
Tip: Hover the section title to learn what’s included in Analyst / Premium plans.
Hunting Playbook now
Saved successfully.
IOC Appendix
Saved Limited preview
Last updated: 2026-02-26T17:06:37+00:00

IOC Appendix — KillNet (Disruption Ecosystem)


More IOC context for Research. Full appendix for Analyst and Premium plans.
IOC Appendix now
Saved successfully.
OSINT Library
Saved Limited preview
Last saved: 2026-02-26T16:50:08+00:00

OSINT Library — KillNet


2025-10-01 — ENISA — “ENISA Threat Landscape 2025 (PDF)”

Full OSINT references available for Research / Analyst.
OSINT Library now
Saved successfully.
Social Medial & Communication
SOCMINT integrated: 0/28
Address Verification SOCMINT
t.me/kil************ Restricted Not integrated
t.me/don*********** Restricted Not integrated
t.me/kil************ Restricted Not integrated
t.me/kil************* Restricted Not integrated
t.me/kil********* Restricted Not integrated
t.me/kil***************** Restricted Not integrated
t.me/kil*********** Restricted Not integrated
t.me/leg******** Restricted Not integrated
t.me/Kil************** Restricted Not integrated
t.me/com******** Restricted Not integrated
t.me/War*********** Restricted Not integrated
t.me/WeA***************** Restricted Not integrated
t.me/WeA***************** Restricted Not integrated
t.me/Kil************* Restricted Not integrated
t.me/Mat******* Restricted Not integrated
t.me/Kil************* Restricted Not integrated
t.me/WeA****************** Restricted Not integrated
t.me/Kil**************** Restricted Not integrated
t.me/fir********* Restricted Not integrated
t.me/Kil****** Restricted Not integrated
t.me/SSS********** Restricted Not integrated
t.me/Dat************* Restricted Not integrated
t.me/Kil********************* Restricted Not integrated
t.me/Tuk********* Restricted Not integrated
t.me/Let************* Restricted Not integrated
t.me/osi******** Restricted Not integrated
t.me/+O7************** Restricted Not integrated
t.me/Kil**************** Restricted Not integrated
Notes: preview mode hides sensitive social/contact details.
Reference Images/Associated Evidence Limited
Showing 1–8 of 8 images
Propaganda Free Preview
Propaganda
Avatar Free Preview
Avatar
Propaganda Free Preview
Propaganda
Propaganda Free Preview
Propaganda
Propaganda Free Preview
Propaganda
Propaganda Free Preview
Propaganda
Propaganda Free Preview
Propaganda
Propaganda Free Preview
Propaganda
Showing 4 of 8 images in preview mode. Additional evidence is restricted for Analyst and Premium plans.