top of page
Search

KillNet

Introduction & Overview


KillNet Logo

KillNet is a Russian nationalist hacker group known for its use of distributed denial of service (DDoS) attacks to target European infrastructure in support of Russia's 2022 invasion of Ukraine. Originating in 2022 through the advertisement of a DDoS tool-for-hire of the same name, KillNet rapidly gained notoriety through its persistent self-promotion following operations. 


KillNet is a part of a wider network of pro-Russian hacker groups. These groups work to perpetuate the Kremlin's narrative at home through the perpetuation of propaganda as well as to hinder Western activity which threatens Russian interests. It is unclear whether this support is an attempt to gain political favour from followers/potential sponsors or due to direct involvement from government bodies. Regardless, KillNet no longer seems to be active, and even during its peak of activity, it did not cause any major/permanent damage with its activities. 


History & Foundations


The name "KILLNET" can originally be attributed to a DDoS tool offered to threat actors on the dark web (Mascellino, 2022). However, in January 2022, a user called KillMilk advertised the tool in a Telegram channel of the same name (Intel 471, 2024). This marks the beginning of KillNet as both a weapon and a movement. KillMilk is believed to have been an active hacker since the age of 14 and launched their first attack against a foreign nation in 2019 (Flashpoint, 2025). 


In December 2023, KillMilk took a step away from KILLNET, whilst maintaining close ties (Antoniuk, 2025). This departure was due to the identity of KillMilk being exposed as Nikolai Nikolaevich Serafimov, a convicted ex-drug dealer with a taste for luxury automobiles (Gazeta.ru, 2024). It seems that, despite his lead position within the network, KillMilk was more of a marketing specialist than a technical genius, using his skills to recruit and coordinate other hackers to carry out operations. 


On January 23, 2022, the KillNet tool was made available on a subscription basis, advertised on the Killnet Telegram channel. (ReliaQuest, 2025). Following this, the KillNet Telegram channel quickly began discussing taking on the Anonymous hacking group, (Vedere Labs, 2022). This shift in activity from a hacker-for-hire service towards autonomous, aggressive activity seems to increase (at least on the surface) in tandem with the February 2022 Russian invasion of Ukraine. Russia's movements were accompanied by KillNet attacks against Lithuanian police departments, airports, and the government (Goodin, 2022). Within the first 48 hours of the invasion, KillNet had also launched an avalanche of attacks against Ukrainian targets (Intel 471, 2024). 


KillNet Advertisement
An advertisement for the original KILLNET tool.


March 2022 saw KillNet keep its momentum and ambition, declaring open war on Anonymous (ModnyMishka) and carrying out further attacks against European states (Vedere Labs, 2022). On the 3rd of March Killnet took down the Ukrainain news source "Korrespondent" and the Ukrainian branch of Vodafone, with the group claiming that the objective of the attacks was to prevent the distribution of propaganda (Vedere Labs, 2022). The 20th of March also saw the release of the second version of the KillNet tool, but its domain was taken down shortly after (ReliaQuest, 2025). Killnet claims they took it down themselves, but earlier had complained that it was banned in Russia and Europe, and this seems to have prompted a definitive change in branding from a criminal network to a hacktivist group.


On the 15th of April 2022, KillNet carried out what they viewed as an anti-fascist operation, attacking the German Federal MoD as well as several German airports, Gatwick airport in the UK, and 8 Polish airports (Vedere Labs, 2022). The 28th of April saw attacks against the Czech Republic, specifically against the servers of news broadcasters (expatz.cz, 2022), and on the 29th, KillNet attacked a range of Romanian public institutions, knocking their websites offline for a few hours (Marica, 2022). These attacks continued on the 30th, with KillNet threatening to attack up to 300 Romanian websites, including newspapers, major public institutions, hotels, boarding houses, booking sites and political parties, specifically those associated with the Government (Chirileasa, 2022). With this increase in activity came the creation of KillNet Legion, KillNet's digitally militant arm of various smaller hacker groups, which are given individual objectives (Intel 471, 2024). 


The new KillNet Legion was quickly put to work, with the network carrying out DDoS attacks against Moldova in May 2022. Italy's police anti-cybercrime arm managed to foil KillNet's efforts to disrupt the Eurovision voting system on the 16th of May (Kitson, 2022). This attack came in response to predictions that Ukraine would win the contest due to Russia's invasion, as well as Russia's consequent ban from the contest. On the same day, Killnet officially declared war on the US, UK, Germany, Italy, Latvia, Romania, Lithuania, Estonia, Poland, and Ukraine (ReliaQuest, 2025). Italy came under further attack on the 19th of May, with KillNet launching attacks against the Italian superior council of the judiciary, its customs agency and its foreign affairs, education and cultural heritage ministries (David, 2022). However, KillNet's rampant aggression and growing popularity within Russian nationalist/hacking circles would not remain unchecked. On the 21st of May, 5:20 PM, Anonymous declared war on KILLNET (YourAnonOne) Just a minute later, the same account claims that KillNet's website, killnet.ru, had been knocked out (YourAnonOne). KillNet's activity also began to generate real-world repercussions, ending in a 23-year-old KillNet member being arrested for participating in attacks against Romania (HHS.gov, 2023). 


Despite these setbacks, KillNet made good on its promise of war with Lithuania, carrying out various DDoS attacks against the state (Vail, 2022). These attacks were seemingly in response to Lithuania's decision to block the transit of goods sanctioned by the European Union to the Russian exclave of Kaliningrad. The primary target was the  Secure National Data Transfer Network, a core component of Lithuania's national cyber defence network designed to sustain an internet network during war or crisis (Goodin, 2022). According to KillNet, the attacks were a testing ground for some new operational abilities (Flashpoint Intel Team, 2022). 


It is at this point that KillNet's activity begins to wind down. In July 2022, KillNet Legion was disbanded in order for Legion 2.0 to take its place in the future (Intel 471, 2024). The group did manage to carry out an attack against Lockheed Martin in response to the company's provision of HIMARS systems to Ukraine (Yildrim, 2022), as well as some DDoS operations against the websites of the Japanese government (Yildrim, 2022). November saw a change of objective, with KillNet hacking Russia's biggest online drug market, publishing vendor information online (Yildrim, 2022). KillNet also launched the Infinity Forum, an online space designed to create cooperation amongst pro-Kremlin hacker groups; however, by February 2023, KillMilk announced that the forum was being sold (Flashpoint, 2025). 


Late 2022/early 2023 saw the relative death throes of KillNet. Whilst in December 2022 and January 2023, KillNet attempted to shift its targeting towards medical organisations/services (HHS.gov, 2023), these operations failed to garner the previously achieved levels of support the group had received. This prompted a rebrand from 'KillNet' to 'Black Skills' in March 2023, shifting back from hacktivism to hacker-for-hire services as their main form of income (Flashpoint, 2025). By April, the group announced they would be going back on this rebranding, calling it a mistake. Early December 2023 saw the retirement of KillMilk from KillNet (Antoniuk, 2025). A threat actor called Deanon Club, a hacking group that had previously called KillNet 'clowns', took over KillNet, seemingly having created a bond during the groups' collaboration during their creation of the Infinity Forum (Antoniuk, 2025). 


Following this shift in leadership and failed rebranding, KillNet experienced considerable operational fragmentation. Whilst sporadic activity has been reported from the group, such as the claim in May 2025 that KillNet knocked out the Ukrainian drone counter-measure network (MASH), on the whole, KillNet has remained relatively inactive. 


A point of interest is Russia's and, consequently, KillNet's cyber-war relationship with France. Since WW2, France has actually been very cooperative with Russia compared to the rest of Europe. Because of this, many Russian nationalist hacker groups tend to leave France alone (Muncaster, 2022). Therefore, whilst KillNet's attacks on European states have been extensive and widespread, France has, until recently, remained untouched. 


This changed on the 31st of July when KillMilk stated on Telegram that KillNet would be targeting European states in response to supposed cyber attacks from said countries against Russia (KillMilk). KillMilk states that the group will begin by attacking France using both ransomware and DDoS attacks. At the time of writing, no such attacks have been reported. 


Objectives & Ideology


Ideologically, KillNet is explicit in its pro-Russian nationalism. From the onset of the 2022 Russian invasion of Ukraine, KillNet has stated its support for Russia and has consequently had a general objective of attacking any states which attempt to support Ukraine (Lyons, 2022). For example, Killnet has posted videos declaring support for the Russian state, encouraging the Russian people never to doubt their government (Vail, 2022). KillNet has also stated that it only recruits Russian citizens; however, the veracity of this claim is dubious (ReliaQuest, 2025). 


KillNet Propaganda piece
(Russian propaganda posted and pushed by KILLNET reading: “Citizens of Ukraine! Surrender! Save your lives! You are being driven to certain death. Your president has rotten spiritually, morally, and mentally”.) - SOURCE

Whether through attempts to gain political favour or through direct influence from the Kremlin, KillNet's activities tend to follow/reflect the news cycle in Russia (Flashpoint, 2025). The goal of this symbiosis is to reinforce the Kremlin's domestic image in the cyber sphere. Through the execution of highly visible attacks, combined with extensive self-promotion of their activities, KillNet helps the Kremlin proxy-recruit nationalist hacker groups to carry out deniable operations in support of the state's interests. These groups then often target Western governments and agencies as they threaten Russian interests abroad (Vedere Labs, 2022), as evidenced by the 27/6/22 KillNet attacks against Lithuania (Vail, 2022).


The nationalistic pursuits of KillNet seem to be the primary driver for their operational objectives; however, these objectives are not without a financial component. Whilst supposedly driven by their stance on Narcotics, KILLNET's attacks on dark net markets also seem to have had financial motives, with the group snatching crypto wallets in the process (Flashpoint, 2025). Interestingly, KillNet is also associated with Solaris, a Russian darknet market. Around $50,000 was sent to KillNet from a Solaris-associated crypto wallet in October 2022 (TRMLabs, 2025). KillNet then carried out attacks against Solaris' rival, RuTor. RuTor was then forced to pay $15,000 to KillNet to stop the attacks (TRMLabs, 2025). The very foundations of the group are based on this premise of hackers-for-hire, with KillNet briefly returning to these roots during its rebrand as Black Skills (Flashpoint, 2025). The original KILLNET DDoS tool charged $1350 a month for access (Mascellino, 2022). 


Military/Political Abilities


In addition to ideological coordination with the government, KillNet also seems to coordinate its attack with the efforts of government/military bodies such as the FSB, GRU, SVR, and TsNIIKhM (Burgess, 2022). Open collaboration isn't clear, however, KillNet activities tend to occur either in similar time frames, or in complement to cyber attacks more directly linked to the Russian state. However, compared to a lot of groups available to Russia, KILLNET is unsophisticated and unorganised (Avertium, 2022). Whilst Russia is known for its disinformation approach, KillNet lies about deeds which can be easily disproven and seems to have a preoccupation with creating a reputation for itself. 


Telegram message from KillNet stating they will support the Russian army in Ukraine
A telegram message shared by KILLNET declaring that they will take actions to  support Russian military operations in Ukraine. (https://t.me/WeAreKillnet_Channel/43)

Senior members of KillNet possess expertise and experience in DDoS attacks, although most members use publicly available DDoS scripts and IP stressers (Intel 471, 2024). Unsurprisingly, KillNet actors often use the DDoS tool of the same name. For $1350 a month, the tool gives an attacker the capacity for 500GB a second of DDoS spam (Mascellino, 2022). The tool itself is supposedly comprised of a 700,000-node botnet which utilises blockchain technology (Intel 471, 2024). The original Killnet software could perform Layer 3/4 or Layer 7 DDoS and included 15 computers (ReliaQuest, 2025). 


Whilst the group has been relatively successful in its activity using the KILLNET tool, is relatively structured in its operations, and possesses a wide range of personnel, it doesn't seem to develop its own tools outside of rare occurrences (Vedere Labs, 2022). However, in addition to KILLNET, the group also occasionally uses DDoS tools such as CC-Attack, MDDoS, LOIC, KARMA, and Dummy, as well as the Crypto, DDG, and Instant IP Stressers (Intel 471, 2024). 


Approach to Resistance


Distributed Denial of Service, or DDoS, attacks make up the vast majority of KillNet activity. Generally, KillNet targets vulnerable equipment inside a target country, enrols it into their botnets, and then uses that piece of equipment to launch DDoS attacks against a wider network (Tylaz.net, 2022). KillNet seems to have attempted to develop this strategy further through the KillNet Legion VERA 1.0 malware. This malware is supposed to assist in the creation of botnets; however, its full utility is unclear at the time of writing (Intel 471, 2024). 


Whilst KILLNET's DDoS attacks don't cause a massive amount of permanent damage, the outages they cause, combined with the targeting of key infrastructure, generate real-world effects on people's lives (HHS.gov, 2023). As seen with Killnet's threats against Romania, their attacks seem to want to hit a network of key pieces of infrastructure in order to cause panic/confusion and an infrastructural shutdown (Chirileasa, 2022). The group seems to primarily target what they view as the military-industrial complex of the West, trying to disrupt production and target civilian personnel through the extraction of personal data, which could be used to further target them (Eich, 2022). In order to target such a wide network, KillNet has also widened its attack vectors into ransomware, malware, spear phishing, and spoofing when necessary (Chirileasa, 2022). 


Backing/support for these operations is often generated through social media-based recruitment and self-promotion. Killnet uses Telegram and other social media, such as X to create material designed to recruit new members to their initiative. Through these avenues, they attempt to recruit pen testers, graphic designers, hackers, phishers, scammers, and DDoSers to support the Russian government and target those who oppose it (Intel 471, 2024). Financial support is also garnered here, with the group's Telegram channels directing people to crypto wallets for donations, and even to an OpenSea page where the group had created an NFT available for purchase (Intel 471, 2024). 


International Relations & Alliances


KillNet is a part of a wider network of political hacktivists and hackers-for-hire fighting the cyber-war in support of Russia. This network features threat actors such as CoomingProject, Mummy Spider, Salty Spider, Scully Spider, Smokey Spider, Wizard Spider and the Xaknet Team (Lyons, 2022). It is common for KillNet to work in collaboration with these other actors to carry out mutually beneficial operations. Xaknet has been a particularly close collaborator with the group, carrying out DDoS attacks alongside KillNet in March 2022 to target the central infrastructure of Western states (CISA, 2022). 


KillNet itself is more of a loose group of individuals in leadership positions, with these individuals (such as KillMilk) using social media channels to issue general orders/objectives to followers. However, the primary 'arm' of KillNet, which is used to carry out more specific and coordinated attacks, is known as the KillNet legion. Originally known as Cyber Special Forces Russian Federation, Legion is comprised of several groups “Jacky”, “Mirai”, “Impulse”, “DDOSGUNG”, “Sakurajima”, “Kratos”, “Rayd”, “Zarya”, “Vera”, and “Phoenix” (ReliaQuest, 2025). Set up to carry out DDoS attacks for KillNet, each of the six subdivisions under Legion has its own targets and objectives (Intel 471, 2024). For example, on 11 May 2022, Sakurajima and Jacky were told to begin targeting German and Polish infrastructure, with no restriction on targets (ReliaQuest, 2025). 


Works Cited


Follow us on our social platforms

  • alt.text.label.Instagram
  • Our Twitter Account
  • alt.text.label.YouTube

Contact us at team@moderninsurgent.org

Copyright © Modern Insurgent

The content of this page is copyright protected. Its reproduction, in whole or in part, is prohibited without the author's permission.

bottom of page