Loading signal...
Signal
Submitted
Apr 28, 2026, 19:29 UTC
The pro-Kremlin hacker group Killnet, linked to GRU handlers, has launched various low-impact DDoS attacks since early 2022, with reported funding from darknet drug marketplace Solaris but no major disruptions.
Killnet first appeared in early 2022 offering commercial DDoS attacks via a large claimed botnet, later shifting focus to politically motivated cyber operations supporting Russia’s war in Ukraine. Despite headline-grabbing claims against European banks, U.S. government sites, and corporations like Lockheed Martin, investigations revealed weak or unsubstantiated impacts. Killnet’s leadership, notably the alias KillMilk, was active on darknet forums and involved in cybercriminal ecosystems intermixed with political narratives. Independent analyses identify Killnet as a primarily self-promotional entity with limited proprietary cyber capabilities, likely leveraging rented botnets and third-party IP stressers. The group’s connections to the GRU-affiliated XakNet group reinforce its state-backed nature. Financial support from Solaris, a major darknet drug market, links Killnet to illicit funding streams, including at least one documented $50,000 transfer. Though Killnet threatened European banking systems with large-scale attacks, none materialized. Their activity pattern suggests a hybrid warfare informational and disruption role, blending cybercrime, propaganda, and limited technical attacks to challenge adversaries while advancing Russian strategic narratives.
Confidence: High
The article explicitly details aggressive cyber activities by the pro-Kremlin hacker collective Killnet, linked to GRU, including targeted DDoS attacks and espionage attempts aligned with Russian military objectives in Ukraine, supported financially and ideologically by hostile actors.
Source URL
https://theins.press/en/society/264864
Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.
{
"id": "fc66736e-1066-4bc5-9fa8-e44aaab6f9e0",
"url": "https://theins.press/en/society/264864",
"source": "extension",
"status": "approved",
"category": "Cyber & Information Warfare",
"subcategory": "Cyber Attacks",
"incident_type": "Hacking, malware, ransomware",
"country": "Russian Federation",
"source_reliability": "B",
"info_credibility": "3",
"tags": [
"Killnet",
"GRU",
"Russian cyber army",
"DDoS attacks",
"botnet",
"cybercrime",
"pro-Kremlin hacktivism",
"darknet",
"Solaris drug marketplace",
"russia–ukraine war",
"disinformation",
"hybrid warfare",
"darknet forums",
"XakNet",
"cyber threat",
"Russian influence operations"
],
"nodes": [
"Node 2: 5th Column"
],
"countries": [
"Russian Federation"
],
"where_text": "Cyberspace",
"headline": "Analysis of Killnet: Kremlin-Linked Hacktivist Group with Limited Cyberattack Impact",
"description": "Killnet, a hacker collective self-styled as the 'Russian cyber army,' emerged in early 2022 claiming vast botnet capabilities (allegedly controlling around 700,000 devices) and offering paid DDoS attack services. The group has launched multiple DDoS attacks mainly against Ukrainian, European, and U.S. websites, but these were mostly low-impact and short-lived, targeting minor or misidentified sites rather than critical infrastructure. Despite Kremlin media promotion and claims of data breaches against high-profile targets like Lockheed Martin and U.S. government services, evidence suggests most were either rehashed data or failed attempts. Killnet’s founder, known as KillMilk, initially started on darknet forums and transitioned from commercial hacking services to politically motivated attacks after Russia’s invasion of Ukraine. Killnet is suspected to be connected to the Russian military intelligence agency GRU through another group, XakNet, known for coordinated attacks on Ukrainian government sites coinciding with Russia's military operations. The group’s funding sources include donations and apparent sponsorship by the darknet drug marketplace Solaris, which transferred at least $50,000 to Killnet wallets. Despite loud threats about disrupting the European banking sector, no major successful attacks have been confirmed. Cybersecurity firms describe Killnet's role as largely self-promotional, with limited real operational capability. Killnet’s activities also include extortion attempts against darknet forums such as Rutor, as well as collaborations and rivalries with other cybercriminal groups. Independent cybersecurity analysts and international cybersecurity agencies from several countries have listed Killnet among threat actors linked to pro-Russian hacktivist efforts in the conflict.",
"summary_short": "The pro-Kremlin hacker group Killnet, linked to GRU handlers, has launched various low-impact DDoS attacks since early 2022, with reported funding from darknet drug marketplace Solaris but no major disruptions.",
"summary_extended": "Killnet first appeared in early 2022 offering commercial DDoS attacks via a large claimed botnet, later shifting focus to politically motivated cyber operations supporting Russia’s war in Ukraine. Despite headline-grabbing claims against European banks, U.S. government sites, and corporations like Lockheed Martin, investigations revealed weak or unsubstantiated impacts. Killnet’s leadership, notably the alias KillMilk, was active on darknet forums and involved in cybercriminal ecosystems intermixed with political narratives. Independent analyses identify Killnet as a primarily self-promotional entity with limited proprietary cyber capabilities, likely leveraging rented botnets and third-party IP stressers. The group’s connections to the GRU-affiliated XakNet group reinforce its state-backed nature. Financial support from Solaris, a major darknet drug market, links Killnet to illicit funding streams, including at least one documented $50,000 transfer. Though Killnet threatened European banking systems with large-scale attacks, none materialized. Their activity pattern suggests a hybrid warfare informational and disruption role, blending cybercrime, propaganda, and limited technical attacks to challenge adversaries while advancing Russian strategic narratives.",
"actor_primary": "Killnet",
"target_primary": null,
"location_text": "Russian Federation",
"location_region": null,
"location_coordinates_lat": 61.52401,
"location_coordinates_lon": 105.318756,
"location_precision": "Regional",
"is_aggressor_signal": true,
"signal_type": "HYBRID_SIGNAL",
"is_hybrid_war_signal": true,
"classification_complete": true,
"hybrid_signal_complete": true,
"classification_confidence": "High",
"classification_rationale": "The article explicitly details aggressive cyber activities by the pro-Kremlin hacker collective Killnet, linked to GRU, including targeted DDoS attacks and espionage attempts aligned with Russian military objectives in Ukraine, supported financially and ideologically by hostile actors.",
"event_time_utc": "2023-06-01T00:00:00.000Z",
"end_time_utc": null,
"event_time_confidence": "pm24h",
"created_at": "2026-04-28T19:29:00.296Z",
"updated_at": "2026-11-04T08:35:32.139Z",
"reliability_band": "strong",
"location_precision_band": "regional",
"time_precision_band": "within_24h",
"severity_band": "minor",
"attribution_confidence_band": "high",
"attribution_basis": "single_source"
}Source reliability
B
Info credibility
3
Event time
Jun 1, 2023, 00:00 UTC
Event time confidence
pm24h
Location
Russian Federation
Primary actor
Killnet
Country
Russian Federation
Countries
Russian Federation
Tags
Killnet, GRU, Russian cyber army, DDoS attacks, botnet, cybercrime, pro-Kremlin hacktivism, darknet, Solaris drug marketplace, russia–ukraine war, disinformation, hybrid warfare, darknet forums, XakNet, cyber threat, Russian influence operations
Nodes
Node 2: 5th Column
Signal
Submitted
Apr 28, 2026, 19:29 UTC
The pro-Kremlin hacker group Killnet, linked to GRU handlers, has launched various low-impact DDoS attacks since early 2022, with reported funding from darknet drug marketplace Solaris but no major disruptions.
Killnet first appeared in early 2022 offering commercial DDoS attacks via a large claimed botnet, later shifting focus to politically motivated cyber operations supporting Russia’s war in Ukraine. Despite headline-grabbing claims against European banks, U.S. government sites, and corporations like Lockheed Martin, investigations revealed weak or unsubstantiated impacts. Killnet’s leadership, notably the alias KillMilk, was active on darknet forums and involved in cybercriminal ecosystems intermixed with political narratives. Independent analyses identify Killnet as a primarily self-promotional entity with limited proprietary cyber capabilities, likely leveraging rented botnets and third-party IP stressers. The group’s connections to the GRU-affiliated XakNet group reinforce its state-backed nature. Financial support from Solaris, a major darknet drug market, links Killnet to illicit funding streams, including at least one documented $50,000 transfer. Though Killnet threatened European banking systems with large-scale attacks, none materialized. Their activity pattern suggests a hybrid warfare informational and disruption role, blending cybercrime, propaganda, and limited technical attacks to challenge adversaries while advancing Russian strategic narratives.
Confidence: High
The article explicitly details aggressive cyber activities by the pro-Kremlin hacker collective Killnet, linked to GRU, including targeted DDoS attacks and espionage attempts aligned with Russian military objectives in Ukraine, supported financially and ideologically by hostile actors.
Source URL
https://theins.press/en/society/264864
Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.
{
"id": "fc66736e-1066-4bc5-9fa8-e44aaab6f9e0",
"url": "https://theins.press/en/society/264864",
"source": "extension",
"status": "approved",
"category": "Cyber & Information Warfare",
"subcategory": "Cyber Attacks",
"incident_type": "Hacking, malware, ransomware",
"country": "Russian Federation",
"source_reliability": "B",
"info_credibility": "3",
"tags": [
"Killnet",
"GRU",
"Russian cyber army",
"DDoS attacks",
"botnet",
"cybercrime",
"pro-Kremlin hacktivism",
"darknet",
"Solaris drug marketplace",
"russia–ukraine war",
"disinformation",
"hybrid warfare",
"darknet forums",
"XakNet",
"cyber threat",
"Russian influence operations"
],
"nodes": [
"Node 2: 5th Column"
],
"countries": [
"Russian Federation"
],
"where_text": "Cyberspace",
"headline": "Analysis of Killnet: Kremlin-Linked Hacktivist Group with Limited Cyberattack Impact",
"description": "Killnet, a hacker collective self-styled as the 'Russian cyber army,' emerged in early 2022 claiming vast botnet capabilities (allegedly controlling around 700,000 devices) and offering paid DDoS attack services. The group has launched multiple DDoS attacks mainly against Ukrainian, European, and U.S. websites, but these were mostly low-impact and short-lived, targeting minor or misidentified sites rather than critical infrastructure. Despite Kremlin media promotion and claims of data breaches against high-profile targets like Lockheed Martin and U.S. government services, evidence suggests most were either rehashed data or failed attempts. Killnet’s founder, known as KillMilk, initially started on darknet forums and transitioned from commercial hacking services to politically motivated attacks after Russia’s invasion of Ukraine. Killnet is suspected to be connected to the Russian military intelligence agency GRU through another group, XakNet, known for coordinated attacks on Ukrainian government sites coinciding with Russia's military operations. The group’s funding sources include donations and apparent sponsorship by the darknet drug marketplace Solaris, which transferred at least $50,000 to Killnet wallets. Despite loud threats about disrupting the European banking sector, no major successful attacks have been confirmed. Cybersecurity firms describe Killnet's role as largely self-promotional, with limited real operational capability. Killnet’s activities also include extortion attempts against darknet forums such as Rutor, as well as collaborations and rivalries with other cybercriminal groups. Independent cybersecurity analysts and international cybersecurity agencies from several countries have listed Killnet among threat actors linked to pro-Russian hacktivist efforts in the conflict.",
"summary_short": "The pro-Kremlin hacker group Killnet, linked to GRU handlers, has launched various low-impact DDoS attacks since early 2022, with reported funding from darknet drug marketplace Solaris but no major disruptions.",
"summary_extended": "Killnet first appeared in early 2022 offering commercial DDoS attacks via a large claimed botnet, later shifting focus to politically motivated cyber operations supporting Russia’s war in Ukraine. Despite headline-grabbing claims against European banks, U.S. government sites, and corporations like Lockheed Martin, investigations revealed weak or unsubstantiated impacts. Killnet’s leadership, notably the alias KillMilk, was active on darknet forums and involved in cybercriminal ecosystems intermixed with political narratives. Independent analyses identify Killnet as a primarily self-promotional entity with limited proprietary cyber capabilities, likely leveraging rented botnets and third-party IP stressers. The group’s connections to the GRU-affiliated XakNet group reinforce its state-backed nature. Financial support from Solaris, a major darknet drug market, links Killnet to illicit funding streams, including at least one documented $50,000 transfer. Though Killnet threatened European banking systems with large-scale attacks, none materialized. Their activity pattern suggests a hybrid warfare informational and disruption role, blending cybercrime, propaganda, and limited technical attacks to challenge adversaries while advancing Russian strategic narratives.",
"actor_primary": "Killnet",
"target_primary": null,
"location_text": "Russian Federation",
"location_region": null,
"location_coordinates_lat": 61.52401,
"location_coordinates_lon": 105.318756,
"location_precision": "Regional",
"is_aggressor_signal": true,
"signal_type": "HYBRID_SIGNAL",
"is_hybrid_war_signal": true,
"classification_complete": true,
"hybrid_signal_complete": true,
"classification_confidence": "High",
"classification_rationale": "The article explicitly details aggressive cyber activities by the pro-Kremlin hacker collective Killnet, linked to GRU, including targeted DDoS attacks and espionage attempts aligned with Russian military objectives in Ukraine, supported financially and ideologically by hostile actors.",
"event_time_utc": "2023-06-01T00:00:00.000Z",
"end_time_utc": null,
"event_time_confidence": "pm24h",
"created_at": "2026-04-28T19:29:00.296Z",
"updated_at": "2026-11-04T08:35:32.139Z",
"reliability_band": "strong",
"location_precision_band": "regional",
"time_precision_band": "within_24h",
"severity_band": "minor",
"attribution_confidence_band": "high",
"attribution_basis": "single_source"
}Source reliability
B
Info credibility
3
Event time
Jun 1, 2023, 00:00 UTC
Event time confidence
pm24h
Location
Russian Federation
Primary actor
Killnet
Country
Russian Federation
Countries
Russian Federation
Tags
Killnet, GRU, Russian cyber army, DDoS attacks, botnet, cybercrime, pro-Kremlin hacktivism, darknet, Solaris drug marketplace, russia–ukraine war, disinformation, hybrid warfare, darknet forums, XakNet, cyber threat, Russian influence operations
Nodes
Node 2: 5th Column