Other

KILLNET DDoS Campaigns: European Parliament, NATO, US Airports (2022–2023)

πŸ“… 2022-10-10
Primary Source β†—

Incident Details

KILLNET is a Russian hacktivist collective (with suspected ties to Russian intelligence) that conducted a sustained wave of DDoS attacks against Western government and infrastructure targets throughout 2022-2023 in retaliation for NATO and EU support of Ukraine. Key incidents: (1) October 10, 2022: KILLNET disrupted websites of 14 US airports including LAX, ORD, ATL, and LGA β€” taking them offline for hours though flight operations were unaffected. (2) November 23, 2022: KILLNET took down the European Parliament website using a DDoS attack of several hundred gigabits per second, hours after MEPs voted to designate Russia as a state sponsor of terrorism; the outage lasted several hours. (3) January 2023: Coordinated DDoS against NATO websites following NATO’s decision to supply Leopard 2 tanks to Ukraine; nato.int was intermittently unavailable. (4) January-February 2023: KILLNET targeted hospital websites across the US, UK, and Europe. (5) March 2023: KILLNET attacked SWIFT financial messaging infrastructure and attempted to target NATO’s DIANA defense innovation accelerator. No data was stolen in any of these attacks β€” impacts were limited to website availability. KILLNET attacks were largely symbolic and short-duration, demonstrating cyber-nationalism rather than sophisticated offensive capability.

Technical Details

Initial Attack Vector
Volumetric Layer 7 (HTTP flood) DDoS attacks coordinated via KILLNET's Telegram channel, using distributed botnet infrastructure; targets selected in retaliation for Western support of Ukraine

Timeline

  1. 2022-10-10 Breach occurred
  2. 2022-10-10 Publicly disclosed