Killnet’s attacks on Israel: an invitation to open fire

Killnet, a vehemently pro-Russian hacktivist group with suspected ties to the Kremlin, attacked Israel after Hamas militants massacred hundreds of Israeli civilians. Experts believe it is reckless attention-seeking at best.

Hours after gun battles between Hamas and the Israeli Defense Forces (IDF) erupted in Southern Israel, hacktivists started passionately banging their keyboards. As with Russia’s invasion of Ukraine, cyber activists quickly chose sides.

Killnet, a pro-Russian attacker group spearheaded by its leader Killmilk, was among the first to take a stance, blaming the Hamas’ attack on Israel on Israelis themselves.

“Government of Israel, you are to blame for this bloodshed,” a message on the group’s Telegram channel read. It was immediately followed by a distributed denial-of-service (DDoS) attack, Killnet’s primary tool, on Israel’s government websites.

According to Nataliia Zdrok, a senior threat intelligence analyst at Binary Defense, KillNet unleashed its army of subgroups such as Legion – Cyber Special Forces RF (Russian Federation) and allies like Anonymous Sudan, a group believed to be also linked with Russia.

“KillNet accused the Israeli government not only of the ongoing conflict but also alleged its cooperation with NATO members, and the group also accused Israel of supporting Ukraine, characterizing it as a betrayal of Russia,” Zdrok told Cybernews.

Convoluted motivation

Killnet’s primarily known for its ultra-patriotic pro-Russian stance, targeting countries and organizations that support Ukraine. Interestingly, unlike many of Killnet’s targets in the West, Israel is far from being a staunch ally of Kyiv.

Israel has not imposed economic sanctions on Russia and has maintained a political dialogue with Moscow throughout the conflict. After the Russian military killed hundreds of civilians in Bucha near Kyiv, Israel condemned war crimes, but not Russia.

Reportedly, in May of 2023, Israel granted licenses for two local firms to sell electronic warfare systems with a range of 40 kilometers to be used against Iranian-made Shahed drones.

Most recently, in early September, Ukraine’s president Volodymyr Zelensky still had to convince Israel’s Prime Minister Benjamin Netanyahu to provide Ukraine with lethal arms. Most notably, Israeli support for Ukraine primarily manifests in diplomatic assistance and humanitarian aid.

Why did Killnet attack Israel?

The motiviations of this Moscow-affiliated group to openly target a country trying to maintain a neutral stance are not entirely clear, Karim Hijazi, CEO of Vigilocity and former contractor for the US intelligence community, told Cybernews.

“However, if this (Israel’s alignment with NATO) was really their motivation, why did they wait until now to target Israel so aggressively?” Hijazi pondered.

After all, Killnet and its affiliates targeted Israel’s government websites, the nation’s alert systems, the Israeli Security Agency, the Iron Dome air defense system, and multiple banks during the most trying moment for Israel in decades.

Recklessly, Killnet likely chose this dangerous and chaotic moment to promote itself, trying to position itself as a global leader that can rally other groups in a major crisis.

“However, if this (Israel’s alignment with NATO) was really their motivation, why did they wait until now to target Israel so aggressively?”

Hijazi pondered.

“While KillNet’s successful takedown of an Israeli government website did not have a material impact, it did send a message to other hacktivist groups to join the fight,” Hijazi said.

Killnet’s invitation to open fire has worked, at least to some degree, as various groups that supported Moscow in its war against Ukraine joined the cyberwar on the side of Palestine. Hijazi believes that Killnet’s involvement likely influenced Libyan Ghosts and Anonymous Sudan to throw themselves into the conflict.

What political repercussions of a GRU (Russia’s Main Intelligence Directorate of the General Staff) -linked group stirring conflict against Israel will have, remains to be seen. For hacktivists, however, a war is an opportunity.

“Hacktivists closely monitor developments on the frontlines and in geopolitics, reacting rapidly to these events. They are constantly seeking attention, and a new conflict allows them to garner that attention and satisfy their subscribers, which is about 102,000 now,” Zdrok explained.

Is Killnet dangerous to Israel?

Whether the DDoS attacks that hacktivists often employ have any real-world effect is a polarizing question. Some security researchers would rather not see groups like Killnet dubbed “hackers” at all. However, context matters.

While a defaced website might not have much impact on a nation in peacetime, wartime disruption can have severe consequences. For example, Anonymous Sudan targeted Israeli media websites, a crucial source of information during a time of distress. Similarly, inactive government services can cause real-world harm.

“As seen during the Russia/Ukraine war, hacktivists can sometimes have an inadvertent impact on critical systems and should be taken seriously. KillNet is also speculated to have ties to the Russian government, specifically the GRU, and they can be a significant cyber adversary,” Hijazi said.

What’s more, groups often associated with DDoS attacks can turn to new tools. According to researchers, AnonGhost, a pro-Palestine hacktivist group known for DDoS attacks, exploited a flaw in Israel’s rocket alert app Red Alert and sent out fake nuclear bomb threats.

The reality of DDoS attacks is that if they were completely useless, attackers would use different methods and businesses wouldn’t need to provide services to guard against them.

Even though Killnet or other DDoS groups haven’t damaged Israel so far, the resources spent dealing with the groups’ attacks could have been diverted elsewhere. And for destruction seeking groups, that’s a win in itself.

“Russian hacktivism has witnessed a significant upsurge since the beginning of the Russia-Ukraine war. Many pro-Russian groups exhibit strong anti-Ukrainian and anti-Western ideas fueled by the ongoing war,” Zdrok concluded.