DarkOwl Identifies Links Between Killnet and Anonymous Sudan

Summary

DarkOwl linked Killnet and Anonymous Sudan through shared Telegram posts and a joint claim of an attack on the European Investment Bank. Open-source reporting indicated website availability issues; other claims, including one involving IFC, lacked confirmation.

Key points

DarkOwl found that Killnet and Anonymous Sudan reposted messages about threats to European financial institutions and later signed a claim about an attack on the European Investment Bank together.
Open-source reporting indicated the European Investment Bank’s cyberattack affected the availability of some of its websites; DarkOwl assessed it was likely a DDoS attack.
Killnet claimed the International Finance Corporation had been taken down, but DarkOwl found no evidence or reporting confirming a successful attack.
A Telegram channel purporting to represent REvil welcomed Killnet and posted a poll about potential European financial targets; DarkOwl said it was unclear whether former REvil members were involved.
DarkOwl said the groups’ historical activity suggested future attacks would likely be DDoS, but it found no evidence that they had capabilities beyond those attacks.

Article Details

Event Type: Threats and alleged cyberattacks against European financial institutions, with reported collaboration between Killnet and Anonymous Sudan.
Impact: Open-source reporting indicated that a cyberattack affected the availability of some European Investment Bank websites; the article says it appeared likely to be a DDoS attack. Killnet claimed the International Finance Corporation had been taken down, but the article reports no evidence confirming that claim. The broader threat to the European financial system was not shown to have been carried out.

MITRE ATT&CK

T1498 · Network Denial of ServiceThe article describes Killnet's historical DDoS activity and says the attack affecting some European Investment Bank websites appeared likely to be a DDoS attack.

Threat Actors

Anonymous SudanThe article reports threats and alleged collaboration with Killnet, including a message signed by both groups about an attack on the European banking system.KillnetThe article reports claims of attacks against European financial institutions and describes historical DDoS activity.REvilThe article describes REvil as a ransomware group and reports that a Telegram channel purporting to represent it welcomed Killnet; it says the channel's connection to previous REvil members is unclear.

Countries

RussiaREvil is a group that conducted ransomware attacks and was assessed to be based in Russia.