4 ms·
Serious question: How do they know that? I assume killnet does not have a static IP address and doesn't leave it's return address
by mkoryak 4y ago
Serious question:
How do they know that?
I assume killnet does not have a static IP address and doesn't leave it's return address
- woodruffw 4y agoI don’t know about the details in this case, but hacking (particularly DDoS) groups can be remarkably childish: they sometimes intentionally leave their name in requests, knowing that it’ll show up in logs. The other identifying technique is correlation: if they’re using a network of hacked devices to create a flood of traffic, any previous attacks that saw traffic from those same devices are possibly from the same group. So it’s possible killnet has a public chronology here.
- Minor49er 4y agoThe former of these would easily open the possibility of a false flag. Same with the latter, though it would be harder to pull off
- woodruffw 4y agoThis would be a pretty strange false flag: why bother blaming some random group that hasn’t been linked to the Russian government? To my mind, the most likely explanation here is the simplest one: airport websites make good testing targets, and Russia doesn’t punish hackers who target non-military resources in the West.
- Minor49er 4y agoI was speaking generally, but in this case it would be used to simply say "the Russians," regardless of whether or not they are under the Russian government. Even then, using your own example: imagine you are testing a malicious system that you built that is hitting a public testing target. Wouldn't you want to link it to anyone other than yourself for when it is inevitably detected?
- NegativeK 4y agoPeople doing threat intelligence are generally on top of attribution and try to do appropriate, fact-based attribution. That said, the warnings about Russia interfering with US infrastructure were flowing a bit before the invasion of Ukraine. Russia would be the first suspect on the top of the list, even barring good threat intel.
- status200 4y agoHacking groups can have a recognizable fingerprint / strategy [0] Killnet has claimed responsibility for similar attacks in the past [1] [0] http://attack.mitre.org/ http://attack.mitre.org/ [1] https://www.cisa.gov/uscert/ncas/alerts/aa22-110a https://www.cisa.gov/uscert/ncas/alerts/aa22-110a
- kasey_junk 4y agohttps://www.mandiant.com/resources/blog/how-mandiant-tracks-uncategorized-threat-actors https://www.mandiant.com/resources/blog/how-mandiant-tracks-...
- laba 4y agokillnet spends a lot of time promoting themselves, 7 hours ago they announced in their telegram channel that they are going to start an attack on USA airport websites and asked everybody to join them They've also done similar attacks before so they were clearly under radar