Communication Barrier from KillNet

Indicators of Compromise

APT Groups

Mitigation

<b><font>MITRE Map</font></b><div><b><br></b><div><b>Reconnaissance&nbsp;</b></div><div><ul><li>T1595: Active Scanning&nbsp;<br><br></li><li>T1589: Gather Victim Identity Information&nbsp;</li></ul></div><div><b>Resource Development</b></div><div><ul><li>T1583: Acquire Infrastructure&nbsp;<br><br></li><li>T1584: Compromise Infrastructure&nbsp;</li></ul></div><div><b>Credential Access&nbsp;</b></div><div><ul><li>T1110: Brute Force&nbsp;</li></ul></div><div><b>Impact</b></div><div><ul><li>T1498: Network Denial of Service&nbsp;<br><br></li><li>T1489: Service Stop</li></ul></div><div><div><b>Primary Killnet Tactics</b></div><div><b><br></b></div><div>Brute-force dictionary attacks against:</div><div><ul><li>SSH (port 22) primarily targets the root account</li></ul><ul><li>Minecraft and TeamSpeak servers</li></ul></div><div>DDoS attacks on the OSI model:</div><div><div><ul><li>layer 4 (SYN flood attacks)<br><br></li><li>layer 7 (high volume POST/GET requests) to cause resource exhaustion and system failure.</li></ul></div></div><div>In various Telegram groups, they collaborate with the members who are instructed to use IP stresser-for-hire tools such as Crypto Stresser, DDG Stresser, Instant-Stresser, and Stresser.ai. Moreover, several scripts are used during their attacks. Some of them are CC-attack, MDDoS, Low Orbit Ion Cannon (LOIC), KARMA, and Dummy.</div></div><div><br></div><div><div><b><font>How to Prevent a Killnet Attack</font></b></div><div><br></div><div>Firstly, we need to pay attention to two main defense tactics. One is enforcing strong password policies that can withstand basic brute-force credential attacks, and the second is to have a proper strategy for fighting off DDoS attacks.</div><div><br></div><div>The other defensive tactics are listed below:</div><div><br></div><div><ul><li>Purchase DDoS mitigation services from an Internet Service Provider (ISP), Content Delivery Network (CDN), or Web-Application Firewall (WAF) provider.<br><br></li><li>Deploy multi-factor authentication (MFA) mechanism for all remote accesses<br><br></li><li>Use blocklisting known Killnet-related IoC, such as IP addresses used by Killnet attacks.<br><br></li><li>Enable the DMZ (Demilitarized Zone) for internet-facing entities.<br><br></li><li>Employ DDoS protection via web bot detection techniques.<br><br></li><li>Reduce attack surfaces and make it easier with ASM (Attack Surface Management) platforms.<br><br></li><li>Get the CTI (cyber threat intelligence) feeds that monitor dark web information to identify and predict potential threats and provide actionable intelligence data for your organization.<br><br></li><li>Configure web servers and APIs with security modules to optimize performance during a web traffic spike.<br><br></li><li>Perform stress tests on all critical services for their ability to handle resource exhaustion attacks<br><br></li><li>Create and practice IRP (Incident Response Plan) for the worst case, which resulted in temporary downtime.</li></ul></div></div></div>