Versus Killnet - Alex Holden

Good afternoon, folks. Great to be here at B-Sides Dublin. My name is Alex. I'm going to be talking today about something different. I heard a lot of great talks today about AI. This is not a talk about AI. THIS IS ACTUALLY YEAH. >> [applause] >> THIS IS A TALK ABOUT HUMAN INGENUITY. And the reason why I'm talking about this today at B-Sides. I want to show you how small group of people, computer scientists, cyber security experts, hackers, took up great task. We accomplished that. I think this is a one of the happiest stories that I talk about. This is also the most personal story I ever talked. And believe me, I've done hundreds of different talks. This is

definitely one of those that gets closer my heart. But as I talk, think about what you can be doing in your own way in changing the world for better because we got into cyber security not only to break things, but to build things, to make things better. And as I'm going to be talking today, think how you can be contributing to projects like this, to others, and seeing how the world can be definitely improved because this is a human story for me. I'm going to be talking about a group called Killnet. And this group is a hacktivist group, a Russian hacktivist group that came to power many years ago. The birth date of Killnet, a sad day in our

history, is on November 13th of 2021. And they started life as a Russian DDoS server, denial of service service in Russia that was basically targeting anybody who pays them to knock down a website from the internet. And as a service in Russia, they had to be very careful about the laws in the place where they live. But if you look at their very first targets, it's these companies. These are Russian government institutions. If you notice, whoever designs those logos does not have great imagination. It's a quite roadkill chicken with different types but Killnet actually started its career as DDoS service against Russian government. But as things progressed, they actually became much more political. So one day

before Russian invasion into Ukraine on February 23rd of 2022, Killnet changes its tone because probably talked somebody talked to them say, "Hey, knock it off." But they actually change their tune and they pledged their allegiance to Russian government and the Russian cause. They actually say that they're politically motivated now threat group that would be serving the Russian government as well. And they've been spewing Russian rhetoric from that day forward until the very last day of existence. And they start attacking anybody who Russia would actually brand as the enemies. Initially, it was Ukraine, but very quickly it became the entire world. The part of the world that we're in here. And the targets was pretty much

all of us. The bad thing about Killnet is that they legitimize hacktivism. If you look just a couple years before, so let's look at 2021 and beyond that, we would see that if one nation decides to target another one with cyber attacks, it would be a huge cost for political discontent. It would be very strong words. It would be near declaration of war because before that it was unprecedented. With the Russian invasion into Ukraine, this became normal. When one nation actually attacks another for no apparent reason without declaration of war, but if this is happening in cyberspace, this became normal. In fact, this became so normal that in May of 2022, Russian politicians, members of Russian

Duma, were actually calling openly that participation in hacktivist groups like Killnet is equivalent of serving in Russian army because it furthers the political cause and they said that this is a good thing to be part of this collective. This also signified probably one of the first times when hacktivists became beyond cybercriminals. Russia is associated with cybercrime quite a bit, but Killnet was not only joined by cybercriminals. Actually, cybercriminals were very small minority there. They [snorts] the Killnet collective was mostly comprised by of IT special by IT specialists. And this is simply because of one interesting fact. >> [snorts] >> In with beginning of a Russian invasion in Ukraine, a lot of previously a lot of Russians were

gainfully employed in companies in Europe and the United States around the world, and they were making a decent living mostly as IT personnel, some in cybersecurity, some others, but after Russians' actions against its neighbor, many companies, including uh, here in Ireland, decided uh, to make steps, uh, to eliminate their connections with Russia. So, what of people who lived in Russia, uh, quickly became unemployed and, uh, from their Western, uh, companies. And amount of unemployment in Russia, especially in IT, uh, hit all-time high. And these people didn't know what to do. They were angry at their employers, uh, employers they were not angry at their government. So, they started joining, uh, Killnet. This was a movement within

Russia that counted over 100,000 members in its, uh, ranks that came out online every single day to attack, uh, their enemies. And their enemies would be posted in their Telegram channel and there would be massive attacks. Think about this. Uh, people with, uh, cyber criminal skills definitely can hack inside of a system. But what about a developer? Can a developer cause a significant outage by tampering with, uh, scripts, figuring out what are the costly, uh, queries to the database and, uh, spam, uh, spam those queries? Absolutely. And network, uh, engineer can actually figure out, uh, network misconfigurations and cause quite a bit of routing problems, uh, to the targets. Not to forget that, uh, some of these

folks still had keys to their old employers and, uh, they were happy to pay back the employers for, uh, getting fired. My favorite, uh, member of, uh, Killnet collective though is a grandma. One guy wrote about his grandma and he said that in our day his grandma would sit on her computer and, uh, open Internet Explorer, look up the target of the day, and hit reload as quickly as possible. Uh, uh, I'm sure our writers would stop grandma, uh, quite effectively, but, uh, uh, unfortunately, uh, she was joined by many, many capable, uh, individuals who actually, uh, took pleasure taking down sites in much more vicious way than eroding Internet Explorer over over. This ushered the new

era of activists. Keep in mind that after that came attacks in the Middle East between Israel and pro-Hamas groups. We've seen rise of hacktivism happening later on when Canada and India had challenges between their respective government and hacktivists from India decided to take playbook from Killnet and start attacking their government. This ushered the new era and the leader of Killnet Collective was somebody called Nikolai Nikolaevich Serafimov. This is a normal-looking person. He looks like a normal person. Some based on internet comments, he is a good father. And if you look at his internet profile, he was a patriot. He actually said that he he was a patriot of Russia. Now, with all these positive images, I

can tell you that Killmilk, how he called himself as a leader of Killnet, was a not a good person. He was a racist. He was a person who absolutely hated everybody and even in his early days, when he was writing about his aspirations, he was saying that he will pay back everybody who crossed him when he was younger and weaker. This is a person who was addicted to drugs most of his adult life. As a younger person in his social media profile, he rates his mood based on amount of drugs in his system. And this actually catches up with him in 2017 he when he gets arrested for drug trafficking by Russian government. And he is actually facing a very serious

charges. The charges that carry up to eight years of prison time, minimum four years. Killnet actually cooperates with the investigation and judge in his case actually notes that the this young man was very resentful of his participation in Russian drug trade. So he actually gets questionably only one year of prison time in a gulag rather than minimum four year requirement. And in Russia they actually deal with criminals very sternly. So one year instead of four minimum is greatly unusual and sounds like this is where Mr. Serafimovich actually met his government handlers who further pointed him on the right way and this is definitely one of the strong connections between Killnet collective and the Russian government.

They Killnet didn't do lot of very sophisticated breaches even though they tried but they use besides the DDoS attacks they also heavily use propaganda as its weapon. But [snorts] they use propaganda. They actually targeted not only Ukraine but they also targeted anybody who would be an enemy of Ukraine. They heavily targeted companies like Lockheed Martin and Boeing because of those companies support for Ukraine. In fact there was a bounty on anybody getting inside of a computer of Lockheed Martin employee and trust me the Lockheed Martin has a lot of employees but Killnet collective of 100,000 people also has a lot of manpower and capabilities. So targeting of this magnitude is different. And beside that the psychological

warfare of photoshopping executives of Lockheed Martin in casket and telling them that this is going to be you if you don't stop definitely pressured from one country against another. The most despicable act that we've seen was this post on Telegram. On left side it's in Russian and the right right side it's translated but I'm going to tell you what it says. It's basically saying that Killnet is commissioning attacks against hospitals not only in United States but in Great Britain, Germany and many other European countries. This is the directive of Killnet and its leader to attack hospitals and post scriptum there you may not be able to see says kill them first. This is just in the wake of COVID. It's

targeting people who are weaker. People in the hospital, sick people. And while some hospitals have a lot of redundancy and can take a lot of internet traffic. Some rural hospitals actually experience outages not only with their main sites but with their emergency systems, communications and others. This is attack against health care. It's attack against us. And this is despicable act make these people our enemies. I'm being very serious here because very few attacks of this magnitude actually been directed against our society. Little Mr. Kilmister knew that his days were already numbered and the timer that was ticking was already took its toll and his little group of Kilmister is over. Let me tell you about myself. This is

probably the latest introduction I've done in a presentation. So, hi. My name is Alex and I was born originally in Kiev, Ukraine many, many, many years ago. I My parents brought me, my family to from USSR in 1989 and I live in city of Milwaukee which is 100 km north from Chicago and I've been there for the last 37 years. I'm happy in Milwaukee but I still see myself as a part of global community. I consider myself a cybersecurity professional and this what my career been my entire life and part of my career is monitoring of the bad guys, of threat actors. I I've done a lot of interesting things. You can Google my career, find interesting things about me

but I think the highlight of my resume is this. I've been making Mr. Putin mad since 2014. He He is really, really upset in 2014. We discovered something about Russian hackers that targeted at the time the biggest breach of all time. It's still one of the biggest breaches of all time when the threat actors stole 1.2 billion credentials using SQL injection against 420,000 websites and Mr. Putin was so upset he put me on his naughty list. And uh you get put on that list, you don't get like note, you don't get a certificate or anything like that. You get a call from Department of Homeland Homeland Security in the United States and I get a call

from an agent. He said, "Is this Mr. Khodan?" I'm like, "Yes." "This agent so-and-so from DHS. I have a message for you. Don't go to Russia." I'm like, "Okay." I was not planning to. He's like, "This is very serious. Don't go to Russia." Can I ask why? No, you cannot ask why. Okay. So, it goes for a while back and forth and I'm not from Russia, I'm from Ukraine, different country, you know. He's like, "Still don't go to Russia." Fine, won't go to Russia. >> [snorts] >> But just as a return for Mr. Putin's actions, I put sanctions against him. He's not allowed in my house. He He can't go down the driveway and wait in the garage while a couple of my

Ukrainian friends get to play my own version of Homeland Security. But >> [laughter] >> It's actually been interesting that when a foreign leader recognizes you as a threat. And I definitely don't like the violence, but I definitely proud to make his life a little bit difficult because he made ours really miserable. But back to Killnet and his life. So, in 2022 20 beginning of 2023, Killnet was actually a brand name in Russia. They sold merchandise, t-shirts, hats, different stickers and stuff like that. They actually were making business off merchandise. And people wanted to be Killnet. They were doing promo videos. People were getting tattoos with Killnet everything. Russian uh newspaper RT RT, um which is a Russian propaganda um

paper, actually published an interview with uh Kilmilk at the time. And me um always having interest in Russian propaganda, uh I actually read this uh interview. And one thing that actually stood out, and I actually translated this in the slide, that in when the Kilmilk was asked if uh somebody abroad outside of Russia supports his efforts, he actually uh calls out a group called Solaris. And uh he's saying some uh basically saying that if not for Solaris, uh Kilnet would not exist. So, okay. Well, interesting. If Solaris doesn't exist, then uh Kilnet uh won't exist. That's an interesting notion. And I actually know Solaris. I know much about Solaris. Even uh before when we were talking

about this uh in our group, and uh my company is only 55 uh persons strong, we were talking about how can we stop uh Kilnet? 100,000 people, how do you stop it? And we had lots and lots of crazy stupid ideas. I'm not even going to entertain those. Uh but this gave us a good idea, and we decided to act upon it. This was a slow um Hail Mary, really, because we did not think that we would be successful, but we said it might work. Let's try. And we set a group of nine people including myself. Uh I'm the only one who resided in the United States. The rest were in Ukraine, and uh everybody

uh patriots of uh their country, decided to um use connection of Solaris uh between and Kilnet, and try to bring down Kilnet. So, uh here's a little bit about uh Solaris. They are uh illegal drug marketplace. No wonder a druggy um person convicted for drug trade would know much about uh Solaris and have connections there. Um this was established by uh threat actor named Zanzi and at the time uh in 2022, uh this was one of the biggest top three uh illegal Russian drug marketplaces uh online. They were operating over thousand of uh shops in different cities of Russia trying to um monetize illegal drugs uh and sell them online through very complex system. So, we decided to go after uh Solaris

and we knew quite a bit about Solaris. Um first of all, um we why would a cybersecurity company actually look at um uh illegal drug marketplace because you know, we are not drug enforcement or anything like that. But uh in threat intelligence uh cyber threat intelligence that we do, we actually figured that um many years ago uh that if you go to um dark web and try to monitor the bad guys, they won't tell you where they are, what they do. But uh if you go to the legal drug marketplace where they buy their drugs and quite a few of them do um you're going to see them buying drugs near their homes. So, you can actually

uh use uh the information within uh drug trade to zero in on threat actors who use the same nicknames uh on uh dark web, whether it's a drug trade or illegal um hacker forums. So, we actually use these things uh for different different reasons. We were trying to figure out where the bad guys are. Um in in order to get inside of uh the drug trade, we don't need to be drug traffickers or anything like that. So, uh in uh 2018 when Zanzi was just starting his uh uh site for Solaris, he um, was looking for help because he was trying to make extremely secure, um, website and that nobody can get in and at some point 2018 he had actually

problems, uh, with, uh, some PHP code. So, he reaches out, uh, to, uh, people on the dark web and he, uh, was asking for help with, uh, getting some PHP code to run. Uh, we, uh, use many different alter egos on the dark web and, uh, we recommended, uh, to him the best shadow IT service that he could ever find, ourselves, under a different nickname. Uh, he came to us and he said, "I'm Zantee, I want, uh, help." Like, Zantee who? So, we started asking him a whole bunch of questions. He was, uh, trying to prove that he is really bad guy. Uh, we didn't believe him. He's like, "Okay, just look at my system." We said,

"Okay, we'll be happy to look at this." Um, we'll we'll see what we can do to, um, fix this. Do you want us to do the backup of the system before we start doing this? He's like, "Yes." Do you want offsite backup? He's like, "Yes." So we made a copy of the server, uh, for ourselves. Um, then, uh, we said, "Okay, you know, if we make changes on the system, like, you know, update libraries and stuff like that, we may lose access to our system. Can we put, like, you know, backup connection to this?" He's like, "Yes." Or backup connection, backdoor, I mean. Uh, so, we we will put in backdoor. Um, uh, when we still couldn't figure out,

uh, how to fix his site because we didn't look to try to fix his website. Uh we uh, we screwed up and the people got to turn off the backdoor. [clears throat] Um, so, then he got more sophisticated, much more secure, great great security. Um, so, he moved to, uh, Tor network onion and, uh, backdoor start began much easier to manage because, um, now he can't tell the difference in traffic. So, a whole bunch of things, you know, but as his, um, infrastructure grew, it actually got really really big. I mean, um, seriously speaking, the infrastructure of Solaris was sophisticated. It was great. It It was had multi-tier was he created internal ecosphere for Bitcoin trade

because Bitcoins were not legal in Russia. So, he was collecting payments from bank cards from Russians from the Russian bank converting it to Bitcoins and within the big Bitcoin ecosphere, he was actually able to trade money between drug dealers drug dealers website operators and stuff like that. It was extremely complex setup with about 2,000 servers that were actually completely functional and simple to use. And we had access to only one server and that was you know kind of sad because we know that there is much more and the server that we had access to was not interesting at all and the system was super secure. I mean, he said that you know initially that this system going to

be the most secure system in the world and we believe him so you know connect through a back show to his server look at it it's extremely secure until we found the SSH keys sitting on the server. So, we got access to a third of his infrastructure but that's only one third of infrastructure of super secure system that we could not get much further and then we noticed that there is Ansible running on system and we run some scripts for Ansible and we got access to another one server. So, we are controlling two thirds of this super secure infrastructure nobody could get in unless you have access and but there is one server remaining which

is the most important stuff with their Bitcoin exchange and then we see that he's running Zabbix for monitoring and we just ordered the scripts for Zabbix to allow us to drop SSH keys there. So, we have access to everything. Horizontal and vertical. And we are seeing this a whole ecosphere for over two months monitoring day in day out. Knowing that at some point we need to pull a trigger to play the next step of our game. The next step of our game is was interesting when it was self arrest from our side. We actually engineering the system that the bad guys themselves decided to transfer all the Bitcoins in their daily ecosphere from instead of to a

normal account that they did the clearing to to an account of a charity in Ukraine. So, the Russian drug dealers actually then donated over 1.5 Bitcoins to charity in Ukraine that was helping elderly people during the war. It was winter of 2022 and a lot of elderly people in Ukraine were actually suffering during that winter much more so during the war. Power outages and stuff and we were able to get the bad guys to transfer themselves all their money to Ukrainian charity. We also as a part of our plan went to Forbes magazine and Forbes wrote an article about us about us hacking the system. At the time it was only 25,000 US dollars. It got

much more because when the money was cashed out by the charity it was over 47,000 US dollars about 40,000 euros. It's a little bit that helped but the idea was to get on in big publication like Forbes magazine for people to see not only the Solaris problem but connecting them to Killnet. Making sure that this connection exists, and that's through our word of a small company in United States and Europe, but on from the biggest publications in the world, we wanted to highlight this evil connection. So, what Solaris doing? They actually published a statement. So, immediately after the Forbes story, they published the statement in Russia. I'm going to highlight some things and they have Nobody hacked us.

You can see it for yourself. Everything is still working. Don't believe your lying eyes because we are telling you this. Don't read the internet. Don't panic. Everything okay, but just in case, we're going to be taking down the system for management and we're going to be fixing everything that we need to fix. Cool. So, they fixed everything. Now it's the system again the most secure system in the world and we obviously want to confirm it. So, we go to their super secret GitLab. System just confirmed what they they changed. They didn't change much. They changed the tour site address. They changed the Bitcoin address for deposits. They changed copyright date and the logo a little bit.

So, not much. So, we decided to go with step two. Step two, we wanted to ring the bell a little bit more. So, three weeks after Forbes story, we actually publishing something on our own site exposing Solaris again as its connection to the Russian collective Killnet. And we're not only putting a lot of terms and a lot of factual information. We're actually publishing and dumping all the data that we recovered from Solaris into public. This allowed to map a lot of drug users in the Russia to their real names because of bank card use. We This allowed to track a lot of cyber criminals through cryptocurrency and nicknames. This also allowed connection to quite a bit of Russian

government officials to be mapped out and we sat and waited. So first what happens immediately Solaris exit nodes were taken over by competition. Kraken which was number one drug illegal drug marketplace in Russia immediately takes over those exit nodes and uh basically through out all the traffic to themselves saying hey Solaris is hacked now use us. That's one component. Danzig said too tired and too old I'm going to quit >> [snorts] >> and then they start fading to obscurity but still operating and um but then they said to everybody like you know everything is fixed we restarted servers we redid everything it's a new infrastructure we logged in checked yes of course they changed a lot of things

they the now completely unhackable we went to all the servers confirmed that they are unhackable very good so great security but the positive thing that it takes another year but Solaris finally citing problems citing no reputation distrust from community they actually close their doors for good. So that's a victory that took us a while. Immediately after all this we had to weather a storm and myself putting my name out there definitely not great idea to do this don't do this yourself please this is about getting cyber threats doxing which is not very pleasant but I didn't have deep dark secrets like some but there was also targeting so there was a swatting attempts against my house and um I want to over thank

our wonderful police department that was extremely professional dealing with these things and I'm always in touch with our local police department to make sure that they know who we are what they do. Lots of hate speech lots lots of racist components that I don't care to translate or repeat. But this is one part of it. On the other thing Killnet is unraveling. So they they are spewing propaganda but they are really unraveling they breaking down into small pieces. The Russian government and this is what's a part the big part of plan the pivotal part of a plan Russian government noticed this connection. They understand that they are sponsoring and paying for Killnet activities. This is

their pet project. But this pet project is siphoning the money to illegal drug trade and Russian officials don't particularly like competition in illegal activities. So they cut off funding for Killnet. So 100,000 people need leadership. They need propaganda. They need technology. They need direction. They need targeting and Russian government take a step back. And never does another thing with Killnet. So this is a great step. This was the plan for us to Killnet. But it doesn't go away immediately. So Killnet is slowly slowly going broke. The story is breaking December of 2022 January of 2023. In February of 2023 Killnet starts going broke very quickly. We see him pawning his four cars. So, he bought

four luxury cars in 2022 for himself and his wife. Two people, four cars, go figure. But, he pawns all of them. His debt is skyrocketing for many different reasons. His wife even taking microloans to do her nails and hair. So, which is funny but true. They they really run out of money. He actually starts uh uh is saying something like this. He says that from now on Killnet is going to be a for-profit organization. Charity is over. We're going to be charging people for attacks. And people said, "Oh, that's great. The 100,000 of us, we are ready to get paid." He's like, "No, no, it's just me." No, that doesn't work like that. So, this this didn't go.

Then he disbands Killnet. He disbands. He says, "Everybody is fired. I'm going to rebuild Killnet. Now Killnet is just me." So, then he realizes that idea, so he gets everybody back. Nobody was really paying attention at that point. >> [snorts] >> He even gave it Killnet to another threat actor and made a big deal that now Killnet is being handed over to another guy under name Darkside and somebody said, "Well, didn't you used to call yourself Darkside a couple years ago?" He's like, "Oh, yeah, sorry. That didn't work." So, on October 6th of 2023 in the final months, Killnet actually calls for peace. On October 6th, he makes a post asking every member of Killnet Killnet

to follow Red Cross guidelines in cyberattacks against Ukraine. He talks about attacking only military targets and stay away from civilian targets. What he said actually made sense. But October 6th uh of 2023 was a peaceful day compared to October 7th. And on October 7th, after Hamas actions against Israel, he actually throws all support of Killnet behind Hamas and calls for more attacks against Israel, Ukraine, and its allies. Um and that's how it continues uh for the end of 2023. Um as of the beginning of 2024, Killnet is no more. The channel, we are Killnet, which was the primary channel of communication on Telegram of Killnet, gets sold for less than 10,000 US dollars to a group called the Anon

Club. The Anon Club was not about the Anon people, they just had a cool name. Uh but you would never believe what the Anon Club did with the we are Killnet channel. Uh I was greatly amused, but the entire channel was dedicated to fighting Russian illegal drug trade. So, the Anon Club decided to see if they can get money back from Killnet that government was doing by saying we are declaring the war against illegal drug trade. And that that didn't work, but they actually stopped quite a bit of illegal drug trade by doxing the leaders. And then Killnet himself gets doxed by Russian media. So, Russian media actually identifies him, goes to his home. He initially says no, no, it's

not me, then says that it's it's it's me. Uh and you know, but nothing really turns out because nobody paying attention. Killnet becomes irrelevant. He joins different groups for different reasons. He picks up fights with different bloggers. He yells quite a bit. Uh but he is not successful in any of this. Um he even at one point spreads rumor that he was killed. Nobody pays attention. The next day he comes back saying like, "No, the rumor is not true." He gets four likes. Uh, I mean, the the only thing that he've done, um, he actually goes back his music roots. He used to be a musician. So, he releases two singles, profanity riddle, um, tracks. Okay, he

can carry the tune better than I can, but that's about it. >> [laughter] >> Um, he also tried to sell, um, training classes of what to do on the dark web. Uh, when he, uh, sold those classes, it was from 250 euros to 25,000 euros. Uh, the reviews were not great. He was just sending people links, uh, that he found on Google. And people, oh, Yandex, I'm sorry. Um and So, most people wanted, uh, their money back. I don't know, didn't buy it. But um this um really, uh, sets him to Iran. See, we often hear that, uh, he posts something, but from great following where, um, his posts were getting, um, tens of thousands of reactions, uh,

within first hour, he's not getting any reactions, uh, from anybody anymore. Russia stopped projects with hacktivist movement of that magnitude. They still have hacktivist groups, they still have threat groups, but, um, the experiment with 100,000, uh, individuals, uh, becoming part of a great collective, they would not repeat again because they cannot control it. They cannot control criminals, and they cannot, um, do much about, um, the outcomes. So, this story has, uh, several layers. And, uh, this story is about finding an Achilles' heel of a group of people, a herd of, um, threat actors, bad guys, um, that we were trying to target and try to slow them down. I'm not going to take full credit for stopping Killnet.

Lots of different things were happening in this ecosphere, but I would like to believe that our blow was the most significant one to the group, and cut off of the funding from the government, and confidence from government was really the key. We took a gamble, a great gamble that actually endangered us, and could not might have not paid off at all. But, we found this Achilles heel, and this talk is about making a difference, of us setting goal, setting a direction, and follow that direction until we actually got something that was really resembling a victory. And that's why I'm here to present this and tell my story, and I'm very happy to see you guys here, and

listening some laughing at my stupid jokes, and really hope that this encourages you to create something positive in cybersecurity. Thank you.