Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cyberwarfare

Killnet Releases ‘Proof’ of Its Attack Against Lockheed Martin

On August 1, Lockheed Martin was supposedly targeted with a DDoS attack delivered by the pro-Russian hacker group Killnet. The information came via the Moscow Times who reported Killnet’s claim for responsibility. 

On August 1, Lockheed Martin was supposedly targeted with a DDoS attack delivered by the pro-Russian hacker group Killnet. The information came via the Moscow Times who reported Killnet’s claim for responsibility. 

Newsweek added that Killnet claimed to have stolen Lockheed Martin employee data and threatened to share that data.

There has been no word from Lockheed Martin about the supposed attack beyond telling Newsweek it is “aware of the reports and have policies and procedures in place to mitigate cyber threats to our business,” adding that “we remain confident in the integrity of our robust, multi-layered information systems and data security.”

Killnet is a pro-Russia group that specializes in DoS and DDoS attacks. It is thought to have been formed in March 2022, and that its primary motivation is retaliation against perceived enemies of Russia. It is believed to be responsible for politically motivated attacks in Romania, Moldova, the Czech Republic, Italy, Lithuania, Norway and Latvia – as well as Eurovision 2022. 

It claimed responsibility for the attack against Lithuania in late June 2022, which it said was in retaliation for the restrictions imposed by Lithuania against Russia earlier in June.

Lockheed Martin produces the high mobility artillery rocket system (HIMARS) provided by the US to Ukraine and used to great effect against the Russian invading army. Lockheed Martin is consequently a natural target for pro-Russia hacking groups.

On August 11, 2022, Killnet reportedly shared a video on its Telegram group that claims to depict PII of Lockheed Martin employees. DDoS attacks are sometimes used to disguise and enable data exfiltration, so the claim is not beyond the bounds of plausibility.

Louise Ferrett, a threat intelligence analyst at Searchlight Security, has examined the video. It comprises, she said, “what appears to be Lockheed Martin employee names, email addresses, and phone numbers, with pictures of people – presumably the employees – overlaid.”

Advertisement. Scroll to continue reading.

Killnet also uploaded two spreadsheets with the message (translated from Russian), “For those who have nothing to do, you can email Lockheed Martin Terrorists – photos and videos of the consequences of their manufactured weapons! Let them realize what they create and what they contribute to.”

However, Ferret is not convinced. “Cross-referencing a sample of the data it does appear that they are or were genuine Lockheed employees, however that does not necessarily confirm that the company was breached,” she said. “For example, this could be a re-hash of old or open source data in an attempt to undermine the organization and intimidate its employees.”

On the one hand, Lockheed Martin has said nothing about an attack, nevermind a breach. That, however, proves nothing either way. On the other hand, Killnet has failed to provide irrefutable evidence of exfiltrated data – which again doesn’t prove anything.

Without a comment from Lockheed Martin or proof from Killnet, this is more likely to be a propaganda exercise from a pro-Russian hacking group than a successful attack against Lockheed Martin. SecurityWeek has asked the HIMARS manufacturer for a comment on Killnet’s latest claims and will append any response we receive.

Related: Hacked Ukrainian Military Emails Used in Attacks on European Governments

Related: Russia vs Ukraine – The War in Cyberspace

Related: Russia, Ukraine and the Danger of a Global Cyberwar

Written By

Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this event as we dive into threat hunting tools and frameworks, and explore value of threat intelligence data in the defender’s security stack.

Register

Learn how integrating BAS and Automated Penetration Testing empowers security teams to quickly identify and validate threats, enabling prompt response and remediation.

Register

People on the Move

Phil Venables, former CISO of Google Cloud, has joined Ballistic Ventures as a Venture Partner.

David Currie, former CISO of Nubank and Klarna, has been appointed CEO of Vaultree.

Chris Burger has been named Chief Information Security Officer at F5.

More People On The Move

Expert Insights

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.