Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cyberwarfare

Killnet Releases ‘Proof’ of Its Attack Against Lockheed Martin

On August 1, Lockheed Martin was supposedly targeted with a DDoS attack delivered by the pro-Russian hacker group Killnet. The information came via the Moscow Times who reported Killnet’s claim for responsibility. 

On August 1, Lockheed Martin was supposedly targeted with a DDoS attack delivered by the pro-Russian hacker group Killnet. The information came via the Moscow Times who reported Killnet’s claim for responsibility. 

Newsweek added that Killnet claimed to have stolen Lockheed Martin employee data and threatened to share that data.

There has been no word from Lockheed Martin about the supposed attack beyond telling Newsweek it is “aware of the reports and have policies and procedures in place to mitigate cyber threats to our business,” adding that “we remain confident in the integrity of our robust, multi-layered information systems and data security.”

Killnet is a pro-Russia group that specializes in DoS and DDoS attacks. It is thought to have been formed in March 2022, and that its primary motivation is retaliation against perceived enemies of Russia. It is believed to be responsible for politically motivated attacks in Romania, Moldova, the Czech Republic, Italy, Lithuania, Norway and Latvia – as well as Eurovision 2022. 

It claimed responsibility for the attack against Lithuania in late June 2022, which it said was in retaliation for the restrictions imposed by Lithuania against Russia earlier in June.

Lockheed Martin produces the high mobility artillery rocket system (HIMARS) provided by the US to Ukraine and used to great effect against the Russian invading army. Lockheed Martin is consequently a natural target for pro-Russia hacking groups.

On August 11, 2022, Killnet reportedly shared a video on its Telegram group that claims to depict PII of Lockheed Martin employees. DDoS attacks are sometimes used to disguise and enable data exfiltration, so the claim is not beyond the bounds of plausibility.

Louise Ferrett, a threat intelligence analyst at Searchlight Security, has examined the video. It comprises, she said, “what appears to be Lockheed Martin employee names, email addresses, and phone numbers, with pictures of people – presumably the employees – overlaid.”

Killnet also uploaded two spreadsheets with the message (translated from Russian), “For those who have nothing to do, you can email Lockheed Martin Terrorists – photos and videos of the consequences of their manufactured weapons! Let them realize what they create and what they contribute to.”

However, Ferret is not convinced. “Cross-referencing a sample of the data it does appear that they are or were genuine Lockheed employees, however that does not necessarily confirm that the company was breached,” she said. “For example, this could be a re-hash of old or open source data in an attempt to undermine the organization and intimidate its employees.”

On the one hand, Lockheed Martin has said nothing about an attack, nevermind a breach. That, however, proves nothing either way. On the other hand, Killnet has failed to provide irrefutable evidence of exfiltrated data – which again doesn’t prove anything.

Without a comment from Lockheed Martin or proof from Killnet, this is more likely to be a propaganda exercise from a pro-Russian hacking group than a successful attack against Lockheed Martin. SecurityWeek has asked the HIMARS manufacturer for a comment on Killnet’s latest claims and will append any response we receive.

Related: Hacked Ukrainian Military Emails Used in Attacks on European Governments

Related: Russia vs Ukraine – The War in Cyberspace

Related: Russia, Ukraine and the Danger of a Global Cyberwar

Written By

Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines.

Click to comment

Expert Insights

Related Content

Cyberwarfare

Websites of German airports, administration bodies and banks were hit by DDoS attacks attributed to Russian hacker group Killnet

Cyberwarfare

Iranian APT Moses Staff is leaking data stolen from Saudi Arabia government ministries under the recently created Abraham's Ax persona

Cybercrime

Artificial intelligence is competing in another endeavor once limited to humans — creating propaganda and disinformation.

Cyberwarfare

The UK’s NCSC has issued a security advisory to warn about spearphishing campaigns conducted by two unrelated Russian and Iranian hacker groups.

Cyberwarfare

WASHINGTON - Cyberattacks are the most serious threat facing the United States, even more so than terrorism, according to American defense experts. Almost half...

Cybercrime

Albanian prosecutors on Wednesday asked for the house arrest of five public employees they blame for not protecting the country from a cyberattack by...

Cyberwarfare

Cybersecurity firm Group-IB is raising the alarm on a newly identified advanced persistent threat (APT) actor targeting government and military organizations in Asia and...

Cyberwarfare

Russia-linked cyberespionage group APT29 has been observed using embassy-themed lures and the GraphicalNeutrino malware in recent attacks.