Threadlinqs IntelligenceStart free

Threat actorTracked since 2026-08

Killnet

As of 2026-10-20, Killnet is a threat actor tracked by Threadlinqs Intelligence across 2 threats spanning threat intel. ATT&CK coverage spans 23 techniques across 7 tactics in 2 of 2 tracked threats. Most-observed techniques: T1491.002 (External Defacement), T1008 (Fallback Channels), T1027 (Obfuscated Files or Information).

Tracked threats
21 high · 1 medium
First seen
2026-08-26
Last seen
2026-10-20
ATT&CK techniques
23across 2 of 2 threats
Related CVEs
0None referenced
2 tracked threat(s) · Categories: THREAT_INTEL

Activity timeline

Killnet appears in 2 tracked threats between and ; the busiest month was 2026-08 with 1 report.

ATT&CK techniques observed

23 techniques observed across 2 of 2 tracked threats · Impact (8), Command and Control (4), Resource Development (4), Initial Access (3), Discovery (2), Execution (1)
  • T1491.002 External Defacement — Impactobserved in 2 of 2 tracked threats
  • T1008 Fallback Channels — Command and Controlobserved in 1 of 2 tracked threats
  • T1027 Obfuscated Files or Information — Stealth (formerly Defense Evasion)observed in 1 of 2 tracked threats
  • T1059.010 Command and Scripting Interpreter: AutoHotKey & AutoIT — Executionobserved in 1 of 2 tracked threats
  • T1071.001 Application Layer Protocol — Command and Controlobserved in 1 of 2 tracked threats
  • T1078 Valid Accounts — Initial Accessobserved in 1 of 2 tracked threats
  • T1082 System Information Discovery — Discoveryobserved in 1 of 2 tracked threats
  • T1087 Account Discovery — Discoveryobserved in 1 of 2 tracked threats
  • T1095 Non-Application Layer Protocol — Command and Controlobserved in 1 of 2 tracked threats
  • T1485 Data Destruction — Impactobserved in 1 of 2 tracked threats
  • T1498.001 Network Denial of Service: Direct Network Flood — Impactobserved in 1 of 2 tracked threats
  • T1499.003 Endpoint Denial of Service: Application Exhaustion Flood — Impactobserved in 1 of 2 tracked threats
  • T1529 System Shutdown/Reboot — Impactobserved in 1 of 2 tracked threats
  • T1561 Disk Wipe — Impactobserved in 1 of 2 tracked threats
  • T1561.001 Disk Wipe: Disk Content Wipe — Impactobserved in 1 of 2 tracked threats

Tracked threats