# Killnet

> As of 2026-10-20, Killnet is a threat actor tracked by Threadlinqs Intelligence across 2 threats spanning threat intel. ATT&CK coverage spans 23 techniques across 7 tactics in 2 of 2 tracked threats. Most-observed techniques: T1491.002 (External Defacement), T1008 (Fallback Channels), T1027 (Obfuscated Files or Information).

- **Tracked threats:** 2
- **Categories:** THREAT_INTEL
- **As of:** 2026-10-20

## ATT&CK techniques observed

23 techniques observed across 2 of 2 tracked threats. Tactics: Impact (8), Command and Control (4), Resource Development (4), Initial Access (3), Discovery (2), Execution (1).

- [T1491.002](https://intel.threadlinqs.com/technique/T1491.002) External Defacement — Impact — observed in 2 of 2 tracked threats
- [T1008](https://intel.threadlinqs.com/technique/T1008) Fallback Channels — Command and Control — observed in 1 of 2 tracked threats
- [T1027](https://intel.threadlinqs.com/technique/T1027) Obfuscated Files or Information — Stealth (formerly Defense Evasion) — observed in 1 of 2 tracked threats
- [T1059.010](https://intel.threadlinqs.com/technique/T1059.010) Command and Scripting Interpreter: AutoHotKey & AutoIT — Execution — observed in 1 of 2 tracked threats
- [T1071.001](https://intel.threadlinqs.com/technique/T1071.001) Application Layer Protocol — Command and Control — observed in 1 of 2 tracked threats
- [T1078](https://intel.threadlinqs.com/technique/T1078) Valid Accounts — Initial Access — observed in 1 of 2 tracked threats
- [T1082](https://intel.threadlinqs.com/technique/T1082) System Information Discovery — Discovery — observed in 1 of 2 tracked threats
- [T1087](https://intel.threadlinqs.com/technique/T1087) Account Discovery — Discovery — observed in 1 of 2 tracked threats
- [T1095](https://intel.threadlinqs.com/technique/T1095) Non-Application Layer Protocol — Command and Control — observed in 1 of 2 tracked threats
- [T1485](https://intel.threadlinqs.com/technique/T1485) Data Destruction — Impact — observed in 1 of 2 tracked threats
- [T1498.001](https://intel.threadlinqs.com/technique/T1498.001) Network Denial of Service: Direct Network Flood — Impact — observed in 1 of 2 tracked threats
- [T1499.003](https://intel.threadlinqs.com/technique/T1499.003) Endpoint Denial of Service: Application Exhaustion Flood — Impact — observed in 1 of 2 tracked threats
- [T1529](https://intel.threadlinqs.com/technique/T1529) System Shutdown/Reboot — Impact — observed in 1 of 2 tracked threats
- [T1561](https://intel.threadlinqs.com/technique/T1561) Disk Wipe — Impact — observed in 1 of 2 tracked threats
- [T1561.001](https://intel.threadlinqs.com/technique/T1561.001) Disk Wipe: Disk Content Wipe — Impact — observed in 1 of 2 tracked threats

## Tracked threats

- [Evolution of Hacktivism in Hybrid Warfare: NoName057(16), Killnet and Handala Hack Tactics and Real-World Impact](https://intel.threadlinqs.com/threat/TL-2026-3963) — MEDIUM
- [Hacktivism as Hybrid Warfare: NoName057(16), Killnet, and Handala Hack Escalate Coordinated Disruption Campaigns Against NATO/EU Infrastructure](https://intel.threadlinqs.com/threat/TL-2026-2154) — HIGH

## Full data

Infrastructure, IOC values and detection queries (Splunk SPL / Microsoft KQL / Sigma) require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/actor/Killnet