AI
Killnet’s Origins and Mobilization
Killnet formed in November 2021, initially DDoSing Russian targets. Days before the 2022 invasion of Ukraine, they pledged allegiance to Russia. Leader Kilm recruited unemployed IT workers fired by Western companies. The group’s Telegram channel grew to 100,000 followers. They attacked hospitals, calling to “Kill them first.” Russian Duma officials endorsed the group, equating membership to military service. Normal people, including a grandmother clicking reload in Microsoft Edge, became cyber activists.
The Solaris Connection
In a Russian state TV interview in October 2022, Kilm named Solaris, a dark web drug marketplace, as crucial to Killnet. Holden’s team already monitored Solaris via a backdoor planted years earlier when founder Zanzi asked for PHP help. Solaris operated over 1,000 stores across Russia, selling drugs via Bitcoin conversion. The connection exposed Kilm as a former drug criminal. Holden’s theory: tracking drug marketplaces reveals invisible threat actors.
Inside Solaris: The Heist
Using SSH keys, Ansible, and Zabbix scripts, Holden’s nine-person team gained broad access to Solaris servers. They redirected nearly $50,000 from drug dealers to a Ukrainian charity for the elderly and sick. Forbes covered the story. Solaris denied the breach but took the system down for a week. They patched by changing onion addresses and Bitcoin addresses. Holden’s team later published source code and database dumps, exposing the entire operation.
Killnet’s Collapse
Russian government withdrew financial support from Killnet. Leader Kilm went bankrupt, pawning his car and taking microloans for his wife’s expenses. The group disbanded, reformed, was sold. As of 2024, their Telegram channel fell from 100,000 to 3,000 followers, bought by a group fighting Russian drug trade. Kilm faded to obscurity. Holden concluded: a small team of Ukrainian people made a difference.
Notable Quotes
“I’ve been making Vladimir Putin mad since 2014.” Alex Holden · ▶ 1:32
“Kill them first. This is our enemy.” Alex Holden · ▶ 8:29
“We let the drug dealers themselves push buttons to transfer funds within their systems to Ukrainian charity that helped elderly and sick in times of war. we were able to transfer nearly $50,000 US” Alex Holden · ▶ 14:32
“As of 2024, Killnet is no more.” Alex Holden · ▶ 20:12
“Small team of Ukrainian people actually made a difference.” Alex Holden · ▶ 21:37
Key Takeaways
- Killnet recruited unemployed IT workers and even grannies for DDoS attacks.
- A backdoor into the Solaris drug marketplace enabled $50,000 donation to Ukraine.
- Cutting Killnet’s financial support led to its collapse within a year.
About the Speaker
Alex Holden is the founder and CISO of Hold Security, LLC. Under his leadership, Hold Security played a pivotal role in information security and threat intelligence, becoming one of the most recognizable names in its field. Mr. Holden researches minds and techniques of cyber criminals and helps our society to build better defenses against cyber-attacks.