“We continue our destructive activities, for the glory of our homeland.” Says an official statement by Russian cybercriminals, Killnet, on their Telegram channel.

From Killnet To Killnet PMHC

For weeks, the group had been hinting at an announcement that would take place around 2200 Moscow local time on April 26. The following statement was issued, declaring a realignment and an establishment of guidelines that seem to echo those of the infamous Wagner Group:

Translation based on iterations between ChatGPT and DeepL.

From this moment on, we are the Russian Private Military Hacking Company, Killnet. Please welcome [and appreciate] us. What does this mean? …We [will] continue our destructive activities for the glory of our homeland! We can’t live on donations [alone] and assistance from our sponsors. We defend not only the interests of the Russian Federation, but also now take orders from private and state [actors]. Killnet does not operate in Russia and CIS countries.

‘Killmilk’/Killnet Telegram

“CIS countries” refers to the Commonwealth of Independent States, a Eurasian intergovernmental bloc of former Soviet states.

On the night of April 29th, the group continued to discuss the restructuring through a special Q&A session.

We created four subdivisions of specialists of different levels. In our organization, we have former cyber criminals from different areas of the darknet and former [officers] from different special services (not only from Russia). Nowadays, we are ready to offer to our country not only protection but also the [ability to punish] criminals [of varying severity] all over the world.

‘Killmilk’/Killnet Telegram

Implications Of Concern

Throughout the course of the Q&A, inquiring followers and Killnet representatives mentioned several personal concerns regarding the direction of the war. Some of the exchanges covered the potential for Ukrainian counter-offensives being leveraged for propaganda, as well as disinformation about agreements being made between NATO leadership and wealthy Russian elites.

One question in particular seemed to imply rumors of political disloyalty in the ranks of the Russian military:

Q: “Guys, how to remove […] generals who do not issue shells to our soldiers?”

A: “It is quite a complicated issue as we have no right to judge any of the officials of our country. There are special agencies for that, let’s leave their work and task alone, and let’s not go down the road of “Navalnists”, every state has its own dirt and cleanliness, every country has its own specialists to eliminate pollution and encourage clean-minded citizens.”

These concerns seem to reveal a greater awareness of the situation on the ground than North American and European media tend to suggest of Russian media consumers.

While presented as “shitposting”, several memes and animations shared on the channel and in their comments demonstrate a knowledge of Ukraine’s capabilities to launch long-ranged attacks with devices such as this one depicting retrofitted TU-141 Strizh drones.

These achievements are shown in a dismissive way (painting the weapons as unreliable and ineffective), but there is an implied acknowledgement of the reality that Ukraine is capable of bypassing Russian air defenses.

A Need For Revenue Streams, “Altruism Is Over”

The group also revealed that they now have an official training and recruitment channel, which they dubbed the Dark School. The channel was created on April 4th. It offers training and recruitment materials in Russian, English, Estonian, and Hindi, for a price.

As of 29 April, the Dark School‘s splash page mentions having had their servers taken down by “European bastards”. Naturally, this is followed by a call for donations. As well, there are some links attempting to tantalize prospective students with scattered collections of NATO documents (though it mostly seems to be files that are publicly accessible). Anything more than that reads little differently than what you’d see on any cyber “bootcamp” website, with a blackhat twist.

While Killnet attempts to re-launch as a blackhat-for-hire service, it’s important to remember that it’s not the first time the group has attempted to use their notoriety to generate revenue through merchandise and advertised services. They are also not beyond exaggerating the efficacy of their attacks.

While much of this can be humanizing, it is important to remember that Killnet, despite having previously claimed to have no desire to target individuals uninvolved in the conflict, are still very much a part of Russia’s cyber operations arsenal.