‘Black Skills’ Is Killnet’s Attempt To Form A ‘Private Military Hacking Company’

About ‘Black Skills’

On March 13, 2023, Killmilk, the leader of the Russian hacktivist DDoS collective Killnet, announced on Telegram the creation of “Black Skills,” a private military hacking company.

The name “Private Military Hacking Company” is a clear riff on the growing presence and cult of private military companies in Russia (primarily the Wagner group). It’s also likely a not-so-subtle invitation to the Russian government to use Killnet’s resources as a cyber-mercenary group, although they’re also unlikely to investigate their clientele deeply.

This comes just weeks after the setup of “Black Listing” – a Telegram-based DDoS-for-pay service targeting darknet marketplaces that was officially set up by the Deanon Club, Killnet’s partners, but which Killnet also supports.

Consolidate its illegal identity

Black Skills / Black Listing appears to be an attempt by Killnet to establish itself as a corporate identity. According to our intelligence, the new group will be organized and structured, with sub-groups dealing with payroll, PR and technical support, pen testing, as well as data collection, analysis, information operations and hits against priority targets.

Killnet appears to have concluded that previous attempts to scale operations did not work. Activity on the “Infinity” forum, which was created as a channel between hacktivists and cybercriminals in late 2022, took off, prompting its founders to put the forum up for sale. Its “school for hackers” failed to take off.

In this new project, Killnet requires all applicants to fill in a formal questionnaire that describes, among other things, their skills, as well as whether they have served in the army or as a civil servant.

It is currently unclear if this is going to be a complete rebranding/replacement of Killnet’s de facto umbrella organization for pro-Kremlin hacktivist groups, or just an attempt to capitalize on their gains over the past year and make themselves a more effective organization (eg. e.g. by separating more skilled members from the rest by putting them into different subgroups that have varying degrees of access to information).

Much of the claims they have made about the 24 “wards” can only exist on paper. What seems obvious is that they are trying to make their skills easier to monetize: an “investment” sub-group, for example, is tasked with finding and negotiating with funding sources.

Generally speaking, Killnet is still frowned upon on top forums, where they are seen as a collection of boastful, unsophisticated threat actors whose bark is often bigger than their bite.

Some top forum users have also criticized the group for seeking cooperation with Russian security services, for encouraging doxxing campaigns and for not taking action against members of Infinity who targeted or shared data belonging to Russian organizations.

Keep a close eye on illegal communities with Flashpoint

Flashpoint gives teams access to illicit online communities, including closed sources across forums, the open web and chat service platforms, as well as indicators of compromise (IOCs) and technical data analyzed by our expert intelligence analysts. Having spent years in illicit communities, we understand the data to be collected, have the flexibility to move collection capabilities to go where adversaries go, and can quickly analyze, refine and contextualize that data to provide valuable insights. Sign up for a free trial today.