The May attacks had been claimed on Telegram, in a public group. They had been brought forward by the Legion group - which is part of the larger Killnet network. Killnet also claimed responsibility for an attack on the State Police, which made his website unreachable for a few hours on May 16. After the attacks, Killnet had made a mockery of Italy, saying that they had been a mere "exercise" and anticipating that they were preparing an "offensive phase".
Other threats had arrived from hostile groups, which envisaged attacks on May 30, which then did not materialize. The hackers, again through Telegram, had complimented the CSIRT for the level of protection offered to the country's strategic infrastructures. “False Italian government, I advise you to raise the salary of this team by several thousand dollars. CSIRT Accept my respects gentlemen! ”, Read a message (in a slightly limping Italian) in the public group, reported by Open.
The message in Italian spread by Killnet
Killnet and the various groups related to it, including the Legion collective, are pro-Russian units aligned against NATO, which aim to attack the countries that have taken sides against the war in Ukraine. Poland, Germany and Romania also suffered attacks. The ddos (acronym for distributed denial of service) is a type of cyber attack that aims to disable a server by flooding it with requests.
Killnet's structure according to CyberKnow
Killnet operates according to one rather organized hierarchical scheme. Researchers from CyberKnow, an organization specializing in combating cyberattacks, published a post on Medium in which it identifies the main subgroups and the command and control lines.