Russian cybercollective Killnet dropped evidence of possible collaboration with ransomware gang Conti in its hacking campaign against Lithuania on a Telegram channel, security company Flashpoint reports. Credit: 2AlexD / Getty Images Cyberattacks on the Lithuanian government and private institutions conducted by the Russian cybercollective Killnet, and the group’s possible collaboration with the Conti hacking gang, were shared on the Telegram messaging service ahead of a major DDoS (distributed denial of service) attack Monday, according to cybersecurity company Flashpoint.Multiple attacks on Lithuanian entities have been claimed by Killnet on its Telegram channel “WE ARE KILLNET,” in response to Lithuania’s June 18 restrictions of trade routes with Russia.A Flashpoint blog post confirms that Killnet warned about the attacks on the Telegram channel, highlighting the cloud-based instant messaging platform’s use as a popular communication channel for threat actors.In keeping with the UN’s sanctions on Russia for its invasion of Ukraine in February 2022, the Lithuanian government put restrictions on trade routes between the Baltic country and the Russian exclave Kaliningrad—a Russian territory situated between Lithuania and Poland on the Baltic coast—for the transport of steel and other metals. The train routes used for trade, according to the Russian government, are essential for at least half of the exclave’s imports, prompting Russian officials to label the move a “blockade.” The restricted train transit entails bans over goods including coal, steel, metal, construction materials, and advanced technology.DDoS attacks hit Lithuania infrastructure targetsKillnet had declared their allegiance to the Russian government during the invasion of Ukraine. To that end, it launched a retribution campaign against Lithuania for its sanctions, featuring several DDoS attacks on infrastructure targets, such as airports, various prominent businesses, and government websites, including those belonging to Lithuania’s police departments, and its defense ministry, according to Flashpoint. DDoS attacks are malicious attempts to temporarily or indefinitely disrupt the traffic of a targeted server, service, or network, making the resources unavailable to the intended users.Killnet sent Reuters a statement saying that, “The attack will continue until Lithuania lifts the blockade,” adding that it has “demolished 1652 web resources. And that’s just so far.”The Lithuanian National Cyber Security Center told Reuters that it expects “attacks of a similar or greater intensity in the coming days, especially in the transportation, energy and financial sectors.”Flashpoint revealed that it had identified chatter on various pro-Russian Telegram channels claiming that the “current standoff between Russia and Lithuania could escalate to a full-fledged military confrontation.” Flashpoint added that it has not seen any evidence yet pointing to actual physical violence as a result of planning on Telegram.Killnet Telegram communications include a chat on June 25 regarding a plan for a mass coordinated attack on June 27, which Killnet referred to as “Judgment Day.” Additional smaller attacks were also observed by Flashpoint analysts, including one that took place on June 22.Additionally, Flashpoint’s analysts have identified a post from June 26, wherein Killnet labeled Lithuania a “testing ground for our new skills” and added that their “friends from Conti” are eager to fight, hinting at a collaborative effort between Killnet and another Russia-based ransomware gang Conti. Conti, too, had expressed their allegiance to Russia at the beginning of the Russian invasion of Ukraine. Related content news Okta confirms recent hack affected all customers within the affected system Contrary to its earlier analysis, Okta has confirmed that all of its customer support system users are affected by the recent security incident. By Shweta Sharma Nov 30, 2023 3 mins Data Breach Cyberattacks Cybercrime news Top cybersecurity product news of the week New product and service announcements from Wiz, Palo Alto Networks, Sophos, SecureAuth, Kasada, Lacework, Cycode, and more. By CSO staff Nov 30, 2023 17 mins Generative AI Security feature How to maintain a solid cybersecurity posture during a natural disaster Fire, flood, eathquake, hurricane, tornado: natural disasters are becoming more prevalent and they’re a threat to cybersecurity that isn’t always on a company’s radar. Here are some ways to prepare for the worst. By James Careless Nov 30, 2023 8 mins Security Operations Center Data and Information Security Security Practices news analysis Attackers could abuse Google's SSO integration with Windows for lateral movement Compromised Windows systems can enable attackers to gain access to Google Workspace and Google Cloud by stealing access tokens and plaintext passwords. By Lucian Constantin Nov 30, 2023 8 mins Multi-factor Authentication Single Sign-on Remote Access Security Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe