‘Black Skills’ Is Killnet’s Attempt to Form a ‘Private Military Hacking Company’

About ‘Black Skills’

On March 13, 2023, Killmilk, the leader of the Russian hacktivist DDoS collective Killnet, announced on Telegram the establishment of “Black Skills,” a Private Military Hacking Company. 

The name “Private Military Hacking Company” is a clear riff on the growing presence and cult of private military companies in Russia (primarily the Wagner Group). It is also likely a not-so-subtle invitation to the Russian government to use Killnet’s resources as a cyber mercenary group, although it’s also unlikely they will deeply vet their clientele. 

This comes just weeks after the setup of “Black Listing”—a Telegram-based DDoS-for-pay service targeting darknet marketplaces that was officially set up by Deanon Club, Killnet’s partners, but which Killnet also supports.

Solidifying its illicit identity

Black Skills / Black Listing appear to be an attempt from Killnet to establish itself as a corporate identity. According to our intelligence, the new group will be organized and structured, with subgroups taking care of payroll, public relations and technical support, pen testing, as well as data collection, analysis, information operations and hits against priority targets. 

Killnet seems to have concluded that earlier attempts at scaling its operations didn’t work out. Activity on the “Infinity” forum created as a conduit between hacktivists and cybercriminals at the end of 2022 tanked, prompting its founders to put up the forum for sale. Its “school of hackers” failed to take off.

In this new project, Killnet requires every applicant to fill in a formal questionnaire detailing, among other things, their skills, as well as whether they have served in the army or as public servants. 

It is unclear at this point whether this is going to be a complete rebranding/replacement of Killnet’s de facto umbrella organization for pro-Kremlin hacktivist groups, or just an attempt to capitalize on their gains over the last year and turn themselves into a more efficient organization (e.g. by separating more skilled members from the rest by putting them into different subgroups that have varying levels of access to information). 

Much of the claims that they have made about the 24 “departments” could just exist on paper. What seems obvious is that they are trying to make its skills more easily monetizable: an “investment” subgroup, for example, is tasked with finding and negotiating with sources of funding.  

Generally speaking, Killnet remains frowned upon on top-tier forums, where they are seen as a collection of boastful, low-sophistication threat actors whose bark is often bigger than its bite.

Some users of top-tier forums have also criticized the group for seeking cooperation with the Russian security services, for encouraging doxing campaigns, and not doing anything against members of Infinity who targeted or shared data belonging to Russian organizations. 

Keep a close eye on illicit communities with Flashpoint

Flashpoint provide teams with access to illicit online communities, including closed sources across forums, the open web and chat services platforms, as well as indicators of compromise (IOCs), and technical data as analyzed by our expert intelligence analysts. Having spent years operating within illicit communities, we understand the data to collect, have the agility to move collections capabilities to go where adversaries go, and can rapidly analyze, refine, and contextualize that data to produce valuable insights. Sign up for a free trial today.