Killnet

Killnet appeared in early 2022, first as a denial-of-service-for-hire service, before presenting itself after the invasion of Ukraine as a pro-Russian patriotic collective. It claimed waves of attacks on public websites of countries supporting Ukraine: Lithuanian ministries and services in June 2022, after a restriction on transit to Kaliningrad, US airport websites in October 2022, US and European hospital websites in early 2023. These attacks made sites unreachable for a few hours, without reaching operational systems: planes flew and hospitals treated patients. The group mainly sought visibility, through announcements on messaging apps, symbolic targets and coordination with other pro-Russian collectives. Its links with the Russian state remain debated: it serves Russia's interests without public proof that it takes orders. For insurance, Killnet is the example of low-severity, high-frequency hacktivist risk, generating protection costs and short business interruptions rather than major losses. It also illustrates the characterization problem: if such a group acted on a state's instructions, would its attacks fall under a state-act exclusion, even though nothing proves it at the time of the loss?