Killnet, Kaliningrad, and Lithuania’s Transport Standoff With Russia

Killnet, Kaliningrad, and Lithuania’s Transport Standoff With Russia

Russian cyber collective Killnet has taken responsibility for today’s DDoS attacks on the Lithuanian government and private institutions. On its Telegram channel, the group claimed that it would stop the attacks as soon as the Lithuanian government reinstates transit routes with the Russian exclave of Kaliningrad.

The Lithuanian National Cyber Security Center told Reuters in a statement that it expects “attacks of a similar or greater intensity in the coming days especially in the transportation, energy and financial sectors.”

“The attack will continue until Lithuania lifts the blockade,” a spokesperson for the Killnet group told Reuters. “We have demolished 1652 web resources. And that’s just so far.”

Killnet and Russia

At the start of Russia’s invasion of Ukraine, the cyber collective Killnet declared their allegiance to the Russian government in the war. Killnet has been continuously posting alleged evidence of their DDoS attacks on Lithuanian entities onto their Telegram account, “WE ARE KILLNET,” which features attacks on infrastructure targets, such as airports, various prominent businesses, and government websites, including those belonging to Lithuania’s police departments, and its defense ministry. 

This development once again highlights the importance of Telegram as a communication channel for threat actors; Killnet uses its Telegram group not only to recruit new members but also to coordinate its attacks in real time.

On June 25, Flashpoint analysts observed chatter regarding a plan for a mass-coordinated attack to take place on June 27, which Killnet referred to as “judgment day.” Flashpoint analysts assess with high confidence that the attacks reported on today are the attacks Killnet had planned prior.  Smaller attacks have also been observed prior to June 27, including one that took place on June 22, according to our intelligence. Flashpoint analysts assess with high confidence that, based on ongoing chatter regarding Lithuania on Killnet-affiliated Telegram channels that took place over the last week, Killnet made Lithuania its target after the Baltic government closed transit routes to Russia’s Kaliningrad region on June 18.

Notably, in a post from June 26, 2022, Killnet labeled Lithuania a “testing ground for our new skills” and additionally said that their “friends from Conti” are eager to fight, likely pointing to a connection between Killnet and Conti, a ransomware collective that also expressed their allegiance to Russia at the beginning of the Russia’s invasion of Ukraine. 

Military implications

Flashpoint has identified chatter on various pro-Russian Telegram channels claiming that the current standoff between Russia and Lithuania could escalate to a full-fledged military confrontation, although no evidence of physical violence is yet to take place between Russia and Lithuania as of this publishing.

Lithuania is a Baltic state that was occupied by the Soviet Union from the end of World War II until the fall of the USSR in 1991. Lithuania is a member of the EU and NATO.

Belarusian President Lukashenko, who is closely allied with Vladimir Putin, on June 25 referred to the move as a “declaration of war.”

Lithuania doubles down on Kaliningrad closure

On June 18, the Lithuanian government announced that it would close routes between the Baltic country and Kaliningrad for transport of steel and other metals. The Lithuanian government justified the closure as a necessary requirement to fulfill the obligations of European Union sanctions against Russia.

These train routes, according to the Russian government, are essential in bringing in at least half of the exclave’s imports, prompting Russian officials to label the move as a “blockade” and warn of a harsh retaliation. 

Lithuanian President Gitanas Nauseda recently doubled down on his decision, according to a statement he posted to Facebook, calling Russia Ukraine’s “aggressor.”

“Lithuania must maintain and will maintain control of goods transported through its territory and there can be no talk of any ‘corridors’ as well as any thoughts of degrading Russia in response to Kremlin’s threats,” he said.