Pro-Russian group Killnet launched DDoS attacks on Romanian govt sites

Romanian energy supplier Electrica Group ransomware attack

A series of DDoS attacks launched by Russian hacktivists are targeting several Romanian government websites.

The Romanian national cyber security and incident response team, DNSC, warns of a series of distributed denial-of-service (DDoS) attacks targeting government websites. The attacks have started on April 29, 2022, at 04:00.

The attacks were allegedly launched by Pro-Russian group Killnet, below is the list of targeted websites:

gov.ro (Romania’s Government)
mapn.ro (Ministry of Defense)
politiadefrontiera.ro (Romanian Border Police)
cfrcalatori.ro (Romania’s National Railway Transport Company)
otpbank.ro (commercial bank operating in Romanian)

The website of the DNSC is currently unreachable, but it is not clear if it was hit by a DDoS attack too.

Other Romanian agencies are investigating the attacks, below is the statement published by the Romanian Intelligence Service.

“Following the investigations carried out by the CYBERINT National Center within the Romanian Intelligence Service, it was established that the cyber attackers used network equipment from outside Romania. The attackers took control of the equipment in question by exploiting cyber security vulnerabilities, respectively the lack of cyber security measures and used them as a vector of attack on sites in Romania.” reads the announcement published by the Romanian Intelligence Service.

The pro-Russian Eastern KILLNET group, who claimed the responsibility for the attacks, this month launched DDoS attacks on the sites of institutions in states such as the USA, Estonia, Poland, the Czech Republic, but also on NATO sites.

The DNSC shared indicators of compromise for these attacks and published guidelines to mitigate them.

This week, Ukraine ‘s computer emergency response team (CERT-UA) announced that it is investigating, along with the National Bank of Ukraine (CSIRT-NBU), ongoing DDoS (distributed denial of service) attacks targeting pro-Ukraine sites and the government web portal.

The attacks originated from compromised websites, most of them use the WordPress CMS. Threat actors planted a malicious JavaScript code, tracked as BrownFlood, in the web pages of the sites to generate the malicious traffic to a list of static URLs included in the JavaScript code.

Please vote for Security Affairs as the best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS
Vote for me in the sections “The Underdogs – Best Personal (non-commercial) Security Blog” and “The Tech Whizz – Best Technical Blog” and others of your choice.
To nominate, please visit: https://docs.google.com/forms/d/e/1FAIpQLSfxxrxICiMZ9QM9iiPuMQIC-IoM-NpQMOsFZnJXrBQRYJGCOw/viewform

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, KillNet)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.