United States Airports Targeted by Russian-Allied Threat Actors

Killnet threat actors have once again launched a massive, distributed denial-of-service (DDoS) attack against several United States airport websites. Killnet has been one of the most active threat organizations throughout the Russia-Ukraine conflict and continues to make their presence known against their enemies, including the United States. Security analysts at Raidware tracked several outages from this DDoS attack which targeted 24 total airport websites. Phoenix Sky Harbor Airport (PHX), Los Angeles International (LAX), Atlanta International (ATL), and Chicago air travel site “flychicago[.]com” were among the victims to be affected. Killnet actors boasted about the attacks in their Telegram channel shortly after a CNN article was posted about the DDoS incidents. The attacks caused no lasting damage to any of the affected sites; however, cybersecurity experts highlighted that Killnet’s primary motivation is notoriety, as opposed to the actual damage. This is not the first time Killnet has explicitly targeted the United States. In previous months the United States Congress homepage, tax-related websites, and state government websites were also victims of Killnet DDoS attacks. While the Russia-Ukraine conflict continues to grow, cyber-attacks continue to target both sides in parallel. CTIX analysts will continue to monitor threat actor activity across the landscape and will provide additional updates accordingly.