Russian hackers disrupt Turkey-Syria earthquake relief

Russian hackers have disrupted contact between Nato and military aircraft providing aid to victims of the Turkish-Syrian earthquake which has claimed at least 28,000 lives.

A Nato official confirmed that the alliance had fallen victim to a cyber attack, which is believed to have been carried out by the Killnet group of hackers.

The Killnet group of hackers claimed responsibility for the distributed denial of service (DDoS) attacks but didn’t give any more details.

“We are carrying out strikes on Nato. Details in a closed channel,” it said on one of its associate Telegram channels.

The website of Nato Special Operations Headquarters, which is based in Belgium, was down for only a couple of hours before it was restored.

Other organisations affected by the attack included the  Strategic Airlift Capability.

It is a multi-national organisation which relies on Nato support in its task of providing military and humanitarian airlifts.

In February last year the organisation delivered supplies to the Ukrainian army.

Most, but not all member states are Nato members.

SAC aircraft have been used for a variety of missions since 2009 including the evacuation of nearly 3,000 civilians from Kabul after the Taliban took control of the country.

It is currently being used to transport search and rescue equipment to the earthquake-stricken area.

One of the organisation’s C-17 aircraft, which was believed to be flying supplies to the  Incirlik Air Base in southern Turkey, was warned of the disruption in a message from a SAC manager via the ACARS (Aircraft Communications Addressing and Reporting System) network.

The aircraft was told that  Nato’s NR network – which is believed to be used for transmitting sensitive data – had been hit by the denial of service attack.

Although contact with the aircraft was not lost, the hackers’ attack is likely to have hampered the relief efforts.

Confirming the hackers’ attack the Nato official said: “NATO cyber experts are actively addressing an incident affecting some NATO websites. NATO deals with cyber incidents on a regular basis, and takes cyber security very seriously.”

Western security agencies have described Killnet as a loose group of pro-Kremlin activists who aim to disrupt military and government websites of countries that support Ukraine with fairly basic DDoS attacks.

The attacks usually cause outages of several hours and no significant lasting damage although cyber security experts have said that the group may be pacing itself and keeping its more sophisticated attacks in reserve.

Russia is regarded as a hotbed of talented hackers and security officials in the West have said that they have prioritised dealing with the risk.

In May last year, British police arrested a Killnet member in London. In response, Killnet threatened to disable ventilators in British hospitals if the police didn’t release the unnamed person.

In January, Killnet was blamed for taking down the websites of 14 US hospitals, although US officials said that the impact was limited and that no unauthorised entries into hospitals’ cyber architecture were detected.

In March 2022, shortly after the Kremlin invaded Ukraine, Killnet released a video of a hooded figure with a distorted voice urging Russians not to flee the country but instead to support the Motherland.

Killnet has clashed in cyberspace with the pro-Western hacker collective Anonymous which has attacked various Russian targets. Killnet has previously claimed to have taken down the Anonymous server.