Romanian Websites Down due to KillNet DDoS

The Romanian national cyber security and incident response team, warns of a series of distributed DDoS attacks targeting government websites. The attacks have started on April 29, 2022.

The attacks were allegedly launched by Pro-Russian group Killnet, below is the list of targeted websites:

• gov.ro (Romania’s Government)
• mapn.ro (Ministry of Defense)
• politiadefrontiera.ro (Romanian Border Police)
• cfrcalatori.ro (Romania’s National Railway Transport Company)
• otpbank.ro (commercial bank operating in Romanian) 

The website of the DNSC is currently unreachable, but it is not clear if it was hit by a DDoS attack. Romanian agencies are investigating the attacks, below is the statement published by the Romanian Intelligence Service.

Following the investigations carried out by the CYBERINT National Center within the Romanian Intelligence Service, it was established that the cyber attackers used network equipment from outside Romania. The attackers took control of the equipment in question by exploiting cyber security vulnerabilities, respectively the lack of cyber security measures and used them as a vector of attack on sites in Romania.

The pro-Russian Eastern KILLNET group, who claimed the responsibility for the attacks, this month launched DDoS attacks on the sites of institutions in states such as the USA, Estonia, Poland, the Czech Republic, but also on NATO sites.

The DNSC shared indicators of compromise for these attacks and published guidelines to mitigate them.