Draft:Server Killers

• Comment: None of the sources have dates and few have names. No inline cites. See WP:BACKWARD. guninvalid (talk) 08:53, 29 August 2026 (UTC)

---

Server Killers

Server Killers
Founded	August 2023
Affiliation	State-aligned Hacktivists
Type	Hacker group, cyberwarfare organization
Purpose	Pro-Russia DDoS and cyberattacks
Remarks	Linked to attacks on critical infrastructure
Telegram	https://t.me/ServerKillersRus

Server Killers is a pro-Russian hacker group that has been active since 2023. Server Killers primarily targets government and public-sector websites and online services, particularly in European countries that support Ukraine or have adopted policies opposed to Russian interests. Reported targets have included government ministries, law-enforcement agencies, public administration, airports and other publicly accessible infrastructure. For example, in February 2026, Server Killers and NoName057(16) claimed coordinated DDoS attacks against Spanish government websites, primarily ministries and security forces. In 2025, the Server Killers group is said to be part of Killnet.

The group is predominantly associated with distributed denial-of-service (DDoS) attacks. Its activities have also included attacks against Ukrainian airports and other Ukrainian infrastructure, as well as targets in Italy, Poland, Romania, the United Kingdom and other European countries.

Targets and motives

Server Killers describes its operations as politically motivated hacktivism and has publicly linked some campaigns to Western military and political support for Ukraine. In August 2026, for example, the group claimed responsibility for DDoS attacks against Norwegian public digital services and described the campaign as retaliation for Norway's continued support for Ukraine. The Norwegian authorities confirmed the disruption.

Attacks

Romania

In April 2024 and July 2026, Server Killers participated in cyberattacks against the Romanian government. They targeted critical government infrastructure in Romania, including the main government portal, the Ministry of Internal Affairs, the President’s Office, the Senate of Romania, the Ministry of Foreign Affairs, Romanian airports, banks such as Banca Transilvania, and Romanian cybersecurity agencies.

Moldova

In March 2024, Server Killers group announced that they've joint cyber attack on the Moldova government with NoName057(16) and Cyber Army of Russia Reborn, ZulikGroup. They're targeted many Molodova government and electric suppliers websites. Also targeted Central Bank of Moldova.

Czech Republic

Hackers targeted the websites of the Czech Interior Ministry and the police force on Thursday afternoon, rendering them inaccessible for about an hour due to reported overload. Ministry spokesperson Ondřej Krátoška said experts are investigating the source of the attack, which is believed to have come from the Russian hacking group Server Killers.

Italy

In January 2025, Server Killers claimed to have targeted several Italian healthcare organizations, including Policlinico Tor Vergata, Salvator Mundi International Hospital, the Agostino Gemelli University Hospital Foundation IRCCS, the European Institute of Oncology, Hospital Physiotherapy Institutes, and University of Pittsburgh Medical Center Italy.

In November 2025, Server Killers reportedly targeted several Italian airport websites, including those operated by SOGAER S.p.A., Milan Bergamo Airport, Bologna Guglielmo Marconi Airport, Naples Capodichino Airport, Palermo Falcone e Borsellino Airport, Aeroporti di Puglia, Trieste Airport, and Turin Caselle Airport

Lithuania

In April 2025, Server Killers targeted Lithuania's financial sector, including several banks and other financial institutions. The attacks formed part of a broader campaign against Lithuanian organizations and financial infrastructure, with the group claiming responsibility for disrupting the online services of targeted institutions.

Norway

On 24 August 2026, Server Killers claimed responsibility for a large-scale distributed denial-of-service (DDoS) attack targeting the infrastructure of Norway's Digitalisation Directorate (Digdir). The attack disrupted several shared government digital services, including ID-porten, MinID, Altinn and eInnsyn. The attack continued for several days and was described by Digdir as the largest attack against its solutions to date. Digdir reported no evidence of a security breach or compromise of personal data.

On 26 August, Server Killers claimed responsibility for the attack and declared a “cyberwar” against Norway. The group said the operation was motivated by Norway's continued support for Ukraine, particularly a new Norway–Ukraine defence and security cooperation agreement signed on 23 August 2026 and support provided through the Nansen Programme.

Germany

In 2025 summer the group claimed to have targeted multiple Germany government and public-sector websites in a series of DDoS attacks. The claimed targets included the Federal Ministry of Labour and Social Affairs, German Air Force, Federal Police, City of Bonn, City of Bremerhaven, Ruhr Regional Association, State Government of Brandenburg, WestfalenBahn GmbH, and Start Niedersachsen Mitte. The group described the attacks as DDoS operations. German authorities have previously documented repeated DDoS campaigns by pro-Russian hacktivist groups against government, police and other public-sector websites.

Belgium

On November 7, Server Killers claimed responsibility for DDoS attacks targeting Belgian public-sector websites, including websites associated with the General Intelligence and Security Service of the Ministry of Defence (SGRS/ADIV). The Belgian Centre for Cybersecurity later reported that Server Killers and other pro-Russian hacktivist groups had claimed DDoS attacks against Belgian entities, predominantly in the public sector.

On December 15, websites of several Belgian energy suppliers, such as Eneco, Mega (energy supplier) and Luminus were attacked by the hacker group. Belgium Defense Minister Theo Francken confirmed the attack.

Canada

In October 2025, Server Killers launched cyber attack to the Canadian Government insitutions, including Canadian Armed Forces, Canadian Centre for Cybersecurity, Parliament of Canada, House of Commons, Royal Mounted Police of Canada.

Denmark

In November 2025, Server Killers claimed to have targeted multiple Danish websites in distributed denial-of-service (DDoS) attacks. The claimed targets included Aalborg Airport, Herning Airport, Midtjyllands Airport, Hans Christian Andersen Airport, Sønderborg Airport, Aarhus Airport, Stauning Vestjylland Airport, and Billund Airport.

The group also claimed attacks against Danish government and defence-related websites, including the Government of Denmark, Folketing (Parliament), Prime Minister's Office, Ministry of Finance, Minister of Defence (Denmark), Danish Police, Danish Security and Intelligence Service (PET), Danish Agency for Digital Government, Technical University of Denmark, Danish Defence, Defence Intelligence Service (FE), Ministry of Defence Acquisition and Logistics Organisation, Royal Danish Defence College, and Personnel Command.

The claims occurred amid a broader wave of DDoS attacks against Danish public-sector and political websites in November 2025. Danish authorities confirmed that multiple Danish websites experienced DDoS-related outages.

Finland

In December 2025, Server Killers claimed to have targeted multiple Finnish energy-sector websites in distributed denial-of-service (DDoS) attacks. The claimed targets included Helen, Oulu Energy Group, Energiequelle, Porvoon Energia Oy, Finnish Energy, Taaleri Energia, Energiapolar Oy, KSS Energia Oy, and Kuopion Vesi Oy. The claims formed part of a wider series of DDoS activity against Finnish organizations attributed to or claimed by pro-Russian hacktivist groups.

France

Server Killers claimed to have targeted multiple French websites in distributed denial-of-service (DDoS) attacks. The claimed targets included Lyon Airports, Marseille Provence Airport, Rennes–Bretagne Airport, Aéroport de Lille, Société Aéroport de Strasbourg-Entzheim, Caen–Carpiquet Airport, Bergerac Dordogne Périgord Airport, Toulon–Hyères Airport, and Rouen Seine Valley Airport.

The group also stated that it was targeting the University of Montpellier and Paris City University. These claims were presented by the group as part of its DDoS activity against French organizations.

Poland

Server Killers claimed to have conducted distributed denial-of-service (DDoS) attacks against multiple Polish government, infrastructure and public-service websites. The claimed targets included the Electronic Documents Archive of Poland, National Information Centre for REACH and CLP, Firearms Registration System of Poland, Polish Gas Company, Agricultural Social Insurance Fund, Polish State Railways (PKP), PKP Intercity, and railway timetable services.

The group also claimed to have targeted multiple Polish airports and aviation organizations, including Krosno Airport, Aeroclub of Białystok, Katowice Airport, Opole Airport, Warsaw Modlin Airport, Olsztyn–Mazury Airport, and Poznań Airport.

Taiwan

Server Killers claimed to have targeted multiple airport and aviation-related websites in Taiwan in distributed denial-of-service (DDoS) attacks. The claimed targets included Air Navigation and Weather Services, Taitung Airport, Taipei Songshan Airport, and Taiwan Taoyuan International Airport.

Kosovo

In April-May 2025, several Kosovo government websites were targeted by distributed denial-of-service (DDoS) attacks. The attacks were claimed by the pro-Russian hacktivist group Server Killers, which stated that the operation was conducted in response to statements supporting Ukraine made by Kosovo's Minister of Defence, Ejup Maqedonci, at an international defence conference in Poland. The Kosovo government confirmed that several government websites had been temporarily disrupted by DDoS attacks, but stated that there was no impact on data and that the affected websites were restored.

Server Killers subsequently claimed to have targeted additional Kosovo government and public-sector websites. Its claimed targets included the Ministry of Justice, Ministry of Internal Affairs, Ministry of Health, Ministry of Industry, Entrepreneurship and Trade, Ministry of Economy, Ministry of Education, Science, Technology and Innovation, Kosovo Police-related services, KOS-CERT, the President's Office, Prime Minister's Office, Assembly of Kosovo, eKosova, Kosovo Judicial Council, Independent Oversight Council for the Kosovo Civil Service, Emergency Management Agency, National Institute of Public Health of Kosovo, Kosovo Chamber of Mediators, Kosovo Centre for Security Studies, Limak Kosovo International Airport, Spitali Royal Medical, and American Hospital Kosova.

Ukraine

On 17 February 2025, Server Killers, NoName057(16), UserSec, French Hackers Squad and Digital Revolt claimed to have launched a large-scale cyberattack targeting Ukrainian aviation infrastructure. The claimed targets included Odesa International Airport, Kherson International Airport, Lviv Danylo Halytskyi International Airport, Mykolaiv International Airport, Zaporizhzhia International Airport, Kyiv International Airport, Ivano-Frankivsk International Airport, and Kharkiv Airport.

On 9 January 2026, Server Killers separately claimed to have targeted several Ukrainian financial institutions. The claimed targets included Globus Bank, CRYSTALBANK, JSCB Industrial Bank, Unex Bank, MTB Bank, and Accord Bank.

Luxembourg

Server Killers, together with NoName057(16), People's CyberArmy, 22С, NIGHTMARE, CyberDragon and UserSec, claimed to have conducted a coordinated cyberattack campaign against Luxembourg in response to the country's support for Ukraine and participation in the Czech-led initiative to procure ammunition for Ukraine.

The claimed targets included the Luxembourg Cybersecurity Center, University of Luxembourg, and the European Procurement Coordination Office (EPCO). The groups characterized the campaign as retaliation against the Luxembourg government for its political and military support for Ukraine.

North Macedonia

Server Killers claimed to have launched coordinated cyberattacks against North Macedonian government, financial, transport, energy and aviation infrastructure, including the Government, Parliament, Stopanska Banka, Skopje International Airport, Ohrid International Airport, and multiple ministries and public agencies. The group cited North Macedonia's military support for Ukraine and sanctions against Russia as the stated motives.

Israel

Server Killers claimed to have conducted cyberattacks against multiple Israeli government, financial, transportation and healthcare organizations. The claimed targets included Mossad, the Israel Securities Authority, the Israel National Cyber Directorate, Israel Airports Authority, and several major hospitals and medical centers. The attacks were part of the group's broader campaign against Israeli infrastructure.

Austria

The pro-Russian hacktivist group claimed to have joined an attack by NoName057(16) against Austrian government and aviation infrastructure. The claimed targets included Austrian federal and administrative services, the Ministry of Migration, Innsbruck Airport, Salzburg Airport, Linz Airport, Graz Airport, and Klagenfurt Airport.

South Korea

In September 2024, the group claimed to have gained unauthorized access to more than 100 internet-connected cameras in South Korea, including cameras located in cafés, restaurants, residences, computer rooms, car parks, offices, supermarkets and public streets, particularly in Seoul, Incheon, Daejeon and Suwon.

In April 2026, Server Killers and NoName057(16) claimed to have targeted South Korean government and public digital infrastructure. The claimed targets included the Government of South Korea, Ministry of the Interior and Safety, Ministry of Education, e-government services, Public Data Portal, Government Service Portal, and Immigration Policy Service.

India

In summer 2024, Server Killers claimed to have targeted the websites of India's National Investigation Agency (NIA) and Bank of India in cyberattacks. The group reported that the NIA attack lasted approximately 12 hours, while the Bank of India attack lasted approximately two hours. Server Killers stated that the attacks were conducted in response to what it described as insults to Islam and India's support for Israel.

New Zealand

In mid-June 2025, Server Killers announced a campaign against New Zealand organisations, citing the New Zealand government's support for Ukraine as its stated motive. On 19 June, the group claimed to have disrupted the websites of eight New Zealand airports, including Auckland, Christchurch and Queenstown airports. The group had previously identified government and defence-related organisations as potential targets, including the Ministry of Foreign Affairs and Trade, Ministry of Transport, New Zealand Defence Force, Civil Aviation Authority, and the government portal.

United Arab Emirates (UAE)

The pro-Russian hacktivist group claimed to have targeted the websites of the Emirates National Oil Company (ENOC) and the Central Bank of the United Arab Emirates. Both websites were reportedly inaccessible at the time of the claims. The group stated that the attacks were conducted in response to the United Arab Emirates support for Israel.

United Kingdom

Server Killers claimed to have targeted multiple British government and public-sector websites in cyberattacks. The claimed targets included the Ministry of Defence, Ministry of Justice, Security Service (MI5), Maritime and Coastguard Agency, Air Accidents Investigation Branch, Northern Ireland Assembly Commission, Association of Greater Manchester Authorities, and several local authorities, including Blackburn with Darwen, Ealing, Neath Port Talbot, Tameside, Tonbridge and Malling, Suffolk Coastal, and Adur and Worthing councils.

The group also claimed attacks against other UK public-sector organisations as part of its broader campaign against government infrastructure.

United States

Server Killers claimed to have targeted multiple US organizations and websites in cyberattacks. The reported targets included the Maryland Aviation Administration, as well as Energy East Corp, a natural gas utility company, and AUL Corp, a vehicle service company. The reported activity included attacks against aviation, energy and transportation-related organizations.