{ "id": "7387d8ae-fce9-43d6-bb64-81656c1b4a9b", "created_at": "2026-04-06T00:15:07.373104Z", "updated_at": "2026-04-10T13:11:56.492982Z", "deleted_at": null, "sha1_hash": "33b79568da8ca7e4747013d36190657d184030b9", "title": "Cyber Shadows Pact: Darknet Parliament (KillNet, Anonymous Sudan, REvil)", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 65223, "plain_text": "Cyber Shadows Pact: Darknet Parliament (KillNet, Anonymous\r\nSudan, REvil)\r\nPublished: 2023-06-20 · Archived: 2026-04-05 17:53:40 UTC\r\n1. Home\r\n2. Blog\r\n3. Dark Web\r\n4. Cyber Shadows Pact: Darknet Parliament (KillNet, Anonymous Sudan, REvil)\r\n[Update] June 22, 2023: KillNet and Anonymous Sudan targeted the International Finance Corporation.\r\nThe Darknet Parliament campaign has officially begun with an attack on a European financial institution. The\r\nKillNet hackers have listed the European Investment Bank (EIB) as one of their targets. This marks the\r\nbeginning of a series of anticipated future attacks.\r\nOn June 19, 2023, the hackers announced on their Telegram channel that they had “paralyzed” the inter-network\r\ninfrastructure of the European Investment Bank. As the main shareholder in the European Investment Fund (EIF),\r\nthe EIB provides funding to SMEs and serves as a state institution, providing loans for infrastructure projects in\r\nseveral European countries.\r\nDarknet Parliament attacks European Investment Bank\r\nThe European Investment Bank later confirmed the attack with a Twitter post, stating that the availability of their\r\nwebsite was affected.\r\nEIB’s statement on Twitter\r\nKillNet and Anonymous Sudan Disrupts International Finance Corporation’s Website\r\nKillNet announced on Telegram on June 21, 2023, that they had targeted the International Finance Corporation\r\n(IFC) website with Anonymous Sudan. The IFC is an international financial institution that is part of the World\r\nBank.\r\nKillNet stated in the post that the IFC website is no longer operational; Anonymous Sudan, the hacker group’s\r\nparliamentary colleague, followed by forwarding KillNet’s post on their own Telegram channel.\r\nKillNet and Anonymous Sudan post about International Finance Corporation (IFC) on Telegram\r\nHow Did Hackers Establish the Darknet Parliament?\r\nhttps://socradar.io/cyber-shadows-pact-darknet-parliament-killnet-anonymous-sudan-revil/\r\nPage 1 of 4\n\nDarknet Parliament, the term introduced by the notorious hacktivist group KillNet, has quickly gained traction,\r\nbecoming the latest buzzword in the cyber media. KillNet introduced the phrase in a Telegram post on June 16. \r\nIn the post, they outlined a plan to attack Europe’s banking system. They made the post in a government briefing\r\nreport format, with their decisions and solutions numbered, such as Decision No. 0191 and Solution No. 0191.\r\nThis indicates a possible inclination towards institutionalization or a shift to a more stringent hierarchical\r\nstructure.\r\nKillNet’s post about the Darknet Parliament\r\nAccording to KillNet’s statement, the leaders of three hacker groups have agreed to “impose sanctions” on the\r\ntargets. European and US banks, SWIFT, and the US Federal Reserve System, are among the targets.\r\nFinancial targets mentioned in the warning also include SEPA, IBAN, Wire money transfer service, and Wise, a\r\nmoney transfer company. \r\nKillNet’s warning before posting the Darknet Parliament “pact” is shown below:\r\nKillNet’s initial announcement before the Darknet Parliament post\r\nKey Threat Actors in Darknet Parliament\r\nKillnet, REvil, and Anonymous Sudan, three prominent pro-Russian threat actors, have joined forces for this\r\ncampaign; although not confirmed, the Darknet Parliament campaign targeting European financial institutions\r\ncould be orchestrated in response to European support for Ukraine.\r\nAnonymous Sudan shared the Darknet Parliament message on its own Telegram channel to confirm the planned\r\nattacks. The Darknet Parliament’s threat actors’ polls, which are shared across their Telegram channels,\r\nshowed SWIFT as the first target before EIB was hit on June 19. \r\nUserSec hacker group has also forwarded the messages, suggesting they may be involved in planned attacks. The\r\nUserSec group has previously collaborated with Killnet and Anonymous Sudan. \r\nKillNet Shifts Targets: What Is the Motive Behind the Darknet Parliament?\r\nDuring the ongoing conflict between Ukraine and Russia, KillNet, a pro-Russian hacktivist group, has emerged as\r\na significant cyber threat. Killnet actively engages in cyber warfare by launching DDoS attacks against countries\r\nthat support Ukraine, with a particular emphasis on NATO countries.\r\nSince its transformation into a hacktivist group in February 2022, Killnet has targeted various sectors and\r\ncountries. Their attacks have impacted government organizations, ministries, as well as industries such as aviation,\r\ndefense, and healthcare. The scope of their targets extends to European and Western countries, including the\r\nUS, UK, Germany, Italy, Romania, Lithuania, Estonia, and Poland. \r\nAlthough they have carried out attacks against Ukraine, KillNet’s focus extends beyond the conflict, as they\r\nactively support Russian geopolitical interests on a global scale. Their primary objective has been to disrupt web\r\nhttps://socradar.io/cyber-shadows-pact-darknet-parliament-killnet-anonymous-sudan-revil/\r\nPage 2 of 4\n\nservices and cause harm to their targets rather than pursue financial gain. Thus, the hacktivist group’s recent focus\r\non financial organizations suggests a possible alignment with their broader agenda.\r\nThe Darknet Parliament threat actors are most likely seeking vengeance by imposing their own sanctions on\r\nEuropean financial organizations in response to the sanctions imposed by Western financial institutions on\r\nRussia. Western nations have been taking measures to restrict Russia’s access to funds, such as freezing assets of\r\nRussia’s central bank in their respective countries. Major Russian banks have also been excluded from the\r\ninternational financial messaging system SWIFT, resulting in delayed payments for Russian oil and gas.\r\nAnonymous Sudan Joins the Darknet Parliament \r\nKillNet-affiliated Anonymous Sudan, a politically and religiously motivated hacker group from Sudan, has been\r\nconducting DDoS attacks on various countries and critical infrastructure since January 23, 2023. Original\r\nAnonymous Sudan emerged in response to political and economic challenges, utilizing hacking and DDoS\r\nattacks for digital activism, highlighting government-imposed censorship and restrictions on free speech.\r\nNotably, the group has shown persistent support for Russian hacktivism, emphasizing the reciprocal support\r\nbetween Sudanese and Russian hackers.\r\nUnmasking the Role of REvil Ransomware\r\nREvil, also known as Sodinokibi, is a highly active ransomware group driven by financial motives. Established in\r\n2019 and believed to operate from Russia, REvil has gained notoriety for its involvement in prominent attacks,\r\nsuch as the Kaseya incident.\r\nVx-underground on Twitter has shared a video released by REvil, which sheds light on the collaboration\r\nbetween REvil and KillNet as they target the European banking system. In the video, REvil emphasizes they\r\nare “sufficiently familiar” with the European financial infrastructure. \r\nhttps://twitter.com/vxunderground/status/1669053086495563777\r\nDiscover the Latest Campaigns with SOCRadar\r\nDiscover the latest campaigns conducted by threat actors with diverse motivations by visiting SOCRadar’s\r\ndedicated campaign page. The SOCRadar Labs Campaigns page provides up-to-date information on the latest\r\ncampaigns carried out by threat actors, allowing you to track the timeline, associated threat actors, and indicators\r\nof compromise (IoC) for each campaign.\r\nSOCRadar Labs Campaigns\r\nWith SOCRadar’s Threat Actor Tracking, organizations can effectively track and analyze the activities of threat\r\nactors, including KillNet, REvil, and Anonymous Sudan, engaged in the Darknet Parliament, among numerous\r\nother threats. SOCRadar’s comprehensive platform provides real-time updates and actionable intelligence on all\r\nmonitored threat actors, enabling proactive defense measures. \r\nKillNet’s Threat Actor Profile on SOCRadar\r\nhttps://socradar.io/cyber-shadows-pact-darknet-parliament-killnet-anonymous-sudan-revil/\r\nPage 3 of 4\n\nSource: https://socradar.io/cyber-shadows-pact-darknet-parliament-killnet-anonymous-sudan-revil/\r\nhttps://socradar.io/cyber-shadows-pact-darknet-parliament-killnet-anonymous-sudan-revil/\r\nPage 4 of 4", "extraction_quality": 1, "language": "EN", "sources": [ "MISPGALAXY", "Malpedia" ], "origins": [ "web" ], "references": [ "https://socradar.io/cyber-shadows-pact-darknet-parliament-killnet-anonymous-sudan-revil/" ], "report_names": [ "cyber-shadows-pact-darknet-parliament-killnet-anonymous-sudan-revil" ], "threat_actors": [ { "id": "e53fc09e-24cc-40d4-b38d-7e2d6dbe81d8", "created_at": "2023-03-17T02:01:50.851615Z", "updated_at": "2026-04-10T02:00:03.362605Z", "deleted_at": null, "main_name": "Anonymous Sudan", "aliases": [], "source_name": "MISPGALAXY:Anonymous Sudan", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "a3917c91-ec7d-485f-8784-bfb1b1a78359", "created_at": "2023-11-08T02:00:07.13872Z", "updated_at": "2026-04-10T02:00:03.424164Z", "deleted_at": null, "main_name": "UserSec", "aliases": [], "source_name": "MISPGALAXY:UserSec", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "b4a6d558-3cba-499c-b58a-f15d65b7a604", "created_at": "2023-01-06T13:46:39.346924Z", "updated_at": "2026-04-10T02:00:03.295317Z", "deleted_at": null, "main_name": "Killnet", "aliases": [], "source_name": "MISPGALAXY:Killnet", "tools": [], "source_id": "MISPGALAXY", "reports": null } ], "ts_created_at": 1775434507, "ts_updated_at": 1775826716, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/33b79568da8ca7e4747013d36190657d184030b9.pdf", "text": "https://archive.orkl.eu/33b79568da8ca7e4747013d36190657d184030b9.txt", "img": "https://archive.orkl.eu/33b79568da8ca7e4747013d36190657d184030b9.jpg" } }