Serious question:
How do they know that? I assume killnet does not have a static IP address and doesn't leave it's return address
How do they know that? I assume killnet does not have a static IP address and doesn't leave it's return address
Killnet has claimed responsibility for similar attacks in the past [1]
The other identifying technique is correlation: if they’re using a network of hacked devices to create a flood of traffic, any previous attacks that saw traffic from those same devices are possibly from the same group. So it’s possible killnet has a public chronology here.
To my mind, the most likely explanation here is the simplest one: airport websites make good testing targets, and Russia doesn’t punish hackers who target non-military resources in the West.
Even then, using your own example: imagine you are testing a malicious system that you built that is hitting a public testing target. Wouldn't you want to link it to anyone other than yourself for when it is inevitably detected?
That said, the warnings about Russia interfering with US infrastructure were flowing a bit before the invasion of Ukraine. Russia would be the first suspect on the top of the list, even barring good threat intel.
They've also done similar attacks before so they were clearly under radar