Pro-Russian Hacker Group Disrupts U.S. Airport Websites in Coordinated DDoS Attack
A pro-Russian hacker group, Killnet, launched a series of distributed denial-of-service (DDoS) attacks against multiple U.S. airport websites early Monday, temporarily disrupting public-facing domains. The attacks, originating from within the Russian Federation, targeted over a dozen airports, including Los Angeles International (LAX), Chicago O’Hare, Denver International, and Des Moines International, by overwhelming sites with artificial traffic.
The disruptions began around 3 a.m. ET, when the Port Authority alerted the Cybersecurity and Infrastructure Security Agency (CISA) after LaGuardia Airport’s system was hit. While LaGuardia and Atlanta’s Hartsfield-Jackson Airport later restored service, Denver International reported ongoing attacks as of 11 a.m. ET, though operations remained unaffected. LAX confirmed its website was partially disrupted but restored by 1 p.m. ET, with no impact on internal systems or air traffic control.
A senior official described the attacks as an "inconvenience" rather than a critical threat, as they did not compromise air traffic control, airline communications, or security systems. Cybersecurity firm Mandiant attributed the attacks to Killnet, a group active since the Ukraine war and known for targeting Western allies. While Killnet has claimed responsibility for similar incidents, including recent U.S. government website outages, experts found no direct evidence of Russian state involvement.
The FBI and CISA acknowledged the attacks, and engineers are working to patch vulnerabilities and reinforce defenses. Senator Chuck Schumer (D-N.Y.) linked the cyberattacks to Russia’s retaliation for Ukraine’s recent strike on the Crimea Bridge, calling for a strong response.
Despite their visibility, DDoS attacks are typically short-lived and superficial, though they highlight ongoing cyber risks amid geopolitical tensions.
Source: https://abcnews.com/Technology/cyberattacks-reported-us-airports/story?id=91287965
LaGuardia Airport TPRM report: https://www.rankiteo.com/company/laguardia-gateway-partners
Denver International Airport TPRM report: https://www.rankiteo.com/company/city-&-county-of-denver---department-of-aviation
Hartsfield-Jackson Atlanta International Airport TPRM report: https://www.rankiteo.com/company/hartsfield-jackson-airport
Chicago O’Hare International Airport TPRM report: https://www.rankiteo.com/company/o’hare-international-airport
"id": "o’hcitlaghar1780439746",
"linkid": "o’hare-international-airport, city-&-county-of-denver---department-of-aviation, laguardia-gateway-partners, hartsfield-jackson-airport",
"type": "Cyber Attack",
"date": "2/2026",
"severity": "60",
"impact": "2",
"explanation": "Attack limited on finance or reputation"{'affected_entities': [{'industry': 'Transportation/Aviation',
'location': 'Los Angeles, California, USA',
'name': 'Los Angeles International Airport (LAX)',
'type': 'Airport'},
{'industry': 'Transportation/Aviation',
'location': 'Chicago, Illinois, USA',
'name': 'Chicago O’Hare International Airport',
'type': 'Airport'},
{'industry': 'Transportation/Aviation',
'location': 'Denver, Colorado, USA',
'name': 'Denver International Airport',
'type': 'Airport'},
{'industry': 'Transportation/Aviation',
'location': 'Des Moines, Iowa, USA',
'name': 'Des Moines International Airport',
'type': 'Airport'},
{'industry': 'Transportation/Aviation',
'location': 'New York, New York, USA',
'name': 'LaGuardia Airport',
'type': 'Airport'},
{'industry': 'Transportation/Aviation',
'location': 'Atlanta, Georgia, USA',
'name': 'Hartsfield-Jackson Atlanta International '
'Airport',
'type': 'Airport'}],
'attack_vector': 'Distributed Denial-of-Service (DDoS)',
'date_detected': '2023-10-10T03:00:00Z',
'date_publicly_disclosed': '2023-10-10',
'description': 'A pro-Russian hacker group, Killnet, launched a series of '
'distributed denial-of-service (DDoS) attacks against multiple '
'U.S. airport websites early Monday, temporarily disrupting '
'public-facing domains. The attacks targeted over a dozen '
'airports, including Los Angeles International (LAX), Chicago '
'O’Hare, Denver International, and Des Moines International, '
'by overwhelming sites with artificial traffic.',
'impact': {'brand_reputation_impact': 'Potential reputational harm due to '
'public disruption',
'downtime': 'Partial to full disruption (e.g., LaGuardia restored '
'by ~11 a.m. ET, LAX by 1 p.m. ET)',
'operational_impact': 'No impact on air traffic control, airline '
'communications, or security systems',
'systems_affected': 'Public-facing airport websites'},
'investigation_status': 'Ongoing (FBI and CISA involved)',
'lessons_learned': 'DDoS attacks, while disruptive, are typically short-lived '
'and superficial but highlight ongoing cyber risks amid '
'geopolitical tensions.',
'motivation': 'Geopolitical retaliation (linked to Ukraine war and Crimea '
'Bridge strike)',
'post_incident_analysis': {'corrective_actions': 'Patching vulnerabilities, '
'reinforcing DDoS defenses',
'root_causes': 'Geopolitical tensions, retaliation '
"for Ukraine's strike on Crimea "
'Bridge'},
'recommendations': 'Reinforce DDoS defenses, enhance monitoring, and prepare '
'for geopolitically motivated cyber threats.',
'references': [{'source': 'Cybersecurity and Infrastructure Security Agency '
'(CISA)'},
{'source': 'Mandiant'},
{'source': 'Senator Chuck Schumer (D-N.Y.)'}],
'response': {'containment_measures': 'Engineers working to patch '
'vulnerabilities and reinforce defenses',
'incident_response_plan_activated': 'Yes (Port Authority alerted '
'CISA)',
'law_enforcement_notified': 'FBI and CISA',
'recovery_measures': 'Websites restored (e.g., LaGuardia, LAX)',
'third_party_assistance': 'Mandiant (cybersecurity firm)'},
'threat_actor': 'Killnet',
'title': 'Pro-Russian Hacker Group Disrupts U.S. Airport Websites in '
'Coordinated DDoS Attack',
'type': 'DDoS'}