Cyber Threat Actor: Devil Killer

Devil Killer is a threatactor known by the alias Devil Killer and has been publicly linked to operations originating from Pakistan. The actor’s identity emerged in open‑source reporting that described the perpetrators of a specific website defacement as Pakistani agents, establishing a clear attribution to a Pakistani‑based source in that incident. No further details about the actor’s organizational structure, size, or broader affiliations are available in the referenced material.

On October 24, 2021, Devil Killer compromised the official website of Sambalpur University in India, specifically targeting its grievance portal subdomain. The attackers replaced the legitimate page content with a message stating “hacked by Devil Killer,” which was observed when students attempted to access admission‑related functions. This defacement disrupted online services that supported postgraduate admissions, temporarily hindering academic administrative processes that relied on the affected web infrastructure. The incident was reported by a cybersecurity news outlet, which noted the disruption to the university’s online services as a direct consequence of the alteration.

The only publicly documented activity attributed to Devil Killer involves the defacement of an educational institution’s website, indicating a focus on the education sector within the Indian region. The strategic objective demonstrated in this case appears to be disruption through website alteration, as the attack aimed to impair the availability of the grievance portal and associated admission services. No information regarding specific malware families, initial access vectors, tooling styles, or broader campaign patterns is provided in the source material, so those aspects cannot be described. Consequently, the Sambalpur University defacement remains the sole representative operation that can be cited for this actor based on the currently available evidence.