SkyNet

Summary

SkyNet, a St. Petersburg internet provider, said a DDoS attack had disrupted its network since October 6, 2026, affecting gaming, voice calls, video conferencing, and customer connectivity for several days. BO Team, also known as Black Owl, claimed responsibility and said it disabled more than 15,000 devices, though SkyNet did not confirm that claim.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

SkyNet, an internet provider operating in St. Petersburg since 2003, experienced a major network outage in mid-September before the October disruption described in the incident. The company attributed that earlier outage to a technical failure, while customers reported connectivity problems lasting several days. On September 14, the BO Team hacking group, also known as Black Owl, claimed responsibility for an attack on SkyNet. The relationship between that claim and the mid-September outage was not established, and SkyNet did not confirm that the earlier disruption was part of the group’s claimed activity. BO Team emerged in early 2024 and had previously claimed attacks on Russian telecommunications providers, including Vega-Internet, Kraft-S, SimStar and Orion Telecom.

BO Team claimed another attack against SkyNet on October 5. According to SkyNet, a distributed denial-of-service attack disrupted its network beginning on October 6. The provider disclosed the continuing effects of the attack in a statement on October 9, saying that the disruption had already lasted for days. The affected services included online gaming, voice calls and video conferencing. Customers could also experience slow connections, high latency and interruptions to audio and video services as SkyNet attempted to mitigate the attack. The company did not provide an estimate for when normal operations would resume.

Connectivity complaints continued after the company’s public statement. On October 13, customers were still reporting problems through Detector404, a Russian internet outage monitoring service. Reported symptoms included failures of fiber-optic internet connections, Wi-Fi connectivity failures and high connection latency. These reports showed that the disruption was still affecting users several days after SkyNet said the DDoS attack had begun and while mitigation work was underway. SkyNet’s public response focused on mitigating the attack and restoring affected network services, while no detailed account of its internal detection, containment or recovery measures was disclosed.

BO Team said it had disabled more than 15,000 network devices at SkyNet and warned that a quick recovery would not be possible. The group also published screenshots that purportedly demonstrated access to SkyNet’s internal systems. SkyNet had not confirmed the hackers’ claims about disabled equipment or unauthorized access to its systems. The available accounts therefore confirmed a prolonged DDoS-related service disruption, but did not verify the claimed device count or the extent of any intrusion into SkyNet infrastructure.

BO Team described its operation against SkyNet as retaliation for Russian strikes on Ukrainian data centers. The group also referred to Moscow’s use of the term “digital detox” in connection with those strikes. Those statements represented the group’s stated rationale and were not independently substantiated in the incident reporting. SkyNet’s confirmed operational effects remained concentrated on network availability and service performance, including internet access, gaming, voice calls, video conferencing and audiovisual services.

The incident occurred against a broader pattern of activity attributed to BO Team. Kaspersky reported that the group had expanded beyond disruptive attacks into cyber espionage and more covert intrusions, with researchers identifying 20 targeted organizations in the first quarter of 2026. Kaspersky said the group increasingly focused on manufacturing, telecommunications and oil and gas companies, while researchers described targeted phishing emails with malicious attachments as a typical initial-access method and backdoors and other malware as means of maintaining access to compromised networks. The reporting did not establish that these methods were used in the SkyNet incident. By October 13, SkyNet’s DDoS disruption was still causing customer connectivity failures and degraded service, and the company had not announced a date for full restoration.

Sources

Sources available to members: 1 source.