Loading threat actor…
The Norwegian Defence League (NDL) is a Norwegian far-right anti-Muslim movement associated with the broader Defence League milieu and described as a subsidiary or local counterpart of the English Defence League (EDL). It has been characterized as part of Norway’s right-wing extremist landscape and has been referenced in connection with anti-immigration and anti-multicultural agitation. Reporting tied to the 2011 Norway attack planning indicates that NDL was discussed by the attacker as a comparatively activist movement distinct from his self-described, more violent “Knights Templar” framework, rather than as the operational vehicle for the attack itself. High-confidence information supports NDL’s ideological alignment with anti-Muslim and anti-multicultural extremism in Norway, but does not establish it as a state actor, ransomware actor, or a cyber threat actor. Available information in this record does not substantiate specific cyber capabilities, extortion activity, or a defined pattern of cyber targeting by country or industry.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Attributed origin per open-source reporting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Presented as a Norwegian subsidiary of EDL and discussed in the context of Norwegian security service threat reporting.
Presented as a Norwegian subsidiary of EDL and discussed in the context of Norwegian security service threat reporting.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.