Loading story…
Several Danish political parties were hit by a cyberattack on the eve of local elections, disrupting digital operations at a politically sensitive moment. Reporting indicates the incident affected party systems used for communications and campaign activity, raising concerns about election interference and the resilience of political organizations facing targeted cyber operations.
The attack landed amid broader scrutiny of cyber risk to critical democratic and digital infrastructure, as recent high-profile incidents have shown how outages and malware campaigns can rapidly cascade across organizations. The disruption in Denmark underscores how politically exposed entities remain vulnerable not only to destructive malware and operational outages, but also to timed attacks designed to create confusion, hinder coordination, and erode public confidence during elections.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
Danish political parties were hit by a cyberattack on the eve of local elections, disrupting party operations during a sensitive political period. The incident was reported just before voting, indicating election-related targeting or interference concerns.
In the aftermath of the CrowdStrike-Microsoft outage, Chinese cybersecurity firms promoted domestic products and highlighted the disruption as evidence for reducing reliance on foreign security vendors. This was a public industry response following the global outage.
A faulty CrowdStrike update caused widespread Windows system crashes and major service disruptions affecting organizations globally. The outage became a major cybersecurity and operational incident tied to CrowdStrike and Microsoft environments.
A second wave of WannaCry infections was stopped after a new kill switch was identified and activated, limiting further spread of the ransomware outbreak. This marked a technical mitigation development in the WannaCry incident.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
3 references tracked. Mallory keeps watching after this page renders.
scmp.com
Open sourcescmp.com
Open sourceqz.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Danish intelligence services have publicly attributed a series of destructive and disruptive cyberattacks targeting Denmark's critical infrastructure to Russian state-backed groups. The attacks included a significant incident against a Danish water utility, reportedly causing pipes to burst and temporarily leaving homes without water, as well as coordinated denial-of-service (DDoS) attacks that overwhelmed Danish websites ahead of regional and local elections. Authorities identified the groups Z-Pentest, linked to the water utility attack, and NoName057(16), responsible for the DDoS campaigns, as operating on behalf of the Russian state. These operations are described as part of Russia's broader hybrid warfare strategy aimed at destabilizing Western nations and punishing those supporting Ukraine. The Danish Defence Intelligence Service emphasized that these cyber operations are intended to create insecurity and attract public attention, particularly during sensitive periods such as elections. The Danish government has condemned the attacks as unacceptable, with officials highlighting the incidents as clear evidence of ongoing hybrid warfare in Europe. In response, Denmark's foreign office has summoned the Russian ambassador for clarifications, underscoring the seriousness with which these state-attributed cyberattacks are being treated by Danish authorities.
Jun 29, 2026
The Danish Defence Intelligence Service (DDIS) publicly attributed two major cyber incidents to Russian-linked actors: a cyberattack on a Danish water utility in 2024 by the group Z-Pentest, and a series of distributed denial-of-service (DDoS) attacks on Danish websites ahead of the municipal and regional council elections, attributed to NoName057(16). These attacks targeted critical infrastructure and government services, raising concerns about the security of essential services and the integrity of democratic processes in Denmark. The DDIS highlighted the connection between these threat actors and the Russian state, underscoring the geopolitical motivations behind the campaigns. In December 2025, threat intelligence analysis revealed a significant escalation in DDoS activity against Denmark, with NoName057(16) and their DDoSia project orchestrating 4,559 attacks against 148 unique domains and 137 IP addresses, primarily focusing on government, energy, telecommunications, and transportation sectors. The campaign also extended to Ukraine and other countries, but Denmark was a primary target, with municipal and local government websites bearing the brunt of the attacks. The use of port 443 (HTTPS) as the most targeted vector indicates a focus on disrupting secure web services critical to public administration and infrastructure.
Jun 29, 2026
Denmark’s cyber agency SAMSIK and the Danish Defence Intelligence Service have raised their assessment of the threat from destructive cyberattacks against Danish targets. The move follows an escalation in Russian hybrid activity intended to pressure European governments to reduce support for Ukraine, including cyber and influence operations, DDoS attacks, compromises of CCTV systems, and manipulation of inadequately protected critical-infrastructure components. Organizations connected to support for Ukraine face elevated risk, particularly defence-sector personnel and Western supply-chain factories, warehouses, and critical-infrastructure operators. Authorities expect activity to become more frequent and potentially more disruptive, including attacks conducted through proxies or disposable agents; however, cybercrime and cyber espionage remain the most prevalent threats to Nordic organizations. A direct Russian military attack on a NATO member is still assessed as unlikely, but any such conflict could include destructive cyber operations aimed at supporting military activity and disrupting Western decision-making.
Sep 29, 2026