Loading story…
A large-scale distributed denial-of-service (DDoS) attack disrupted Norway’s shared government digital infrastructure by targeting systems operated for the Norwegian Digitalization Agency (Digdir) by its IT partner Vivicta. The attack began early Monday and continued for about 30 hours at varying intensity, knocking multiple public services offline or degrading performance with failed connections, slow responses, and long login times. Authorities said around 10 services were affected, including ID-porten, Norway’s key digital identity gateway, as well as eSignering, with downstream disruption reported for platforms such as Altinn and Skatteetaten.
The outage also caused knock-on effects in parts of Norway’s health infrastructure, including online pharmacies and the electronic prescription system. Digdir said several services were fully unavailable for short periods and some remained partially inaccessible after stabilization efforts. Norwegian authorities, including the National Security Authority and Data Protection Authority, were notified, and officials said there was no indication of unauthorized access, security breach, or compromise of personal data. Digdir described the incident as significantly larger than recent attacks and said it was the third DDoS campaign to hit the agency in recent months.
See attribution, scope, and your downstream exposure.
12 events from the most recent confirmed update back to the earliest known activity.
Pro-Russian group Server Killers claimed in a Telegram post that it was responsible for the DDoS attack against Digdir and Norwegian public digital services, framing it as retaliation for Norway's renewed security cooperation with Ukraine. Norwegian officials had not confirmed the claim at the time of reporting.
Digdir said the DDoS attack that began on August 24 was two to three times larger than the preceding DDoS incident. On Tuesday afternoon, the agency reported that its systems were stable while mitigation continued.
By Tuesday morning, after about 30 hours of attack activity at varying intensity, Digdir said many systems had been stabilized and some services were gradually coming back online. However, some services, including ID-porten and eSignering, were still partially affected.
During the incident, several Digdir services became fully unavailable for short periods and 10 digital services were disrupted, including ID-porten and eSignering. Dependent platforms and parts of Norway’s health infrastructure also experienced login and access problems, including online pharmacies, the electronic prescription system, Altinn, and Skatteetaten.
A large-scale DDoS attack began at 03:38 CEST on Monday against infrastructure used by Norway’s Digitalisation Agency, Digdir, and operated in part by its IT partner Vivicta. The attack disrupted shared government digital infrastructure, including identity, login, signing, and data-exchange services.
BleepingComputer reported that Digdir was targeted by another DDoS attack on August 3, making the later August incident the third recent attack against the agency. No additional operational details for the August 3 event were provided in the references.
Digdir director Frode Danielsen said the Norwegian Digitalisation Agency had previously been targeted by a DDoS attack in June. The references provide no further dated details about that earlier incident.
Norway's National Criminal Investigation Service (Kripos) opened an investigation into the Digdir DDoS incident. The Police Security Service (PST) monitored the situation and coordinated with other government agencies; Server Killers' responsibility remained unverified.
Truesec assessed that Server Killers shares links, messaging, and other similarities with the Russian hacktivist group Noname057(16), which it said had been exposed as a product of the CISM agency. Truesec said Russian-state leadership of Server Killers was likely but emphasized that it had no direct evidence of such control.
As the investigation progressed, Digdir said it found no indication of a security breach or unauthorized access to sensitive information, and no sign that personal data had been compromised. Authorities also said attribution remained unclear at the time of reporting.
Following the attack, Digdir notified Norway’s National Security Authority (NSM) and the Data Protection Authority (Datatilsynet) about the incident. The references do not provide a more specific date than the reporting timeframe.
Digdir reported that it was stabilizing its solutions following a data attack. The available reference provides no details on the attack’s timing, impact, or type beyond the title.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
16 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcetruesec.com
Open sourcexakep.ru
Open sourcesecurityweek.com
Open sourcestatus.digdir.no
Open sourcetestmiljo.status.digdir.no
Open sourcekommunikasjon.ntb.no
Open sourcedigital-strategy.ec.europa.eu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Norway’s implementation of the national **Security Act** has lagged years behind plan, leaving parts of the country’s critical digital and physical infrastructure without the intended protections. The law entered into force in 2019 and requires authorities to identify **fundamental national functions**, map dependencies, and bring critical entities under stricter security oversight, but work that was due by July 2021 remained unfinished amid coordination problems across ministries and sectors. Public criticism has intensified as the **Office of the Auditor General** and industry voices warn that slow execution is weakening national digital resilience. Reported obstacles include limited capacity, shortages of specialist competence, and sector-specific disputes over scope; one example cited is that Norway’s oil and gas infrastructure was only later recognized as falling under the act, underscoring how delays in classification and coordination have left important value chains insufficiently protected.
Aug 21, 2026
The Danish Defence Intelligence Service (DDIS) publicly attributed two major cyber incidents to Russian-linked actors: a cyberattack on a Danish water utility in 2024 by the group Z-Pentest, and a series of distributed denial-of-service (DDoS) attacks on Danish websites ahead of the municipal and regional council elections, attributed to NoName057(16). These attacks targeted critical infrastructure and government services, raising concerns about the security of essential services and the integrity of democratic processes in Denmark. The DDIS highlighted the connection between these threat actors and the Russian state, underscoring the geopolitical motivations behind the campaigns. In December 2025, threat intelligence analysis revealed a significant escalation in DDoS activity against Denmark, with NoName057(16) and their DDoSia project orchestrating 4,559 attacks against 148 unique domains and 137 IP addresses, primarily focusing on government, energy, telecommunications, and transportation sectors. The campaign also extended to Ukraine and other countries, but Denmark was a primary target, with municipal and local government websites bearing the brunt of the attacks. The use of port 443 (HTTPS) as the most targeted vector indicates a focus on disrupting secure web services critical to public administration and infrastructure.
Jun 29, 2026A sustained DDoS campaign attributed to **NoName057(16)** used the **DDoSia** tool to generate **6,649** recorded attack entries between Feb. 23 and Mar. 1, targeting **126 domains** and **135 IPs** with a multi-country focus on **Denmark, Greenland, and Ukraine**. Reported targeting emphasized public-sector services (about **44%** of attacks), alongside Ukrainian defense industry, tourism/travel (notably tied to Greenland’s economy), and transportation infrastructure; most traffic was directed at `443/tcp` (HTTPS). The activity aligns with politically motivated disruption tied to Denmark’s support for Ukraine and heightened Arctic sovereignty tensions involving Greenland. Separately, Russia’s internet regulator **Roskomnadzor** and the **Russian Defense Ministry** reported a “complex multi-vector” DDoS that briefly disrupted multiple government websites and related infrastructure, including systems of the **Main Radio Frequency Center (GRFC)**. Russian authorities said the attack was contained, but user reports indicated intermittent access issues persisted for days; the responsible actor was not identified and no public claim of responsibility was noted at the time of reporting. A ransomware “state of the month” roundup covering February incidents is not directly related to these DDoS events and should be treated as separate reporting.
Jun 29, 2026