Loading story…
Denmark’s cyber agency SAMSIK and the Danish Defence Intelligence Service have raised their assessment of the threat from destructive cyberattacks against Danish targets. The move follows an escalation in Russian hybrid activity intended to pressure European governments to reduce support for Ukraine, including cyber and influence operations, DDoS attacks, compromises of CCTV systems, and manipulation of inadequately protected critical-infrastructure components.
Organizations connected to support for Ukraine face elevated risk, particularly defence-sector personnel and Western supply-chain factories, warehouses, and critical-infrastructure operators. Authorities expect activity to become more frequent and potentially more disruptive, including attacks conducted through proxies or disposable agents; however, cybercrime and cyber espionage remain the most prevalent threats to Nordic organizations. A direct Russian military attack on a NATO member is still assessed as unlikely, but any such conflict could include destructive cyber operations aimed at supporting military activity and disrupting Western decision-making.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
ICCT research documented more than 180 Russian-attributed hybrid incidents in Europe since the start of Russia's war against Ukraine, including carried-out, attempted, and foiled activity. Arson and explosive placements were the most common recorded category, followed by vandalism; ICCT said the count excludes cyberattacks, drone incidents, and cases still under investigation.
Denmark's SAMSIK and the Danish Defence Intelligence Service raised their assessed threat level for destructive cyberattacks against Danish targets. The assessment cited an escalating Russian hybrid-threat campaign intended to pressure European countries to reduce support for Ukraine, with Ukraine-supporting entities facing elevated risk.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
5 references tracked. Mallory keeps watching after this page renders.
icct.nl
Open sourcemalware.news
Open sourcetruesec.com
Open sourcesamsik.dk
Open sourcefe-ddis.dk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Denmark has raised its threat level for destructive cyberattacks from **medium** to **high**, citing intelligence assessments that Russia is increasingly likely to conduct hybrid activity, including disruptive cyber operations, against Denmark and other NATO members in the coming months. Authorities warned that wiper malware and attacks on operational technology (OT) pose particular risks to critical infrastructure, referencing a late-2024 attack on a Danish waterworks and a disrupted December 2025 attempt against Poland’s energy sector; public agencies and critical-function operators were urged to strengthen incident planning, cyber resilience, and OT defenses. Recorded Future’s Insikt Group reported that Russia has expanded its “New Generation Warfare” across Europe since the invasion of Ukraine, combining cyberattacks, influence operations, physical sabotage, and airspace and maritime incursions. Reported incidents include an explosive drone at Leipzig/Halle Airport, a maritime drone near Romania’s Neptun Deep gas project, attacks on Norwegian public-sector portals, and Russian drones near Estonia. The group assesses that such activity will likely intensify over the next two years, elevating the risk of data loss, service disruption, facility damage, and danger to personnel, while judging Moscow is unlikely to intentionally trigger NATO Article 5 through mass casualties or permanent infrastructure destruction.
Sep 24, 2026
Danish intelligence services have publicly attributed a series of destructive and disruptive cyberattacks targeting Denmark's critical infrastructure to Russian state-backed groups. The attacks included a significant incident against a Danish water utility, reportedly causing pipes to burst and temporarily leaving homes without water, as well as coordinated denial-of-service (DDoS) attacks that overwhelmed Danish websites ahead of regional and local elections. Authorities identified the groups Z-Pentest, linked to the water utility attack, and NoName057(16), responsible for the DDoS campaigns, as operating on behalf of the Russian state. These operations are described as part of Russia's broader hybrid warfare strategy aimed at destabilizing Western nations and punishing those supporting Ukraine. The Danish Defence Intelligence Service emphasized that these cyber operations are intended to create insecurity and attract public attention, particularly during sensitive periods such as elections. The Danish government has condemned the attacks as unacceptable, with officials highlighting the incidents as clear evidence of ongoing hybrid warfare in Europe. In response, Denmark's foreign office has summoned the Russian ambassador for clarifications, underscoring the seriousness with which these state-attributed cyberattacks are being treated by Danish authorities.
Jun 29, 2026
The Danish Defence Intelligence Service (DDIS) publicly attributed two major cyber incidents to Russian-linked actors: a cyberattack on a Danish water utility in 2024 by the group Z-Pentest, and a series of distributed denial-of-service (DDoS) attacks on Danish websites ahead of the municipal and regional council elections, attributed to NoName057(16). These attacks targeted critical infrastructure and government services, raising concerns about the security of essential services and the integrity of democratic processes in Denmark. The DDIS highlighted the connection between these threat actors and the Russian state, underscoring the geopolitical motivations behind the campaigns. In December 2025, threat intelligence analysis revealed a significant escalation in DDoS activity against Denmark, with NoName057(16) and their DDoSia project orchestrating 4,559 attacks against 148 unique domains and 137 IP addresses, primarily focusing on government, energy, telecommunications, and transportation sectors. The campaign also extended to Ukraine and other countries, but Denmark was a primary target, with municipal and local government websites bearing the brunt of the attacks. The use of port 443 (HTTPS) as the most targeted vector indicates a focus on disrupting secure web services critical to public administration and infrastructure.
Jun 29, 2026