Pro-Russian hackers claim large-scale cyberattack on Norway over support for Ukraine

Norway's Agency for Digitalisation Digdir has been under a massive DDoS attack for three days, affecting ten government digital services. Responsibility for the attack was claimed by the pro-Russian group Server Killers, which linked its actions to increased cooperation between Norway and Ukraine.

The attack began on the night of Monday, August 24, and as of the morning of August 26, it continued in waves. According to Norwegian media, this is already the third attack on Digdir systems this summer and the largest of them.

Problems arose in the operation of ten digital services. Among them is ID-porten, a single sign-on system through which residents of the country access numerous government services, as well as MinID, Altinn, and eInnsyn.

On Wednesday morning, most systems were working stably, but restrictions continued to apply to ID-porten. Digdir warned that the situation was becoming critical for some customers and services that depend on this system.

Hackers explained the attack by support for Ukraine

The pro-Russian group Server Killers stated in its Telegram channel that it launched attacks on Norway after Oslo's decisions to deepen cooperation with Ukraine.

This includes documents signed on August 23 in Kyiv by Norwegian Prime Minister Jonas Gahr Støre and Ukrainian President Volodymyr Zelenskyy.

The countries concluded a strategic partnership agreement and a separate defense agreement within the Drone Deal format. It provides for deepening cooperation between the defense sectors and industries of the two countries, exchange of technologies and experience, particularly in the field of drones and anti-aircraft defense.

On the same day, the Norwegian government announced that it would propose to the parliament to maintain support for Ukraine in 2027 at the level of 85 billion Norwegian kroner. The aid is planned to be provided through the Nansen program, with its main part, as before, to be directed to military needs.

Server Killers named the new defense cooperation, development of joint drone projects, and continuation of financial assistance to Ukraine as the reasons for its actions against Norway.

No official attribution of the attack yet

At the same time, Server Killers' statement only means that the group claimed responsibility. Norwegian law enforcement and security agencies at the time of publication did not confirm that this particular group was behind the attack on Digdir.

Server Killers calls itself a pro-Russian hacking group and has been active since at least 2023. It previously claimed DDoS attacks on websites in Romania, Canada, and other countries. Cybersecurity researchers have also observed its interaction with the better-known pro-Russian group NoName057(16).

DDoS attacks involve artificially overloading servers with a huge number of requests, preventing legitimate users from accessing digital services normally.

Sources: VG, Aftenposten, Associated Press, Norwegian government