Norwegian intelligence agency reveals use of infrastructure for cyberattacks on Ukraine
Quick Look
- The Norwegian foreign intelligence agency E-tjenesten reported that an entity acting for a foreign country used Norwegian infrastructure to conduct cyberattacks on targets outside the country, including the Ukrainian authorities.
- The deputy chief of the service, Lars Nordrum, described Norway as an "in-between country" in order to make it difficult to link the attack to its real originator.
- The detection was made possible by the TI system that monitors traffic crossing the country's borders.
AI-generated summary
Why It Matters
Norway has one of the most developed digital infrastructures in Europe, which makes it an attractive target for cybercriminals and countries conducting intelligence activities. The TI system monitors Internet and telecommunications traffic crossing national borders, enabling connection analysis and metadata collection.
The Norwegian foreign intelligence agency E-tjenesten reported that an entity acting for a foreign country used Norwegian infrastructure to conduct cyberattacks on targets outside the country. As revealed by the "VG" daily, one of the main targets was the Ukrainian authorities. According to the deputy head of the service, Lars Nordrum, Norway became an "intermediate country", which was intended to make it more difficult to link the attack to its real originator.
Modern infrastructure – an asset and a threat
Norway boasts one of the most developed digital infrastructures in Europe. However, as Nordrum emphasizes, this makes the country an attractive target for cybercriminals and countries conducting intelligence activities.
We are an attractive digital transit country for cyber operations, said the representative of E-tjenesten.
IT system
The Norwegian TI system, which monitors Internet and telecommunications traffic crossing the country's borders, played a key role in detecting the cyber operation. Thanks to it, services can analyze who, when and with whom communicated electronically, as well as collect metadata regarding communication.
It was TI that allowed us to establish that a foreign entity had access to the administrative systems of one of the Norwegian companies from the critical infrastructure sector for a long time. According to reports, the company was unaware that it had been hacked.
Wave of cyberattacks
Norwegian intelligence did not reveal which country was behind the operation or which company was attacked. It is known, however, that in August Norway fell victim to a series of cyberattacks that disrupted the operation of many public services, including login systems for state services and the tax administration network.
In response to the signing of the strategic defense agreement between Oslo and Kiev, the pro-Russian hacker group Server Killers announced a "cyber war" against Norway. On Monday, it admitted to attacking the Norwegian parliament's servers.
What to Watch
AI outlook — possibilities, not facts
Norway will strengthen the security measures of its IT system and digital infrastructure to detect and prevent its use as an intermediary for cyberattacks.
Likely · Within months
Tensions between Norway and Russia or its proxy may increase in response to cyberattacks attributed to the pro-Russian group Server Killers.
Possible · Within weeks
Open Questions
- Which country was behind the cyber operation using Norwegian infrastructure?
- Which Norwegian critical infrastructure company was attacked and were they aware of the hack?
- What were the exact effects of the cyberattacks on the Ukrainian authorities?
- Does the Server Killers group have ties to Russian intelligence?
