Russian hacktivists take down Norway govt sites in DDoS attacks

Norway's National Security Authority (NSM) published a statement yesterday warning that some of the country's most important websites and online services are being rendered inaccessible due to distributed denial of service (DDoS) attacks.

The statement further explains that a criminal pro-Russian group is believed to be behind the attacks.

DDoS attacks are a special type of cyberattack that causes internet servers to be overwhelmed by many requests and garbage traffic, rendering the hosted sites and services inaccessible for legitimate visitors and users.  

These low-cost attacks have become very common today and constitute part of the ongoing cyber-warfare between pro-Russia and pro-Ukrainian hacktivists.

Most recently, we have seen this kind of attack unfolding against the Lithuanian government and national transportation services. Earlier, Russian hacktivists hit Italy and Romania for providing full-spectrum support to Ukraine.

In this case, the Norwegian authorities report attacks against large companies that offer essential services to the population.

"We have seen similar attacks in other countries recently, but none of these have reported lasting consequences," commented NSM's director, Sofie Nystrøm.

"The attacks will still be able to create uncertainty in the population and give the impression that we are a piece in the current political situation in Europe."

To help system admins mitigate the effects of those attacks, NSM has linked to guidance resources on how to defend against wide-spectrum DDoS.

Although NSM's announcement doesn't mention who the hackers are and what services they targeted, we were able to find some of the targeted websites on the Telegram channel of 'Legion – Cyber Spetsnaz RF.'

Norway DDoS targets

Like other hacktivist groups, Legion recruits volunteers to help with attacks and is the same group that recently targeted Lithuania.

In addition, Legion is believed to be affiliated with Killnet, another group that hit Romania, Italy, and many other countries with DDoS attacks in previous months.

According to the Russian hacktivists, some of the targeted Norwegian entities are Norway's national police, the state's public services portal, the NAV office site (immigration), the Altinn digital government document portal, and the UDI portal (immigration and traveling).

Three Norwegian sites acknowledging the attacks

The reason for the latest wave of disrupting cyberattacks against Norway is for two reasons.

First, Norway blocked the transit of 20 tonnes of goods from mainland Russia to the Svalbard island, destined for Russian miners living in the archipelago.

Secondly, Norway donated long-range rocket artillery (MLRS) systems and 5,000 rounds of shells to Ukraine to help the country thwart the ongoing Russian invasion.

Considering the simplicity and low-cost nature of DDoS attacks compared to the level of disruption they can bring, experts believe that they will continue to escort global political instability.