A three-day cyberattack disrupted Norwegian public digital services after a pro-Russian hacking group declared what it called a cyberwar over Oslo’s support for Ukraine.
The group Server Killers claimed responsibility for the attack, which ran from 24 to 26 August 2026 and targeted Norway’s Agency for Digitalisation, known as Digdir. The Associated Press reported that Digdir spokesman Are Kvistad described it as the largest cyberattack against Norway’s digital service-delivery processes that the country had ever faced.
The assault was a distributed denial-of-service attack, in which attackers direct overwhelming volumes of internet traffic at a target in an attempt to prevent legitimate users from reaching it. Among the affected services was one that allows Norwegian citizens to use a single login to access several government services.
Attack followed Norway’s renewed support for Kyiv
In a message posted on Telegram, Server Killers said it was declaring cyberwar on the Kingdom of Norway because the government had extended its security and defence cooperation with Ukraine on 23 August.
The announcement came shortly after Norway’s prime minister, Jonas Gahr Støre, visited Kyiv. During that visit, he announced that Norway would provide Ukraine with 85bn Norwegian kroner, around $9.2bn, from its state budget in 2027. It would be the third consecutive year in which Oslo had allocated that amount to support the country resisting Russia’s armed aggression.
The timing gives the attack a clear political dimension. The hackers’ stated objection was not to a technical decision or a domestic dispute, but to Norway’s continuing military and financial backing for Ukraine. The episode therefore illustrates how cyber operations can be used to threaten states that assist Kyiv without taking the form of a conventional military strike.
Server Killers’ declaration remains the group’s own claim of responsibility. But the attack fits a wider pattern in which pro-Kremlin cyber groups act as proxy forces, allowing the Russian regime to target government agencies and critical infrastructure while attempting to preserve formal distance and deny direct involvement.
Public services disrupted, but infrastructure endured
The immediate effect was disruption rather than the destruction or theft of data. By flooding Digdir with traffic, the attackers sought to make essential online services unavailable to citizens and businesses. The incident showed how dependent modern government is on a small number of digital gateways: interference with a shared authentication system can affect access to multiple public services at once.
Norway’s digital infrastructure withstood the massed traffic over the three-day period, according to the supplied account of the incident. That resilience limited the damage, but it did not make the attack insignificant. A prolonged outage of public services can create confusion, frustrate citizens and weaken confidence in the state’s ability to protect the systems on which everyday administration depends.
Such operations are designed not only to interrupt websites. They can also demonstrate that an outside actor is capable of reaching civilian and government systems, creating the impression that national infrastructure is vulnerable. In that sense, the disruption itself is part of the message.
Pressure on Europe’s support for Ukraine
The attack is another indication that cyberspace has become a fully fledged theatre of Moscow’s hybrid war against European democracies. Pro-Russian hacking groups increasingly target public and civilian digital services in an effort to interrupt their operation, encourage public distrust and impose additional security and political risks on governments supporting Ukraine.
Norway’s planned multi-year funding makes the confrontation particularly significant. Continued financial assistance strengthens Kyiv’s ability to resist Russian aggression and places additional pressure on Russia’s resources. The hostile reaction from pro-Russian hackers shows how unacceptable sustained international support for Ukraine is to Moscow and to groups aligned with its objectives.
Yet the disruption has not weakened European backing for Ukraine. Instead, it underlines the need for countries to coordinate more closely on cyber security, including the detection, identification and neutralisation of groups such as Server Killers. Without a stronger legal and sanctions response, the absence of consequences for hackers operating in Russia’s interests risks encouraging further attacks on European states.
The next test will be whether Norway and its partners can turn the resilience shown during this incident into a more effective collective deterrent before another politically motivated cyber operation reaches a wider range of public services.
Should European governments respond to such attacks primarily through stronger cyber-defences, or through tougher legal and sanctions measures against the groups behind them?
