Cyberattacks disrupt party websites and public broadcaster DR
Several Danish political parties and the national broadcaster DR were hit by a coordinated cyberattack on 17 November, just hours before the country’s municipal and regional elections. According to European Pravda, citing AFP, websites of the Conservative Party and the Red–Green Alliance were knocked offline, while Danish military intelligence confirmed that the incident was likely caused by a DDoS attack. The pro-Russian hacker group NoName057(16) claimed responsibility, boasting about the operation on its social media channels.
The attack follows a series of similar incidents in the week leading up to the vote. Government websites and defence companies had already been targeted by distributed-denial-of-service attacks, which authorities attributed to Russian-linked actors. NoName057(16), which routinely attacks states that support Ukraine, also claimed responsibility for earlier disruptions affecting several Danish municipalities, signalling a sustained campaign to undermine public confidence before the elections.
Municipal and regional elections in Denmark determine the management of essential services—from schools and healthcare to transport and local infrastructure—with regional ballots placing particular emphasis on mental-health policy. Interruptions to party websites and media platforms risk limiting access to information for voters and overloading local institutions at a critical democratic moment. Denmark’s military intelligence service has warned that the attack forms part of broader attempts to interfere with the political process and destabilise public trust.
Hybrid warfare tactics reflect growing pressure on pro-Ukraine states
DDoS attacks are a staple of Russia’s hybrid warfare strategy, which blends cyber operations, disinformation, political pressure and psychological manipulation to create persistent instability. Rather than destroying infrastructure, these operations aim to spread uncertainty and test national resilience. The targeting of Denmark—a key military, financial and political supporter of Ukraine—reflects Moscow’s intent to pressure states that contribute advanced weaponry, including F-16 fighter jets, to Kyiv.
NoName057(16) plays a central role in this digital offensive. The group conducts frequent DDoS attacks across Europe, using Telegram and other platforms to publicise its actions and cultivate the narrative of a “cyber front” aligned with Russia. Its operations typically focus on symbolic targets—media outlets, political parties, state portals—to amplify the perception of disruption while requiring minimal technical penetration.
The attacks also highlight the vulnerability of democratic processes to external interference. Cyberattacks during elections can obstruct access to political information, complicate administrative coordination and erode trust in the transparency of the vote. Denmark, which spearheads the “Danish Initiative” supporting Ukraine’s security sector, has become a prominent target. Through this initiative, Copenhagen finances weapons deliveries, trains Ukrainian personnel and cooperates with defence industries across the region—making it a strategic priority for Russian hybrid operations.
Danish military intelligence continues to play a critical role in identifying, mitigating and publicly attributing such threats. Its swift response demonstrates institutional readiness and signals to NATO allies the importance of coordinated cyberdefence. The repeated pattern of attacks, and their explicit pro-Russian attribution, underscores the evolving nature of digital threats confronting European democracies as the war against Ukraine enters a protracted phase.
