On Wednesday, a number of important Norwegian companies were hit by a hacker attack.
According to the National Security Authority (NSM), it appears that a criminal pro-Russian group is behind it.
In advance, the hacker group Killnet announced that they would carry out a major attack on Norway. At Telegram, they have also misused and manipulated images of several prominent Norwegians.
Experts believe there is unrest in the attacks. They believe there is a risk that what we saw on Wednesday was just a diversionary maneuver.
HACKER GROUP: The picture is taken from the pro-Russian hacker group Killnet’s account on social media. Photo: Ole Enes Ebbesen / TV 2
Millions of machines
According to Erling Schackt, technology manager at Check Point Software, Killnet controls about four and a half million computers on the Internet – without the users’ knowledge.
– These are machines that are infected, where the user or owner is not aware of this. They use the machines to attack targets, such as Norwegian websites in this denial of service attack, he says.
During such an attack, so many requests are sent to a service that it crashes.
The attack has apparently not done much damage beyond any downtime for Norwegian websites. Daniel Christensen, who is an ethical hacker at Telenor, nevertheless believes that this is a major attack.
– That they managed to take down services with such a large infrastructure, indicates that this is a major attack. It is bigger than what some kids get in the basement, Christensen says.
SIMPLE: Daniel Christensen thinks it is worrying that part of the Norwegian infrastructure is being taken down so easily. Photo: Jan Arne Austad / TV 2
Øystein Borgen, who has covered Russia for TV 2 for a number of years, believes no one knows how big Killnet’s network is.
– Independent computer security experts believe it may be about a few hundred people, who coordinate the attacks via Telegram. They should have quite advanced hacker tools at their disposal and large overall server capacity. It is necessary to run large attacks, he says.
CYBER WARNING: Øystein Bogen has also written the book “Russia’s secret war against the West”, which among other things is about Putin’s cyber warfare against the outside world. Photo: Aage Aune / TV 2
Killnett has also been behind recent attacks on Italy, Moldova, the Czech Republic and Lithuania, among others. Last in line is Norway – and experts believe there is an obvious reason for this.
That is why Norway is affected
The experts point to three reasons why Norway in particular is affected, but agree on one thing:
– This is politically motivated, says Schackt.
TEK EXPERT: Erling Shackt is technology manager at Check Point Software.
First, they point out that the attack is a reaction to the refusal to ship Russian goods in Svalbard via Storskog during the war.
– They are not necessarily looking for money, but this is almost pure sabotage of Norwegian infrastructure, says Schackt.
The book points out that the attack appears to be closely coordinated with political and diplomatic initiatives from Russia.
– The attack on Norway came only hours after Norway would not make an exception from the sanctions, and drop containers with Russian goods through the border station, he says.
SANCTIONS: That the hacker group reacts to Norwegian sanctions by Russia, corresponds with messages the group has written on Telegram. Photo: Killnet / Telegram
Is by chance Norwegian
According to Bogen, until recently Killnet was a purely criminal group that made money by selling hacking tools to those who paid.
After Russia’s invasion of Ukraine, they changed their profile and began engaging in cyber-activism to support Russian political goals.
– In May, they declared cyber war against several NATO countries, as well as against the western hacker group Anonymous, which has previously attacked Russian state infrastructure in retaliation for the war in Ukraine, says Borgen.
The experts believe that the Norwegian military aid to Ukraine is the second reason why Norway is affected.
– It may look like the group has an agenda against Norway due to the support for Ukraine, and that is probably why Stoltenberg and the Minister of Foreign Affairs are used in the campaign, Christensen says.
FALSE: Killnet has claimed that they have control of Jens Stolenberg’s passport, but that is false. Photo: Killnet / Telegram
At Telegram, the group has threatened Secretary General Jens Stoltenberg and manipulated a picture of Foreign Minister Anniken Huitfeldt.
– Norway is also a target because of Stoltenberg, who leads the organization which is designated as Russia’s number one enemy, and which happens to be Norwegian, says Bogen.
MANIPULATED: Killnet refers to the Secretary of State as “Mrs Error”. Photo: KIllnet / Telegram
Sore doubts about the attacker
But Killnet is not the only Russian hacker group the Norwegian computer security community has on the radar.
Morten Tandle at Nordic Financial CERT says that they have been closely following another hacker group called Legion – Cyber Spetsnaz (LCS) since earlier this spring.
– They are also an activist group. They are not organized, but have a communication channel where they post goals, which they ask their followers to attack, says Tandle.
He believes there is a clear connection between Killnet and LCS.
– From our side, it seems as if they are two different groups, with quite similar purposes, and where there is some overlap in membership, he says.
ONLINE CRIME: Morten Tandle is the general manager of Nordic Financial CERT, which works against cybercrime for the Nordic financial industry. Photo: Torstein Bøe / NTB
Among other things, Tandle points out that the message that LCS posted last night was later shared in Killnet’s Telegram group.
– Whether it is members of Killnet and / or LCS who actually carry out attacks against these targets is difficult to know.
Nor does the National Security Authority (NSM) dare to determine who is behind it.
They want to create chaos
NSM refers to similar attacks in other countries recently, and says that none of these have reported lasting consequences.
– The attacks will still be able to create uncertainty in the population, and give the impression that we are a piece in the current political situation in Europe, says director Sofie Nystrøm to TV 2.
The book believes that this is precisely the goal of the hacker group.
– They want to create create unrest, chaos and anxiety and together with other, state Russian instruments try to influence political decisions in other countries, he says.
UNSECURED: Experts are unsure whether Killnet will stop after Wednesday’s attack. Photo: Ole Enes Ebbesen / TV 2
Can be a diversionary maneuver
Although most Norwegian services that were hit on Wednesday night are up and running again, it is uncertain how long the attack will last.
However, there is one thing that worries Schackt.
– What is a bit risky with this and with a service attack in general, is whether you have used this to draw attention away from another attack. But it is difficult to say whether this is the case, says Schackt.
The book says that there will also be some unrest in the data security environment after the attacks.
– At present, it is not known that they have stolen information, but in the data security environment there should be some concern that they may also consider starting with so-called ransomware virus attacks.
