Russian Hackers Launch DDoS Attacks on Danish Government and Businesses Over the past month, Russian-based hackers have targeted approximately 40 Danish websites belonging to government ministries, municipalities, and private businesses. The attacks, primarily distributed denial-of-service (DDoS) incidents, overwhelmed servers with traffic, causing temporary outages. Several organizations confirmed disruptions, including the Danish Foreign Ministry, whose website was offline for three hours on February 3rd. The public transport app Rejsekort also experienced a five-hour outage the same day, though no data was compromised. Other victims included Hillerød Municipality, engineering firm Danfoss, and the Danish Courts Authority (Domstolsstyrelsen). The hacker group NoName057(16), previously linked to cyberattacks ahead of Denmark’s November local elections, is among those responsible. While DDoS attacks typically disrupt rather than steal data, IT security expert Jørn Guldberg warned of broader consequences, including paralyzed public services and eroded trust in digital infrastructure.

Russian Hacker Alliance Launches Cyber Offensive Against Denmark Over Ukraine Aid A newly formed Russian hacker coalition comprising Russian Legion, Inteid, and Cardinal has launched a targeted cyber campaign against Denmark, demanding the government abandon a 1.5 billion DKK ($220 million) military aid package to Ukraine. The group issued its first threat via Telegram on January 28, 2026, warning of DDoS attacks as an initial strike, with "real cyber attacks" to follow if demands are ignored. The offensive escalated on February 2, with the group claiming responsibility for DDoS attacks against Danish energy firms, government websites, and businesses over the past 48 hours. The main wave of attacks was scheduled for 6 PM Moscow time (4 PM Danish time), targeting critical infrastructure, including energy grids, with traffic floods designed to disrupt services. ### Tactics and Early Impact The alliance employs a multi-stage attack strategy, beginning with DDoS botnets to overwhelm servers before potentially escalating to data wipes or ransomware. Screenshots shared by the group show Danish websites already experiencing outages, confirming early disruptions. The hackers leverage low-cost DDoS-for-hire tools capable of delivering gigabit-scale attacks, raising concerns about vulnerabilities in SCADA systems controlling critical infrastructure. While Denmark’s CERT has not issued official alerts, private firms report brief outages, and cybersecurity firm Truesec notes similar attacks in Norway and Finland, linked to disputes over Ukraine aid. ### State Alignment and Psychological Warfare Truesec assesses Russian Legion as state-aligned, though not directly state-funded, fitting Russia’s broader pattern of cyber operations tied to geopolitical conflicts. Since the 2022 Ukraine invasion, Russian cyber intrusions have surged by 300%, with groups combining DDoS attacks with information operations to amplify Kremlin narratives. While 60% of such threats remain at the DDoS stage, escalations can still inflict damage a 2025 Baltic DDoS wave cost banks millions in downtime. The current campaign pressures Denmark politically, though NATO commitments make an aid reversal unlikely. The alliance’s strength lies in loose coordination, pooling botnets and sharing exploits via dark web forums, with potential follow-on attacks including SQL injections or phishing for insider access. Denmark’s response remains under scrutiny as the attacks unfold.