Denmark fingers Russia as culprit in two “destructive” cyberattacks

The Danish government has formally accused Russia of carrying out two “destructive and disruptive” cyberattacks and described them as “very clear evidence” of a hybrid warfare, whatever it actually is.

According to the Danish Defence Intelligence Service (DDIS), Russia was behind a cyberattack on a Danish water utility in 2024 and a series of distributed denial-of-service (DDoS) attacks on Danish websites in the lead-up to the November municipal and regional council elections.

The pro-Russian group known as Z-Pentest carried out the first cyberattack, said DDIS, and NoName057(16) is behind this year’s DDoS disruptions. Copenhagen claims the latter group has links to the Russian government.

“Completely unacceptable”

“The Russian state uses both groups as instruments of its hybrid war against the West. The aim is to create insecurity in the targeted countries and to punish those who support Ukraine,” said DDIS in a release.

“The DDIS assesses that the Danish elections were used as a platform to attract public attention – a pattern that has been observed in several other European elections.”

NoName057(16) is an ideologically driven criminal network that supports the Kremlin's interests, even though its direct involvement with the Russian government is yet to be conclusively proved.

The group has been linked to numerous DDoS attacks since Russia began its war in Ukraine. It has repeatedly targeted Ukraine and its allies, many of which are NATO member states.

In an attack on a water utility in Køge in December 2024, a hacker gained control of the waterworks and altered the pressure in the pumps, resulting in three burst pipes.

“It is completely unacceptable that hybrid attacks are carried out in Denmark by the Russian side,” said Denmark’s defence minister, Troels Lund Poulsen.

“Hybrid” too broad a term?

In September, Copenhagen also described drone incursions on Danish airports and areas of military significance as a “hybrid attack.” Back then, Prime Minister Mette Frederiksen said a hybrid war was underway, calling it “the most difficult and dangerous situation since the end of the Second World War.”

The label of "hybrid war" now covers nearly every hostile act that stops short of open warfare.

“Hybrid war,” along with its spinoffs such as “hybrid threats” and “hybrid attacks,” has become the catchall term in political rhetoric, think tank reports, and the press. The label now covers nearly every hostile act that stops short of open warfare.

Critics, however, argue that the definition is so elastic it’s often wielded as a propaganda tool and a means to avoid the painstaking process of seeking factual evidence, instead relying on a clear analytical concept.

In a 2021 report, the European Parliament warned that vague definitions actually blur institutional responsibilities and hobble efforts to craft tailored countermeasures.

For what it’s worth, Denmark’s neighbor, Sweden, has chosen to sidestep the term altogether, preferring the “gray zone problem” (gråzonsproblematik) within its concept of “total defense,” which demands preparing for any kind of threat, whether military or not.

Unlock more exclusive Cybernews content on YouTube.