Server Killers DDoS hits Digdir single-sign-on for three days after Norway-Ukraine pact

The attack flooded Digdir endpoints with traffic volumes sufficient to degrade the shared authentication layer while leaving most citizen-facing portals reachable. Digdir reported the incident as the largest it has recorded against its platforms; no data exfiltration or persistence was observed, consistent with a pure volumetric denial-of-service operation. Telegram posts from the group explicitly tied the action to Norway’s 23 August renewal of security cooperation and the NOK 85 billion Ukraine aid package announced the same week. Technical indicators remain limited to public Telegram claims and Digdir’s admission of sustained high-volume inbound traffic. No packet captures, sinkhole data, or infrastructure attribution have been released by Norwegian CERT or police. This matches the pattern of prior NoName057(16) and Z-Pentest operations against Nordic targets, where Telegram attribution preceded official statements but independent verification of command infrastructure was absent. Norway’s exposure stems from its repeated public commitments to Ukrainian drone and modern-warfare cooperation, a stance that has drawn documented low-sophistication responses from pro-Russian Telegram collectives since 2022. Similar DDoS waves followed Danish election-related sites and the 2025 dam-valve incident, each accompanied by Telegram footage yet lacking forensic linkage to Russian state operators. The current event continues that cycle of declared retaliation without escalation to destructive effects. Expect continued intermittent DDoS against Digdir and other Nordic digital-service portals through the remainder of the budget cycle; sustained pressure serves to consume defender attention and signal cost to continued Ukraine support without crossing into operations that would trigger formal NATO attribution.