Norway’s military intelligence service has officially revealed details of a large-scale, multi-layered cyber-espionage operation in which Norwegian digital infrastructure and local server capacity were covertly used as transit nodes to carry out aggressive attacks against Ukraine.
According to Norwegian intelligence, hacker groups controlled by Russian security agencies and intelligence services had for a prolonged period been covertly compromising servers, network routers and commercial digital networks located in Norway. The shadow proxy infrastructure created in this way was used by the attackers to conceal their real IP addresses, distribute malware and conduct active reconnaissance within Ukraine’s digital environment. The main targets of these cyberattacks were key critical and energy infrastructure facilities, the financial sector, as well as Ukrainian government agencies and military structures.
Experts emphasise that the use of infrastructure in a NATO member state to carry out attacks against Ukraine not only allows hackers to conceal their tracks but also reduces the likelihood of immediate detection by security systems that traditionally regard European IP traffic as more trustworthy.
Such tactics pose a direct threat to Norway’s own security, as they compromise its national digital infrastructure and involve civilian resources in a hybrid conflict. In response, Norway’s military intelligence service has urged domestic IT providers, government agencies and private businesses to urgently conduct security audits, address identified vulnerabilities in network equipment and introduce additional traffic-filtering mechanisms to prevent national resources from being further exploited by hostile foreign actors.
