ServerKillers conducts pro-Russian hacktivist campaign against Norway

On 23 August 2026, Ukraine’s President Zelenskyy announced that Ukraine and Norway have signed a defence cooperation agreement in the “Drone Deal”. The agreement enables joint projects and the exchange of both technology and expertise. This coincided with the conclusion of a strategic partnership named Yelyzaveta, further strengthening the partnership between the two countries.

A significant DDoS attack impacted Norway’s shared digital government infrastructure on 24 August, primarily affecting the authentication portal ID-Porten and causing prolonged disruption over several days. The attack took place between 24 and 26 August. This is notable as DDoS attacks often cause short-term disruption whilst the attack is active; however, affected services remained unstable. As such, this highlights both the potential impact of an attack and the capabilities of the group to prolong operational disruption.

On 26 August, after the attack against the government infrastructure ceased, pro-Russian hacktivist group ServerKillers declared a “cyber war” against Norway’s government. The group cited the Drone Deal with Ukraine as its motivation. ServerKillers has directly targeted Norway since this announcement, with the most recent attack claim observed on 8 September. Notably, whilst many journalists link the announcement to the previous attack against government infrastructure, the group did not expressly claim responsibility for the initial attack.

The total claimed victim count as of 8 September is 36, which includes entities in the transportation, education, government, and retail sectors. Notable attack announcements, each supported with CheckHost links, have included:

• Vygruppen, branded as Vy, a government-owned railway company

• Posten Bring, a state-owned postal service

• Feide, Norway's national authentication and data sharing system for education and research

• Sikt's research service and AI interface

• Educloud Norway

• A range of educational organisations and universities

• FINN, Norway’s largest general online marketplace and classified-ads platform

• Norwegian Directorate of Immigration

• National Security Authority of Norway

• Norwegian County Governor (Statsforvalteren) office

• Governor of Svalbard

• Norwegian Civil Security Clearance Authority

• Meny, a major Norwegian online supermarket

Shared CheckHost links displayed full outages affecting connections from all locations, indicating complete operational disruption of the sites.

In several of the attack claims, ServerKillers including the duration of the attacks. These ranged from one to five hours, highlighting the group’s potential for sustained malicious activity and subsequent impact.

ServerKillers is a pro-Russia hacktivist group which has been active since at least early August 2023, primarily active on both Telegram. In early January 2025, the group’s main Telegram channel had over 2,200 subscribers alongside subsequent contact, donation, “forum”, and chat channels. However as of early September 2026, these channels are no longer active and the group has maintained a new Telegram channel with 112 subscribers.  

The group mainly conducts Distributed Denial-of-Service (DDoS) attacks and has largely targeted Ukraine and countries which have supported it in the ongoing Russia-Ukraine war. ServerKillers has also taken part in other causes, with many attacks seen targeting Israel in support of Palestine in the ongoing Israel-Palestine conflict. The group posts attack claims to its Telegram channel, sharing CheckHost links as proof that the website has been taken offline.  

ServerKillers is a credible hacktivist group with the ability to conduct successful DDoS attacks. Its ability to compromise and steal data from an organisation, as well as sell access to live cameras in some instances, portrays that the group does have notable technical capability. This is also supported by its creation of the proprietary KRAKEN DDoS tool which can be used for its own attacks and by other cybercriminals.

Hacktivist groups aligned with Russian interests, including well-known entities such as NoName057(16) and ServerKillers, often target government entities of countries involved in geopolitical developments surrounding the Russia-Ukraine conflict. This has notably been observed against countries supporting Ukraine’s military capabilities. The government sector is highly targeted by hacktivist groups, highlighting the requirement for sophisticated and robust anti-DDoS techniques such as traffic filtering, rate limiting, and traffic diffusion.

‍