Denmark accuses Russia of supporting cyberattacks on water, elections

by · UPI

Dec. 19 (UPI) -- The Danish government Friday said that Russia is behind two cyberattacks in 2024 and this year that were "destructive and disruptive."

The Danish Defense Intelligence Service said it determined that Russia was behind a cyberattack on a Danish water utility in 2024 and a series of distributed denial-of-service attacks on Danish websites before the 2025 municipal and regional council elections in the country, the agency said in a press release.

The water-utility attack, the release said, was done by a pro-Russian group called Z-Pentest, and the DDoS attacks were carried out by NoName057(16), which also has ties to Russia.

"The Russian state uses both groups as instruments of its hybrid war against the west," DDIS said in a statement. "The aim is to create insecurity in the targeted countries and to punish those that support Ukraine. Russia's cyber operations form part of a broader influence campaign intended to undermine western support for Ukraine."

Related

DDIS Director Thomas Ahrenkiel told The Guardian the agency was "very certain that these are pro-Russian groups that have connections to the Russian state."

In the attack on a water utility in Køge, Denmark, in December 2024, a hacker took control of a water facility and changed the pressure in the pumps, which burst some pipes.

"This is very clear evidence that we are now where the hybrid war we have been talking about is unfortunately taking place. It once again puts the spotlight on the situation we find ourselves in in Europe," Denmark's defense minister Troels Lund Poulsen said.

Torsten Schack Pedersen, Denmark's minister for resilience and preparedness, said the attacks demonstrated that "there are forces capable of closing down important parts of our society."

He said the country is not equipped to withstand these kinds of attacks. "I think you have to be incredibly naive if you think we are at the top of cybersecurity," he said.

Denmark said it will summon the Russian foreign minister for a discussion.

Germany did the same thing on Dec. 12 after accusing Russia's military intelligence of a cyberattack on air traffic control and election interference. It said a hacker group behind the 2024 cyberattack likely has ties to GRU, Russia's military intelligence.

The ministry also said Russia tried to interfere in Germany's general elections in February. A propaganda group called Storm-1516 was accused of running a targeted disinformation campaign. It allegedly spread misinformation about ballot manipulation, Green Party candidate Robert Habeck and now-Chancellor Friedrich Merz.

"Russia is thus very specifically threatening our security," the ministry said.