Server Killers hit Norway's public login the day after an 85 billion crown Kyiv pledge

The stated grievance and the timing do not match. Server Killers told its Telegram audience it had declared cyber war on Norway over the country renewing security cooperation with Ukraine on Aug. 23 ^[6]. The traffic arrived on Monday ^[1], one day after Prime Minister Jonas Gahr Store stood in Kyiv and committed 85 billion Norwegian crowns of next year's state budget, about 9.2 billion dollars, to a third consecutive year of support ^[7][14]. The published cause was weeks old. The money was a day old.

That gap tells you what the operation was for. Volumetric denial of service needs no foothold, no credential and no patch gap; the input is rented capacity and the output is a name in Norwegian media while the pledge is still being reported. Digdir's own account fits that reading: the agency says it kept services running practically all the time ^[4], which means the deliverable was attention rather than outage.

The target selection is the part worth copying down. Among the services hit was the one that lets citizens use a single login across multiple public services ^[3]. Aim at that and one availability target degrades the entrance to many services at once, without needing to know which ones. The dependency graph is the blast radius, not the agency's own service catalogue.

What is missing is any denominator. "The biggest attack against Digdir solutions that we have ever experienced" is a comparison against an internal baseline nobody outside the agency can see ^[2], and there is no published figure for traffic volume or minutes of degradation. An operator elsewhere in Europe cannot use it to size scrubbing capacity, only to justify asking for more.

The same banner covers very different hands. Norwegian authorities said in 2025 that Russian hackers were likely behind suspected sabotage at a dam, where a remotely controlled valve was opened to increase water flow ^[10], and police said a three-minute video of the control panel, marked by a pro-Russian group, went up on Telegram ^[11]. Danish officials attributed a destructive attack on a water utility in 2024 to Z-Pentest and a 2025 pre-election website attack to NoName057(16), saying both have links to the Russian state ^[12]. Against those, three days of traffic against a login service is the cheap end of the campaign, and the cheap end is the part that scales, because it requires no access to anything.

Attribution will lag: Norwegian officials had not commented on the claim by publication time ^[8]. The diary will not lag. Aid votes, ratification dates, drone cooperation announcements and ministerial visits are all published in advance ^[9], and officials already describe this activity as aimed at undermining support for Ukraine and draining investigative resources ^[13]. For any government running a shared citizen login, that calendar is the cheapest surge forecast available, and it costs nothing to read.