A day of digital chaos in Norway

For more than 30 hours, a relentless DDoS attack has been hammering the digital infrastructure that Norwegians rely on for everything from logging into government portals to picking up prescriptions. The Norwegian Digitalisation Agency, known as Digdir, confirmed that the attack began on Monday and has continued with varying intensity, leaving a trail of disrupted services in its wake.

This isn’t just a minor inconvenience. Ten digital services have been affected, including the critical ID-porten system, which serves as a gateway to thousands of government services. With over 4.5 million users, ID-porten is the digital key to Norway’s public sector, and its downtime has sent ripples across the country.

What exactly was hit?

The attack targeted the infrastructure of Vivicta, Digdir’s IT partner. According to Digdir’s status page, the affected services include identity verification, login systems, data exchange between government agencies and businesses, access to public records, and employee access management. That’s a broad swath of the digital public sphere.

One of the most concerning knock-on effects was on Norway’s health infrastructure. Several health services depend on ID-porten for authentication, meaning patients faced potential problems accessing online pharmacies and the country’s electronic prescription system. For a nation that prides itself on digital efficiency, this was a stark reminder of how fragile that efficiency can be.

Not the first time, and getting bigger

This is the third DDoS incident to hit Digdir’s services since June, according to Norwegian media. But it’s not just a repeat performance. Are Kvistad, a press officer at Digdir, told public broadcaster NRK that this attack is “two to three times larger than what we experienced last time.” That’s a significant escalation, and it raises questions about whether these incidents are connected or part of a broader campaign targeting Norway.

So far, no group has claimed responsibility, and it’s unclear who’s behind the assault or whether the recent incidents are linked. What is clear is that the attackers didn’t manage to breach sensitive data. Digdir has stated that no sensitive information stored in the affected systems was compromised. That’s a small comfort, but a comfort nonetheless.

What’s being done about it?

Digdir is working closely with Vivicta to stabilize the systems and bring services back online. As of Tuesday morning, some services were gradually returning, but the attack was still affecting others. The response has been a mix of technical mitigation and public communication, with Digdir keeping a status page updated for concerned citizens.

For those watching from the sidelines, this is a textbook case of how a DDoS attack works: flood the servers with traffic until they can’t handle legitimate requests. It’s a blunt instrument, but it can be devastatingly effective when aimed at critical infrastructure.

The bigger picture: A trend or a one-off?

The repeated nature of these attacks on Digdir’s services is worrying. Three incidents since June suggests a pattern, even if the motives remain unclear. Could this be a test of Norway’s defenses? A political statement? Or just a particularly persistent group of cybercriminals? Without more information, it’s hard to say.

What is certain is that Norway isn’t alone in facing this threat. DDoS attacks on government services have become a common tool for hacktivists and state-sponsored actors alike. The recent incidents in Norway could be a sign of things to come, not just for the country but for the region.

What should citizens expect?

For now, the advice is to be patient. Digdir is working to restore full functionality, but it’s a process. If you’re in Norway and need to access public services, it’s worth checking the status page before trying to log in. And if you’re waiting for a prescription, you might want to give it a little more time.

The attack may be over soon, but its implications will linger. This incident has exposed vulnerabilities in Norway’s digital infrastructure that will likely require a hard look at how such services are protected. For a country that has embraced digitalization so fully, the stakes are high.

As the situation develops, one thing is clear: the digital age has brought immense convenience, but it has also opened the door to new kinds of chaos. Norway is now learning that lesson firsthand.

A quiet shift in how Britain polices its tech supply chain

London is moving to give ministers a blunt new tool: the power to quietly cut risky technology vendors out of the country’s most vital industries. And in some cases, the public may never know which company got the boot.

The changes, tucked into amendments to the Cyber Security and Resilience Bill published on Monday, borrow heavily from the legal playbook used to push Huawei out of Britain’s 5G networks. But they strip away several of the transparency safeguards that came with that earlier regime.

Under the current telecoms law, the government must publicly designate a vendor as a security threat before it can act. Not so with these new proposals. Ministers would be able to issue a so-called “vendor-related direction” without naming the supplier publicly, and without even sending the vendor a copy of the order. The company on the receiving end could also be barred from talking about it.

Beyond telecoms: who’s in the crosshairs?

The scope is what makes this different. The powers wouldn’t stop at phone networks. They’d extend to managed service providers, data centers, digital infrastructure, and the energy, water, transport and health sectors.

A senior minister could order a company in any of those areas to stop buying from a specific supplier, restrict how its products are used, or even force the removal of equipment that’s already installed. Think of it as a national security off-switch for the supply chain.

What the government says — and what critics worry about

Liz Lloyd, the recently reappointed cybersecurity minister, framed the powers as a preventive measure. “We can act before a threat materialises, not just after the damage is done,” she said, adding that the goal is to put “national security at the heart of how essential services choose their suppliers.”

But the secrecy provisions are raising eyebrows. While the government would have to publish a notice that a direction had been issued, only the recipient company would be named. The vendor itself could stay anonymous. Details could be withheld on national security or commercial grounds, and anyone consulted before the order — including the vendor — could be gagged from even acknowledging the consultation took place.

Security officials have previously pushed back against similar secret powers in other high-profile cases. When Apple sought to introduce end-to-end encryption for iCloud, officials reportedly described such covert measures as unsustainable and unjustifiable. This new bill seems to lean in the opposite direction.

How it mirrors the Huawei 5G ban — and where it breaks from it

The mechanics will feel familiar to anyone who followed the Huawei saga. The Telecommunications (Security) Act 2021 gave ministers the authority to intervene on national security grounds, which they used to force the Chinese equipment maker out of UK 5G infrastructure.

Both laws share that core premise. But the new bill goes further by allowing ministers to skip the usual step of giving both the affected company and the supplier a chance to respond before an order is issued — if national security demands it.

A partial transparency compromise

There is one nod to openness: the amendments add a publication duty that the telecoms act lacks. The government would have to announce publicly that an order had been issued and identify the recipient. But that notice wouldn’t necessarily reveal which vendor was targeted, and details could still be withheld.

So a water utility, a hospital trust, or a data center operator could be named as having received a direction, while the public is left guessing which supplier triggered the alarm.

The government would also have to report annually to Parliament on how many directions were issued, which sectors were affected, and how many were later varied or revoked. That’s a small accountability window, but it’s something.

Who else could get caught up in this?

Here’s a wrinkle: the powers wouldn’t just apply to companies already regulated as part of critical national infrastructure. Ministers could use regulations to sweep in any person or business they deem to be engaged in essential activity in the UK, or providing essential goods or services. That’s a broad net.

There’s also a layer of bureaucratic control. A company issued a direction would need written government approval before hiring an outside specialist to help it comply. And in deciding whether to grant that approval, ministers could rely on a list of pre-approved specialists published by GCHQ. That’s a notable expansion of the intelligence agency’s role in commercial decisions.

What happens next

The amendments are scheduled for committee stage in the House of Lords in September. That’s where the details will get picked apart — and where critics will likely push for more transparency.

The bill’s trajectory is worth watching. If it passes as drafted, Britain will have a powerful new way to quietly sever ties with risky tech suppliers, but at the cost of a more opaque decision-making process.

For companies operating in critical sectors, the takeaway is clear: supplier choices could soon carry national security implications, and the government may not always tell you why.

For a deeper look at how the UK has handled similar threats, check out our coverage of Huawei’s removal from UK 5G networks and the broader debate over national security and technology supply chains.

Washington Turns the Screws on Tehran’s Cyber Mercenaries

The US Treasury has slapped sanctions on nearly 60 individuals and entities tied to Iran, including five members of the Mabna Institute — a shadowy hacking-for-hire outfit accused of running cyber-espionage campaigns for the regime for over a decade.

The move, announced on August 24 under the banner Operation Economic Outcast, is part of a broader push by Treasury Secretary Scott Bessent to choke off the financial flows that keep Tehran’s destabilizing activities afloat.

These Mabna Institute sanctions are the latest salvo in a long-running cat-and-mouse game between US authorities and Iranian cyber operatives. But this time, there’s a twist: the Treasury’s Office of Foreign Assets Control (OFAC) didn’t just name names. It also froze 30 cryptocurrency addresses linked to four of the defendants, spanning Bitcoin, Ethereum, and TRON.

That’s a significant escalation, and it’s sending ripples through the compliance departments of crypto exchanges worldwide.

The Indictment Behind the Sanctions

Just days earlier, on August 18, the Department of Justice (DoJ) unsealed an indictment against 17 members of the Mabna Institute. The charges paint a picture of a sprawling operation that, since at least 2013, targeted:

• 144 US-based universities
• 178 foreign universities
• At least 42 US-based private sector companies
• 11 foreign private sector companies
• Five US federal and state government agencies
• At least two non-governmental organizations (NGOs)

The scale is staggering. We’re talking about a hacking operation that systematically pillaged intellectual property and sensitive data from over 380 academic institutions across the globe. The DoJ alleges the group worked at the behest of Iran’s Islamic Revolutionary Guard Corps (IRGC), stealing research and credentials to advance the regime’s military and technological ambitions.

Follow the Crypto Trail

Here’s where it gets interesting for the blockchain world. TRM Labs, a blockchain forensics firm, dug into the 30 designated crypto addresses and found roughly $16.8 million sitting in them, dating back to 2018.

Most of that — about $15.5 million — is concentrated in 10 addresses tied to Keyvan Fayaz, also known by aliases like “Achilles,” “The Joker,” and “bc.monster.” TRM Labs suggests Fayaz “may have acted as a treasury of sorts for Mabna’s hacking-for-hire operations.”

Another $1.2 million is linked to 15 addresses associated with Behzad Mesri, a defendant separately charged with hacking HBO. TRM Labs noted that Mesri’s addresses show “a pattern of layered transactions” — hundreds of thousands of dollars ultimately funneled to a deposit address at a large centralized exchange, likely to be cashed out.

“On-chain behavior commonly used to obfuscate source of funds,” the firm observed. In plain English: these guys were trying to wash their crypto, and the blockchain left a trail.

Operation Economic Outcast: A Sector-Wide Blow

But the Mabna Institute sanctions are just one piece of a much larger puzzle. Operation Economic Outcast doesn’t stop at individuals. It also targets entire sectors of the Iranian economy: digital assets, technology, gold, aviation, and shipping.

This is a big deal. The Treasury’s new sectoral determinations expand the categories of Iran-related conduct that can trigger secondary sanctions. In practical terms, OFAC can now go after any person or entity providing services in support of these five sectors.

TRM Labs put it bluntly: “Under the new sectoral determination, any institution that processes a significant transaction for an Iranian exchange or digital assets business in turn risks its access to the US financial system.”

That’s not a threat to be taken lightly. For crypto exchanges, fintechs, and even traditional banks with digital asset exposure, the message is clear: if you touch Iranian money, you’re in the crosshairs.

What This Means for Compliance Teams

For cryptocurrency compliance teams, the immediate takeaway is that screening just for OFAC’s Specially Designated Nationals (SDN) list isn’t enough anymore. The sectoral designations create a web of indirect exposure that requires a more nuanced approach.

TRM Labs advises that compliance teams should be ready to screen for secondary sanctions risk and flag incoming transactions from any wallets with exposure to Mabna Institute wallets. That means monitoring not just the sanctioned addresses themselves, but also any addresses that interact with them.

This is a reminder that the crypto industry’s era of lax oversight is over. The tools exist to trace these funds, and US authorities are using them aggressively. If your exchange processes a transaction from an Iranian entity — even unknowingly — you could lose access to the US financial system.

The Bigger Picture

The timing of these sanctions is no accident. The US has been ratcheting up pressure on Iran across multiple fronts, from nuclear negotiations to regional military posture. Cyber operations against Iran have been a persistent headache for Washington, and this latest move signals that the financial angle is now a primary weapon.

For the Mabna Institute, the sanctions and indictments effectively put a bounty on the heads of its members. They’re now cut off from the global financial system, their crypto wallets frozen, and their ability to operate internationally severely constrained.

Whether that will actually deter Iran’s cyber activities is another question. Hacking-for-hire operations like Mabna are often seen as a low-cost, high-reward tool for state actors. Sanctions can make life difficult, but they rarely stop determined adversaries.

Still, the message from Washington is unmistakable: if you’re going to hack for Iran, you’ll pay a price. And if you’re in the crypto business, you’d better be paying attention.