A day of digital chaos in Norway

For more than 30 hours, a relentless DDoS attack has been hammering the digital infrastructure that Norwegians rely on for everything from logging into government portals to picking up prescriptions. The Norwegian Digitalisation Agency, known as Digdir, confirmed that the attack began on Monday and has continued with varying intensity, leaving a trail of disrupted services in its wake.

This isn’t just a minor inconvenience. Ten digital services have been affected, including the critical ID-porten system, which serves as a gateway to thousands of government services. With over 4.5 million users, ID-porten is the digital key to Norway’s public sector, and its downtime has sent ripples across the country.

What exactly was hit?

The attack targeted the infrastructure of Vivicta, Digdir’s IT partner. According to Digdir’s status page, the affected services include identity verification, login systems, data exchange between government agencies and businesses, access to public records, and employee access management. That’s a broad swath of the digital public sphere.

One of the most concerning knock-on effects was on Norway’s health infrastructure. Several health services depend on ID-porten for authentication, meaning patients faced potential problems accessing online pharmacies and the country’s electronic prescription system. For a nation that prides itself on digital efficiency, this was a stark reminder of how fragile that efficiency can be.

Not the first time, and getting bigger

This is the third DDoS incident to hit Digdir’s services since June, according to Norwegian media. But it’s not just a repeat performance. Are Kvistad, a press officer at Digdir, told public broadcaster NRK that this attack is “two to three times larger than what we experienced last time.” That’s a significant escalation, and it raises questions about whether these incidents are connected or part of a broader campaign targeting Norway.

So far, no group has claimed responsibility, and it’s unclear who’s behind the assault or whether the recent incidents are linked. What is clear is that the attackers didn’t manage to breach sensitive data. Digdir has stated that no sensitive information stored in the affected systems was compromised. That’s a small comfort, but a comfort nonetheless.

What’s being done about it?

Digdir is working closely with Vivicta to stabilize the systems and bring services back online. As of Tuesday morning, some services were gradually returning, but the attack was still affecting others. The response has been a mix of technical mitigation and public communication, with Digdir keeping a status page updated for concerned citizens.

For those watching from the sidelines, this is a textbook case of how a DDoS attack works: flood the servers with traffic until they can’t handle legitimate requests. It’s a blunt instrument, but it can be devastatingly effective when aimed at critical infrastructure.

The bigger picture: A trend or a one-off?

The repeated nature of these attacks on Digdir’s services is worrying. Three incidents since June suggests a pattern, even if the motives remain unclear. Could this be a test of Norway’s defenses? A political statement? Or just a particularly persistent group of cybercriminals? Without more information, it’s hard to say.

What is certain is that Norway isn’t alone in facing this threat. DDoS attacks on government services have become a common tool for hacktivists and state-sponsored actors alike. The recent incidents in Norway could be a sign of things to come, not just for the country but for the region.

What should citizens expect?

For now, the advice is to be patient. Digdir is working to restore full functionality, but it’s a process. If you’re in Norway and need to access public services, it’s worth checking the status page before trying to log in. And if you’re waiting for a prescription, you might want to give it a little more time.

The attack may be over soon, but its implications will linger. This incident has exposed vulnerabilities in Norway’s digital infrastructure that will likely require a hard look at how such services are protected. For a country that has embraced digitalization so fully, the stakes are high.

As the situation develops, one thing is clear: the digital age has brought immense convenience, but it has also opened the door to new kinds of chaos. Norway is now learning that lesson firsthand.

The Day a Trusted Maintainer’s Account Went Rogue

On August 20, someone quietly slipped into a well-known open-source maintainer’s account on crates.io, the official package registry for the Rust programming language. They didn’t cause a scene. Instead, they updated three legitimate crates — arrayref, internment, and append-only-vec — with a hidden backdoor. By the time the security team at Wiz noticed, the damage was already spreading.

This wasn’t a random act of digital vandalism. Wiz researchers Rami McCarthy and Benjamin Read tied the attack to state-sponsored North Korean threat actors, a group Microsoft tracks under the name Sapphire Sleet. The same infrastructure and tactics were used in earlier campaigns against the Mastra framework and npm packages targeting the Axios library.

The Rust supply chain attack is a stark reminder that open-source ecosystems are now a primary battlefield for nation-state espionage.

How the Backdoor Worked Without Touching Source Code

Here’s the sneaky part: the attackers didn’t inject malicious code directly into the crates’ source. Instead, they tweaked the package manifests to pull in an external, typosquatted dependency called proc-macro1. That rogue package exploited Rust’s build process — the very automation that developers rely on to compile projects quickly.

When a developer ran cargo build, the malicious payload executed automatically. No user interaction needed. No suspicious binary to spot. Just a normal build that silently triggered a download and ran unauthorized code in the background.

“Because build scripts run during compilation, building an affected project was sufficient to execute the payload,” the Wiz researchers explained.

That means even if the resulting software was never deployed or run, the machine that compiled it was already compromised. For security teams, this is the nightmare scenario: a supply chain infection that happens before the code even exists as a final product.

What the Malware Was After

Once triggered, the malicious binary went hunting for sensitive data. Its targets included:

• Stored web browser credentials
• Cryptocurrency wallet extensions
• Developer environment secrets, like API keys and cloud tokens

It’s a classic espionage playbook — steal credentials that can be used to pivot deeper into corporate networks.

The Blast Radius: 75% of Cloud Environments With Rust Apps

The scale of this Rust supply chain attack is sobering. According to Wiz telemetry, arrayref alone was present in roughly 75% of cloud environments running Rust applications. At the time of writing, that crate had over 245 million downloads on crates.io. The other two compromised crates, internment and append-only-vec, had 14.4 million and 4.5 million downloads respectively.

Those numbers put the potential exposure in the hundreds of thousands of developer machines and CI pipelines. Wiz’s report, published just hours after the campaign began, highlighted how a single compromised maintainer account could ripple across the entire ecosystem.

Why Rust Builds Made This Attack So Effective

Rust’s build system is powerful — but that power comes with risk. Build scripts run arbitrary code by design, which is how the proc-macro1 dependency executed its payload. For developers, this means the trust model of open-source dependencies is now under direct attack.

Security teams need to understand that a compromised dependency in a build pipeline is just as dangerous as a runtime vulnerability. In some ways, it’s worse, because the infection happens before security tools have a chance to inspect the final binary.

Strong North Korean Ties and the Sapphire Sleet Connection

The Wiz investigation didn’t stop at the malicious code. They traced the command-and-control (C2) infrastructure and found clear fingerprints of known North Korean operations. The network communication patterns, server setups, and specific endpoint paths were nearly identical to those used in previous campaigns.

Microsoft and other threat intelligence teams have attributed these operations to Sapphire Sleet, a North Korean state-sponsored group with a history of targeting software supply chains. The Wiz researchers noted that “the arrayref infrastructure substantially overlaps with operations attributed to recent North Korean actors.”

This is part of a broader trend: state-sponsored adversaries are increasingly weaponizing developer ecosystems to gain initial access to downstream enterprise networks. They’re not just attacking companies directly — they’re attacking the tools those companies build with.

What to Do If You Compiled the Tainted Crates

The Rust Security Response Team acted quickly after Wiz reported the issue. They revoked the compromised maintainer’s credentials and removed the malicious crate versions from crates.io. But for anyone who built projects during the affected window, the cleanup is more involved.

Because the payload executed during the build phase, the infection isn’t limited to the final software. Any system that compiled the tainted crates should be treated as potentially compromised. Security teams are urged to:

1. Inspect dependency lockfiles for the affected crate versions
2. Treat any machine that built these crates as compromised
3. Rotate credentials, cloud secrets, and API keys accessible on those systems

This incident is a reminder that supply chain security isn’t just about scanning for known vulnerabilities. It’s about monitoring build processes, auditing dependencies, and preparing for the worst. For a deeper look at how similar attacks have targeted other ecosystems, check out our analysis of npm supply chain attacks and the broader software supply chain security risks facing modern development teams.

The Rust supply chain attack may be contained, but the lessons it leaves behind are permanent. Trust in open-source code is precious — and increasingly, it’s being exploited.

A quiet shift in how Britain polices its tech supply chain

London is moving to give ministers a blunt new tool: the power to quietly cut risky technology vendors out of the country’s most vital industries. And in some cases, the public may never know which company got the boot.

The changes, tucked into amendments to the Cyber Security and Resilience Bill published on Monday, borrow heavily from the legal playbook used to push Huawei out of Britain’s 5G networks. But they strip away several of the transparency safeguards that came with that earlier regime.

Under the current telecoms law, the government must publicly designate a vendor as a security threat before it can act. Not so with these new proposals. Ministers would be able to issue a so-called “vendor-related direction” without naming the supplier publicly, and without even sending the vendor a copy of the order. The company on the receiving end could also be barred from talking about it.

Beyond telecoms: who’s in the crosshairs?

The scope is what makes this different. The powers wouldn’t stop at phone networks. They’d extend to managed service providers, data centers, digital infrastructure, and the energy, water, transport and health sectors.

A senior minister could order a company in any of those areas to stop buying from a specific supplier, restrict how its products are used, or even force the removal of equipment that’s already installed. Think of it as a national security off-switch for the supply chain.

What the government says — and what critics worry about

Liz Lloyd, the recently reappointed cybersecurity minister, framed the powers as a preventive measure. “We can act before a threat materialises, not just after the damage is done,” she said, adding that the goal is to put “national security at the heart of how essential services choose their suppliers.”

But the secrecy provisions are raising eyebrows. While the government would have to publish a notice that a direction had been issued, only the recipient company would be named. The vendor itself could stay anonymous. Details could be withheld on national security or commercial grounds, and anyone consulted before the order — including the vendor — could be gagged from even acknowledging the consultation took place.

Security officials have previously pushed back against similar secret powers in other high-profile cases. When Apple sought to introduce end-to-end encryption for iCloud, officials reportedly described such covert measures as unsustainable and unjustifiable. This new bill seems to lean in the opposite direction.

How it mirrors the Huawei 5G ban — and where it breaks from it

The mechanics will feel familiar to anyone who followed the Huawei saga. The Telecommunications (Security) Act 2021 gave ministers the authority to intervene on national security grounds, which they used to force the Chinese equipment maker out of UK 5G infrastructure.

Both laws share that core premise. But the new bill goes further by allowing ministers to skip the usual step of giving both the affected company and the supplier a chance to respond before an order is issued — if national security demands it.

A partial transparency compromise

There is one nod to openness: the amendments add a publication duty that the telecoms act lacks. The government would have to announce publicly that an order had been issued and identify the recipient. But that notice wouldn’t necessarily reveal which vendor was targeted, and details could still be withheld.

So a water utility, a hospital trust, or a data center operator could be named as having received a direction, while the public is left guessing which supplier triggered the alarm.

The government would also have to report annually to Parliament on how many directions were issued, which sectors were affected, and how many were later varied or revoked. That’s a small accountability window, but it’s something.

Who else could get caught up in this?

Here’s a wrinkle: the powers wouldn’t just apply to companies already regulated as part of critical national infrastructure. Ministers could use regulations to sweep in any person or business they deem to be engaged in essential activity in the UK, or providing essential goods or services. That’s a broad net.

There’s also a layer of bureaucratic control. A company issued a direction would need written government approval before hiring an outside specialist to help it comply. And in deciding whether to grant that approval, ministers could rely on a list of pre-approved specialists published by GCHQ. That’s a notable expansion of the intelligence agency’s role in commercial decisions.

What happens next

The amendments are scheduled for committee stage in the House of Lords in September. That’s where the details will get picked apart — and where critics will likely push for more transparency.

The bill’s trajectory is worth watching. If it passes as drafted, Britain will have a powerful new way to quietly sever ties with risky tech suppliers, but at the cost of a more opaque decision-making process.

For companies operating in critical sectors, the takeaway is clear: supplier choices could soon carry national security implications, and the government may not always tell you why.

For a deeper look at how the UK has handled similar threats, check out our coverage of Huawei’s removal from UK 5G networks and the broader debate over national security and technology supply chains.