Russian Hacker Alliance Launches Large-Scale Cyberattack on Denmark

A recently formed Russian hacker alliance, Russian Legion, has launched a coordinated cyberattack campaign against Denmark, threatening the nation’s critical infrastructure and government services.

The alliance, which includes Cardinal, The White Pulse, Russian Partizan, and Inteid, publicly announced its formation on January 27, 2026, marking a significant escalation in state-aligned hacktivist operations targeting Western nations.

The group initiated “OpDenmark” with a series of distributed denial-of-service (DDoS) attacks aimed at disrupting Danish organizations and pressuring the government over its military support for Ukraine.

The campaign began when Russian Legion issued an ultimatum on January 28, 2026, demanding that Denmark withdraw its planned 1.5 billion DKK military aid package to Ukraine within 48 hours.

The group warned that DDoS attacks were only preliminary actions, stating that more severe cyber operations would follow if their demands were ignored.

Shortly after the deadline passed, multiple Danish companies and public sector organizations reported service disruptions, with the energy sector experiencing repeated targeting.

Truesec analysts identified the Russian Legion as a state-aligned but not state-funded threat actor, operating independently while supporting Russian geopolitical objectives.

The alliance represents a coordinated effort by established hacktivist groups to amplify their operational impact through joint campaigns.

Truesec researchers noted that this pattern follows historical precedent, where Russian-linked cyber groups escalate activity during international conflicts to create psychological pressure and operational disruption.

The attacks have primarily focused on overwhelming target systems through DDoS techniques, rendering websites and online services temporarily inaccessible.

According to the threat actors’ public statements, the main assault was scheduled to commence at 4 PM Danish time, targeting both private enterprises and government infrastructure.

Inteid, one of the alliance members, had already conducted preliminary attacks against sundhed.dk earlier in the week, demonstrating the group’s capability to disrupt healthcare services.

Attack Methodology and Tactical Approach

Russian Legion employs a multi-layered strategy that combines technical disruption with psychological operations.

The group leverages DDoS-for-hire services to generate massive traffic volumes, overwhelming target networks and exhausting defensive resources.

Their approach begins with public threats broadcast through Telegram channels, followed by low-impact attacks that serve as proof-of-capability demonstrations.

The threat actors then post screenshots of affected websites to amplify fear and create media attention, even when actual damage remains limited.

This psychological component aims to generate uncertainty among Danish citizens and pressure decision-makers, though historical data suggests these campaigns rarely escalate to catastrophic outcomes when organizations implement proper defensive measures including rate limiting, geo-blocking, and specialized DDoS protection services.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.