Russian Legion Hacktivist Group Threatens Large-Scale Cyberattack on Denmark
A newly formed Russian hacker alliance, the Russian Legion, has warned of an imminent and ample cyberattack against Denmark, dubbed ‘OpDenmark.’ The group,publicly announced last week and led by the hacking collective Cardinal,comprises The White Pulse,Russian Partizan,and Inteid. This escalating threat comes amid heightened tensions and a clear demand.
According to research from TrueSec, the Russian Legion first published its threat on January 28, 2026, via its Telegram channel. The group demanded that the Danish government publicly reject a planned 1.5 billion DKK military aid package to Ukraine within 48 hours.”DDoS is just the tip of the iceberg; after 48 hours, we will switch to real cyber attacks,” the group stated, signaling a potential escalation beyond disruptive denial-of-service attacks.
Since the initial warning, TrueSec reports that the Russian Legion and its affiliated groups, Inteid and Cardinal, have shared screenshots purportedly showing Danish company websites subjected to distributed denial-of-service (DDoS) attacks. Over the past 48 hours, the alliance has claimed responsibility for targeting Danish companies and public organizations, with a particular focus on the energy sector. The main cyberattack is scheduled to commence at 6 PM Moscow Time (4 PM Danish time) today.
State-Aligned, Not State-Funded
Researchers assess that the Russian Legion is highly likely aligned with the Russian state, but not directly funded by it. This assessment aligns with broader threat intelligence, which consistently demonstrates a correlation between geopolitical events – such as Russia’s invasion of Ukraine – and increased cyber intrusion attempts originating from Russian-linked actors. These groups often engage in both psychological operations and disruptive attacks designed to sow discord and undermine Western interests.
Historically,Russian hacker groups have leveraged cyber sabotage and hacktivism to amplify data operations,aiming to intimidate and influence populations in Western nations. The current threat against Denmark appears to be a continuation of this pattern.
Expanding Threat Landscape: Targeting Critical Infrastructure
The threat to Denmark occurs against a backdrop of a rapidly evolving and increasingly complex threat landscape facing critical infrastructure operators globally. recent reporting highlights a growing vulnerability in the energy sector. On December 29, 2025, CERT Polska documented coordinated destructive cyberattacks targeting over 30 wind, solar, and combined heat and power (CHP) facilities in Poland.Attackers employed wiper malware and exploited vulnerabilities in operational technology (OT) systems to disrupt communications, though electricity and heat supply remained uninterrupted.
Self-reliant analysis from dragos identified this incident as the first notable cyberattack on distributed energy resources (DERs), representing a strategic shift from targeting centralized grid control systems to attacking decentralized generation assets. This expansion of the attack surface resulted in loss-of-view, loss-of-control, and denial-of-service conditions at affected sites.
Moreover, Microsoft Defender research revealed complex, multi-stage adversary-in-the-middle (AiTM) phishing and business email compromise (BEC) campaigns targeting energy sector organizations. Attackers exploited trusted SharePoint services and manipulated inbox rules to compromise accounts and propagate phishing operations,demonstrating the continued effectiveness of credential and email compromise as attack vectors.
Mitigation and Preparedness
Based on past incidents, TrueSec advises organizations to prioritize robust DDoS protection measures. Russian hacktivist groups frequently rely on ddos attacks as a primary tactic, and the availability of powerful DDoS-for-hire services has amplified thier intensity. Maintaining up-to-date mitigation controls, including rate limiting, geo-blocking, and dedicated DDoS protection services, can considerably reduce both the risk and operational impact of these attacks. Organizations must remain vigilant and proactive in bolstering their cybersecurity defenses to protect against this evolving threat.
Keep reading
