The attack started at 03.38 CEST on Monday and has targeted the infrastructure supporting services operated by the Norwegian Digitalization Agency, Digitaliseringsdirektoratet (Digdir), and its operations provider, Vivicta.
Massive DDoS attack disrupts Norway’s government digital services
Bill Toulas
- August 25, 2026
- 11:52 AM
- 0
A large distributed denial-of-service (DDoS) attack has disrupted Norway’s shared government digital infrastructure since Monday, affecting services used by the public sector.
The attack started at 03.38 CEST on Monday and has targeted the infrastructure supporting services operated by the Norwegian Digitalization Agency, Digitaliseringsdirektoratet (Digdir), and its operations provider, Vivicta.
Digdir operates Norway’s shared digital government infrastructure, including public-service logins, electronic IDs and signatures, secure digital mail, government forms, public-record access, and data exchange between agencies.
In an announcement published earlier today, the organization states that several services were completely unavailable for short periods.
The agency says many affected systems have now been stabilized, although some services, like ID-porten and eSignering, remain partially inaccessible.
- As a result of the attack, users may encounter errors such as failed connections, slow server responses, and unusually long login times.
For live updates on the availability of Digdir services, people may consult the services' operating status page as well as the incident report page with updates from Norway's Directorate for Digitization.
Digdir director Frode Danielsen says the investigation into the incident showed no indication of a security breach affecting the organization’s systems or any compromise of personal data.
Danielsen added that this is the third DDoS attack targeting Digdir recently, following one in June and another on August 3.
The Norwegian National Security Authority (NSM) and the Norwegian Data Protection Authority (Datatilsynet) have been notified accordingly.
There is currently no official attribution for the attack, although Norwegian media have speculated about potential Russian involvement.
Meanwhile, services that rely on Digdir but are not directly targeted also experience disruptions.
Altinn, Norway’s central digital platform for communication between citizens, businesses, and government agencies, published a warning about login issues and operational problems, linking to Digdir’s status page.
Skatteetaten, Norway’s tax administration agency, displays a similar notice about login issues on its website and urges users to try again later.
-
Webinar: How AI broke the Pyramid of Pain
The Pyramid of Pain works on the core idea that the higher your detections are up the pyramid, the harder you are to evade. But AI has collapsed the value of the bottom layers to zero.
The latest webinar from Push Security explains how this change impacts detection and response, and what security teams can do about it.
Hospital operator Nutex Health says data stolen in cyberattack
Healthcare and services provider Nutex is investigating a data breach incident where an unauthorized third party exfiltrated information from company servers.
- August 25, 2026
- 10:44 AM
0
From Fake Workers to Account Recovery: The Growing Identity Verification Risk
Attackers are increasingly targeting the processes used to establish or recover identity rather than attacking the login itself. Specops explains how stronger identity verification can help organizations prevent fake workers and social engineering attacks from gaining legitimate access.
- August 25, 2026
- 10:01 AM
- 0
Microsoft PowerToys adds Alt+Tab-style switching for an app's windows
Microsoft updated its Windows PowerToys toolset with a new utility dubbed "Window Hopper" that lets users switch between an app's windows more quickly.
- August 25, 2026
- 09:51 AM
- 0
WhatsApp adds stronger two-step verification, multiple passkeys
WhatsApp has started rolling out several new account security features, including support for multiple passkeys and stronger two-step verification.
- August 25, 2026
- 09:00 AM
- 0
Hackers breached over 270 Zimbra servers in ongoing attacks
Threat actors have already compromised over 270 Zimbra instances in remote code execution attacks targeting a high-severity Zimbra Collaboration Suite (ZCS) vulnerability.
- August 25, 2026
- 08:04 AM
- 0
Get 3 years of Surfshark VPN on unlimited devices for just $83.99
A VPN subscription becomes considerably more practical when it doesn't make you choose which devices deserve protection. This 3-year Surfshark VPN Starter Plan costs just $83.99 (MSRP $430) and supports unlimited devices under one subscription.
- August 25, 2026
- 07:12 AM
- 0
Police arrests dozens of suspects in global cybercrime crackdown
Law enforcement agencies from 22 countries helped identify 263 suspects and arrested 58 individuals linked to cybercrime networks coordinated by African crime groups.
- August 25, 2026
- 06:53 AM
- 0
Unpatched Calix flaw lets hackers bypass NAT to expose internal devices
An unpatched vulnerability in Calix GS7 XGS (GS5239XG) residential routers used by multiple U.S. broadband providers allows remote, unauthenticated attackers to create port-forwarding rules that can expose local network devices to the public internet.
- August 24, 2026
- 05:14 PM
- 1
Hackers target WordPress sites in miniOrange auth bypass attacks
Hackers are attempting to exploit two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin for WordPress that can be used to forge SAML responses and log in as administrators.
- August 24, 2026
- 03:26 PM
- 1b
A breach at South Korea's government-backed startup platform exposed encrypted personal data after an encryption key was included in an API. Penta Security explains why encryption keys must be securely managed and kept separate from the data they protect.
- August 24, 2026
- 10:00 AM
- 0
Microsoft shares temporary fix for Windows 11 gaming issues
Microsoft has shared a temporary fix for ongoing gaming issues caused by Windows 11 updates released during the August 2026 Patch Tuesday.
- August 24, 2026
- 05:42 AM
- 0
Source: Zimperium
The ToxicPanda Android malware has evolved with new malicious functionality, expanding its targeting to 349 applications and adding support for 167 remote commands.
The malware now requests VPN service permissions to create a local interface that allows it to control network traffic passing through it. The feature enables ToxicPanda 2.0 to block communication from Google Play and Google Play Services.
Control at the network level permits the malware to interfere with various security checks and actions, such as app verifications, updates, Play Protect communication, or legitimate disruptions designed to protect users.
ToxicPanda Android malware uses VPN permissions to block Google Play
Bill Toulas
- August 23, 2026
- 10:23 AM
After obtaining VPN service permissions, ToxicPanda 2.0 blocks communications to Google Play before extracting and installing its payload, then requests Accessibility Service permissions.
Mobile security company Zimperium says that ToxicPanda 2.0 is being distributed through Amazon AWS-hosted buckets.
- Analysis of the malware revealed that it now includes functions to automate the Android Wireless Debugging Bridge (ADB), enabling shell-level access to infected devices.
It also includes a separate PIN-harvesting module that targets 140 financial and cryptocurrency apps and can dynamically update the target list.
According to the researchers, the app overlays are invisible to the victim, allowing the malware to capture touch inputs on targeted apps.
ToxicPanda also spoofs the Android lock screen to capture device PINs, unlocking patterns, and passwords.
Abusing ADB
One feature that stands out in the analyzed recent Toxic Panda version is its automatic abuse of the Android Debug Bridge (ADB) to gain shell access.
ADB is the command-line tool for executing shell commands on Android devices. Wireless ADB, introduced in Android 11, provides this access over Wi-Fi without a USB connection.
Using the Accessibility Services permission, the malware enables Developer Options, activates Wireless Debugging, extracts the six-digit ADB pairing code and port, and connects with the device’s local ADB service.
“Once the malware gains shell user permissions, it starts executing high-privilege commands directly through the ADB daemon, the malware bypasses standard Android runtime consent prompts to grant itself broad permissions, neutralize OS background restrictions, silently enable critical components, and enforce persistence,” Zimperium explains.
Wireless ADB abuse is a growing trend among Android malware, as other Android malware authors have implemented it in their malicious tools. Recently, Group-IB reported a similar mechanism implemented in the latest version of the RedHook malware.
Zimperium has published a list of indicators of compromise (IoCs) associated with the latest ToxicPanda version in this GitHub repository.
No comments:
Post a Comment