Cyber Incident Victim: Eduskunta
Date:
Aug 2022
Location:
Finland
Summary
A pro-Russian hacker group targeted the Finnish parliament's website with a distributed denial-of-service (DDoS) attack, causing several hours of downtime. The group NoName057(16) claimed responsibility on Telegram, citing Finland's NATO aspirations as motivation, aligning the attack with broader geopolitical tensions following Russia's invasion of Ukraine. The incident coincided with U.S. support for Finland and Sweden's NATO accession. NoName057(16) had previously collaborated with another pro-Russian syndicate, Killnet, to disrupt digital services in nations backing Ukraine, as part of a declared cyber campaign against NATO and its allies. This attack reflects ongoing retaliatory operations by Russian-aligned threat actors against perceived adversaries in the conflict.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On August 9, 2022, the Finnish Parliament’s external websites became inaccessible for several hours due to a distributed denial-of-service (DDoS) attack conducted by pro-Russian threat actors. The Parliament confirmed the incident in a public statement, noting collaboration with service providers and the Cybersecurity Center to mitigate the attack’s impact. The hacker group NoName057(16) claimed responsibility through their Telegram channel, explicitly linking the attack to Finland’s pursuit of NATO membership. They described the incident as a "friendly visit" in response to Finnish authorities’ eagerness to join the alliance. The timing coincided with U.S. President Joe Biden’s formal signing of documents endorsing Finland and Sweden’s NATO accession. Finland had formally applied for NATO membership on May 18, 2022, amid heightened regional tensions following Russia’s full-scale invasion of Ukraine in February 2022.
NoName057(16) had previously partnered with another pro-Russian group, Killnet, in late June 2022 to execute DDoS attacks against nations supporting Ukraine. The group openly declared hostilities against NATO and Ukraine-aligned states, framing their actions as retaliation for Western involvement in the Ukraine conflict. This incident occurred against a backdrop of reciprocal cyber operations between pro-Ukrainian and pro-Russian factions, with groups like Anonymous and Ukraine’s IT Army targeting Russian infrastructure since the war’s onset. The United Nations reported widespread displacement of over 12 million Ukrainians and documented severe human rights violations in Russian-occupied territories, contributing to Russia’s suspension from the UN Human Rights Council. The Finnish Parliament’s website disruption represented a localized component of this broader geopolitical cyber conflict, with no additional technical details or secondary impacts disclosed beyond the temporary unavailability of public-facing web services.