Aftonbladet

Summary

A distributed denial-of-service (DDoS) attack disrupted multiple Swedish media outlets, including Aftonbladet, and a ferry company, causing service outages over a weekend. The attack, described as "very severe" and more coordinated than prior incidents, originated from hijacked computers potentially linked to eastern regions. A deleted tweet had accused targeted media of spreading false propaganda. Sweden's police cybercrime agency collaborated

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On March 19, 2016, beginning at 19:30 local time, multiple Swedish media organizations experienced a coordinated distributed denial-of-service (DDoS) attack that disrupted their online services. The targeted entities included major news outlets Dagens Nyheter, Expression, Svenska Dagbladet, Aftonbladet, Sydsvenskan, Helsingborgs Dagblad, financial publication Dagens Industri, and ferry operator Destination Gotland. The attack rendered websites inaccessible for an unspecified duration, with the Industry Association Newspaper Publishers in Sweden characterizing the incident as "very severe" in scale. A deleted tweet prior to the attack had threatened Swedish media and government entities for allegedly spreading "false propaganda," though no direct attribution was established between this threat and the attackers. Sweden's Police Cybercrime Agency confirmed the attacks originated from hijacked computers, with vague geographical indicators suggesting possible Eastern European involvement, though authorities cautioned against premature attribution due to potential obfuscation techniques.

Swedish law enforcement and security agencies, including the Civil Contingencies Agency and Police Cybercrime Agency, initiated response measures by engaging national and international partners to trace the attack sources. Most affected organizations restored services after implementing mitigation strategies, though specific technical remediation details weren't disclosed. Anders Ahlqvist of the Police Cybercrime Agency noted the attack demonstrated greater coordination than previous large-scale DDoS incidents targeting Sweden in 2012. No group claimed responsibility, and investigations remained ongoing at the time of reporting. The incident highlighted systemic vulnerabilities in media infrastructure while demonstrating organizational capacity to restore critical services under sustained attack conditions.

Sources

Sources available to members: 1 source.