Norwegian Ministry of Foreign Affairs

Summary

Norwegian entities, including the Ministry of Foreign Affairs, Labour Party, and defense sectors, were targeted in a cyberattack attributed to the Russia-linked group "Cozy Bear." The attackers employed spear phishing techniques to compromise email accounts across multiple organizations, such as the Police Security Service and a radiation protection authority. While no classified information was exfiltrated, officials described the incident as a serious threat to democratic institutions. The breach occurred amid heightened tensions following the deployment of foreign troops in Norway, with security services receiving prior warnings from an unnamed international partner about targeted email server attacks.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On or around February 3, 2017, Norway’s Police Security Service (PST) disclosed that nine email accounts across multiple government and institutional entities had been compromised by hackers. The targeted organizations included the Norwegian Ministry of Foreign Affairs, Ministry of Defense, Labour Party, PST itself, the Radiation Protection Authority, and an unidentified college. Security officials attributed the attacks to a Russia-linked group known as "Cozy Bear," which U.S. authorities had previously implicated in the 2016 Democratic National Committee breach. The attackers employed spear-phishing techniques to harvest sensitive credentials, though PST confirmed no classified information was exfiltrated. Investigations revealed the intrusions began earlier in 2017, with PST receiving warnings from an unnamed foreign partner about targeted email server attacks prior to the public disclosure.

Prime Minister Erna Solberg characterized the incident as "a serious attack on our democratic institutions," emphasizing its political significance despite the absence of classified data loss. The breach occurred amid heightened bilateral tensions following the January 2017 deployment of 300 U.S. Marines to Norway—the first foreign troop presence there since World War II—which drew criticism from Russia. PST spokesman Martin Berntsen confirmed the agency’s forensic review but did not disclose technical specifics of the compromised systems or additional mitigation measures. No disruptive follow-on activities, such as data leaks or ransomware, were reported following the credential theft. The incident underscored persistent vulnerabilities in governmental email infrastructures to socially engineered attacks by state-aligned threat actors.

Sources

Sources available to members: 3 sources.