hw_1a4d816bce81ce31

Prorysk DDoS-kampagne forstyrrer estisk regeringsautentificering og rammer kritiske sektorer

I begyndelsen af september 2026 oplevede Estland en koordineret serie af denial-of-service-angreb mod en bred vifte af offentlige og kritiske digitale tjenester. Estlands Informationssystemmyndighed (RIA) rapporterede, at målene omfattede bank-, sundheds-, energi-, transport- og vandsektortjenester, regeringswebsteder og politiske partiers portaler. Nogle tjenester oplevede midlertidige forsinkelser eller tilgængelighedsproblemer. RIA erklærede, at angrebene blev præsenteret af angriberne som gengældelse for Estlands støtte til Ukraine og præsidentvalget den 2. september. Separat identificerede overvågning af NoName057(16)-aktivitet den prorussiske gruppe som angriber af estiske mål inden for offentlig forvaltning, parlamentarisk autentificering og bankvirksomhed i denne periode. Den 11. september forårsagede kampagnen en særligt betydelig forstyrrelse af Estlands statslige autentificeringstjeneste TARA, som bruges til at autentificere brugere, der tilgår statslige elektroniske tjenester. Angrebet genererede cirka 86,1 millioner anmodninger, mere end 100 gange den almindelige timetrafik. Cloudflare blokerede cirka 91 % af den ondsindede trafik, men det resterende volumen forårsagede forsinkelser og midlertidige forstyrrelser mellem 11:12 og 11:57. Selve angrebet fortsatte indtil cirka 12:15. Fordi Estland officielt bekræftede både kampagnens politiske motivation og den faktiske tjenesteforstyrrelse, mens den præcise russiske stats kommandokæde forbliver ubevist, er overensstemmelse med mønsteret det passende attributionsniveau.

Hændelse: 2026-09-11
Offentliggørelse: 2026-09-11
Først observeret: 2026-10-10T04:30:13.070Z
Kontrolstatus: Ikke vurderet
Lande: EE
Opdateret: 2026-10-10T04:30:13.070Z

Attribution

Officiel

Fakta

Ingen fakta

Kilder

Pro-Russian DDoS campaign disrupts Estonian government authentication and targets critical sectors.

Rolle
discovery_lead

Dato
2026-09-11T14:58:08Z

During early September 2026, Estonia experienced a coordinated series of denial-of-service attacks against a broad range of public and critical-sector digital services. Estonia’s Information System Authority (RIA) reported that targets included banking, healthcare, energy, transportation and water-sector services, government websites and political-party portals. Some services experienced temporary delays or availability problems. RIA stated that the attacks were presented by the attackers as retaliation for Estonia’s support for Ukraine and the presidential election held on 2 September. Separately, monitoring of NoName057(16) activity identified the pro-Russian group as attacking Estonian public-administration, parliamentary-authentication and banking targets during this period. On 11 September, the campaign produced a particularly significant disruption against Estonia’s TARA state authentication service, which is used to authenticate users accessing government electronic services. The attack generated approximately 86.1 million requests, more than 100 times ordinary hourly traffic. Cloudflare blocked approximately 91% of the malicious traffic, but the remaining volume caused service slowdowns and temporary disruptions between 11:12 and 11:57. The attack itself continued until approximately 12:15. Because Estonia officially confirmed both the campaign’s political motivation and actual service disruption, while the precise Russian state chain of command remains unproven, Fitting the pattern is the appropriate attribution level.