| The Record from Recorded Future News
therecord.media
Alexander Martin
February 6th, 2026
Norwegian intelligence discloses country hit by Salt Typhoon campaign
Norway’s domestic security agency confirmed Friday that the Chinese state-sponsored espionage campaign tracked as Salt Typhoon compromised network devices in Norwegian organizations.
The disclosure was made in the Norwegian Police Security Service’s (PST) annual threat assessment for 2026. The agency’s director general, Beate Gangås, said Norway was “facing its most serious security situation since World War II,” citing pressure from multiple foreign intelligence services.
Salt Typhoon is the name U.S. and allied authorities use for a Chinese cyber espionage campaign that has focused heavily on breaching telecommunications and other critical infrastructure. In its report, PST said the actor has exploited vulnerable network devices in Norway.
Gangås said foreign states — particularly China, Russia and Iran — are “conducting intelligence operations and employing hybrid tactics in Norway to undermine our resilience,” stressing the “vital” need for stronger protective security, intelligence and situational awareness.
The assessment said Chinese security and intelligence services have strengthened their ability to operate in Norway, including through cyber operations and human intelligence collection, adding that “the primary intelligence threat from China is in the cyber domain.”
China is described as posing a “substantial” threat and is expected to continue improving its efforts to collect intelligence and map Norwegian digital infrastructure.
PST also warned that China is “systematically” exploiting collaborative research and development projects to bolster its own military capacity and security capabilities.
Salt Typhoon has been linked to significant breaches of telecommunications providers and other critical infrastructure abroad. U.S. officials have said the campaign allowed attackers to intercept communications linked to senior political figures during the 2024 presidential race, including Donald Trump and JD Vance.
Last year, more than a dozen allied countries issued a joint advisory blaming three Chinese technology companies for enabling the espionage campaign, saying the intrusions were used to track the communications and movements of specific targets.
While China dominates the cyber threat picture, PST said Russia remains the principal overall threat to Norway’s security. The agency cited sustained espionage, mapping of critical infrastructure, pressure on Ukrainian refugees, covert intelligence operations using civilian vessels and the risk of sabotage.
Russian intelligence has been “closely monitoring military targets and allied activities and capabilities in Norway for many years,” the report said, adding that the tense geopolitical situation in Europe is likely to drive increased activity.
PST said it expects that to include more Russian cyber operations, influence campaigns and attempts to recruit sources via digital platforms in 2026, describing cyber activity as an integral part of Moscow’s broader intelligence effort alongside traditional espionage and influence work.
“The tense geopolitical situation in Europe means that Russian intelligence has several areas of interest in relation to Norway and other NATO countries. Given the increase in military targets on Norwegian soil, the stronger allied presence, and additional military exercises, we anticipate heightened activity from Russian intelligence services,” the agency added.
Iranian intelligence services are also expected to carry out intelligence and influence operations in Norway, the PST said, warning the regime may attempt to target Western interests through property damage, targeted assassinations, terrorist acts or destructive cyber operations.
The PST said the assessment underlines the need for closer cooperation between authorities and the private sector, particularly operators of critical infrastructure, as foreign intelligence services increasingly combine cyber operations with more traditional espionage and influence campaigns.
Cyberattacks are part of Russia’s hybrid warfare strategy, designed not only to cause harm, but to “demonstrate what they are capable of.”
The Norwegian Police Security Service suspects pro-Russian hackers sabotaged a dam in southwestern Norway in April.
Norwegian daily newspaper VG reported that the hackers breached the dam’s control system, opening valves for four hours, sending large amounts of water gushing forth until the valves could be shut.
The chief of the Norwegian Police Security Service (PST) Beate Gangås, disclosed the incident during a presentation on pro-Russian cyber operations at a public event on Wednesday.
According to VG, Gangås said that the number of cyberattacks on Western infrastructure was increasing, often not to cause damage but to “demonstrate what they are capable of.” She also said Norway should be prepared for further hacking attacks.
At the same event, Nils Andreas Stensønes, head of the Norwegian Intelligence Service said that Russia was the biggest threat to Norway’s security.
Cyberattacks on Western targets are part of Russia’s hybrid warfare strategy. In another water-related case in January 2024, a hacking group breached a Texas water facility’s system, causing it to overflow. The suspected hackers are linked to the Kremlin.
The dam is located in the municipality of Bremanger, approximately 150 kilometers north of the city of Bergen. Local media say that the dam is not used for energy production and that the hackers might have exploited a security gap created by a weak password.
Unidentified hackers breached a Norwegian dam's control system in April, opening its valve for hours due to a weak password.
In a concerning incident this April, unidentified hackers managed to breach the control systems of a Norwegian dam. Reportedly, hackers breached the control systems of a Norwegian dam, causing its water valve to open fully. The incident occurred at the Lake Risevatnet dam, situated near the city of Svelgen in Southwest Norway. The valve remained open for four hours before the unauthorized activity was detected.
According to the Norwegian energy news outlet, Energiteknikk, the hack did not pose a danger, as the water flow barely exceeded the dam’s minimum requirement. The valve released an additional 497 litres per second, but officials noted that the riverbed could handle a much larger volume, up to 20,000 litres per second.
The incident was discovered on April 7 by the dam’s owner, Breivika Eiendom. Norwegian authorities, including NSM (National Security Authority), NVE (Norwegian Water Resources and Energy Directorate), and Kripos (a special agency of the Norwegian Police Service), were alerted on April 10, and an investigation is now underway.
Officials suspect the breach occurred because the valve’s web-accessible control panel was protected by a weak password. Breivika technical manager Bjarte Steinhovden speculated this was the likely vulnerability. The initial point of entry allowed attackers to bypass authentication controls and gain direct access to the operational technology (OT) environment.
The Silver Dania is the third ship detained in recent weeks over concerns of intentional damage to subsea infrastructure in the Baltic Sea.
Hackers exploited a ‘zero-day’ flaw in Ivanti software to breach 12 ministries in Norway
Norway’s security officials warned around 20 critical infrastructure companies, other businesses and public agencies in the country they might also be vulnerable to a cyberattack disclosed Monday that hit 12 government ministries.
A second vulnerability affecting mobile endpoint management software from IT giant Ivanti has been discovered, according to a new advisory from the company.
Norwegian police and military were busy again this week investigating more unidentified drones seen flying over critical energy infrastructure. After a Russian man was arrested for trying to leave Norway with two drones containing lots of pictures, Prime Minister Jonas Gahr Støre likened the incidents to a new form of “hybrid threats.”
