Hackers breached the Norwegian government by using a previously unknown vulnerability in third-party software.
The hackers exploited the zero-day vulnerability to infiltrate an IT platform used by 12 Norwegian government ministries. “We have uncovered a previously unknown vulnerability in the software of one of our suppliers,” the country’s government said on Monday.
In response, authorities have shut down mobile services, including email, for government employees, although other ministry systems continue to operate normally. “We have now closed this vulnerability. It is too early to say anything about who is behind it and the extent of the attack,” the Norwegian Government Security and Service Organisation (DSS) announced.
It's not clear which software platform the zero-day targeted or how long the hackers had access. For now, local authorities have only said that most Norwegian ministries were using the affected IT platform. The only exceptions are the Prime Minister's office, the Ministry of Defence, the Ministry of Justice, and the Ministry of Foreign Affairs.
“We monitor the systems continuously, and we introduce further measures if necessary,” the DSS added, noting that police continue to investigate the incident.
Earlier this month Microsoft warned that a mysterious Russian hacking group, dubbed Storm-0978, is targeting organizations based in Europe and North America. The hacking group relies on phishing attacks, and acquiring zero-day exploits to use on targets. This includes an exploit for a Microsoft Office vulnerability, CVE-2023-36884, which the company patched a couple weeks ago.
“Storm-0978’s targeted operations have impacted government and military organizations primarily in Ukraine, as well as organizations in Europe and North America potentially involved in Ukrainian affairs,” Microsoft added.