New Findings Challenge Attribution in Denmark's Energy Sector Cyberattacks

Forescout analysis finds two distinct intrusion waves against ~22 Danish energy organizations in May 2023: an initial wave and a separate broader mass-exploitation wave that abused Zyxel firewall flaws (notably CVE-2023-28771 and older CVEs) and led to Mirai botnet variant deployments; some communications matched IPs previously used by Cyclops Blink, but attribution to Russia-linked Sandworm is disputed and remains unconfirmed.