APREX · EST. 2026
Artificial intelligence is no longer merely a tool for productivity and innovation — it has become a weapon in Russia's hybrid war against the West. For the Nordic countries, and Norway in particular, this is not a matter of future scenarios but of events that have already taken place.
Norwegian Dam Hacked to Demonstrate Capability
In April 2025, the Norwegian Water Resources and Energy Directorate received an uncomfortable demonstration of Russia's reach: pro-Russian hackers remotely seized control of a valve at a dam in Bremanger in Vestland county, releasing 500 litres of water per second. The situation lasted approximately four hours before it was brought under control.
The Norwegian Police Security Service (PST) confirmed to High North News that this was a deliberate attack, carried out to demonstrate that Russia has the capability to compromise Norwegian critical infrastructure. It was not an accident — it was a message.
Norwegian Intelligence (E-tjenesten) has subsequently warned of what it describes as "persistent and serious" threats from Russia, amplified by artificial intelligence. The petroleum sector in particular is identified as a high-priority target, with Russia allegedly mapping offshore installations and infiltrating digital supply chains.
It was not an accident — it was a message that Moscow can reach Norwegian infrastructure whenever it chooses.
Denmark Hit by Coordinated Mass Attack
Norway is not alone in feeling the weight of Russian cyber pressure. In May 2023, 22 Danish energy companies were successfully attacked simultaneously — an operation that Denmark's sector-based CERT described as the largest cyberattack against Danish critical infrastructure ever recorded.
The investigation uncovered links to Russia's military intelligence agency, the GRU, also known as the Sandworm group. The attackers had detailed advance knowledge of their targets and carried out the operation with high precision.
In 2024, the threat escalated further: a hack targeting a Danish waterworks in Køge resulted in an attacker taking control of pump pressure, causing three pipe bursts. The Danish Defence Intelligence Service (DDIS) disclosed in December 2025 that pro-Russian groups including Z-Pentest and NoName057(16) were explicitly used as "instruments in Russia's hybrid war against the West."
AI "Poisons" Nordic Chatbots
Running in parallel with the physical sabotage is a more subtle but potentially equally dangerous operation: the systematic infiltration of Nordic-language AI models.
Nordic fact-checking organisations have documented that Russian propaganda sites have actively planted content in the training data of popular AI chatbots. When users ask questions in Norwegian, Danish, Swedish, or Finnish, these systems can in some cases reproduce Russian propaganda — and in certain instances link to Russian disinformation sources that are otherwise blocked.
The phenomenon is referred to in professional circles as "LLM grooming" or "AI poisoning." The strategy is to infect the information ecosystem by embedding Russian narratives into what AI systems perceive as credible knowledge.
AI-Driven Cyberattacks Growing in Sophistication
Russia is also deploying AI on the offensive side. The Russia-linked threat actor known as "GreyVibe" has been documented using generative AI tools actively in attack preparation — including the development of tailored malware, the construction of fake websites, and the crafting of targeted phishing emails.
Ukrainian authorities report that Russia is now building AI directly into its malware, so that malicious commands are generated dynamically during an attack. This makes it significantly harder for traditional security tools to detect and stop threats in time.
Ukraine's Centre for Countering Disinformation has recorded 191 instances of Russian information operations using AI since the start of 2025 alone — a marked acceleration.
Is the Nordic Region Being Divided by Divergent Threat Perceptions?
In its coverage, High North News raises the question of whether the Russian AI threat is contributing to divisions among the Nordic countries, which have historically taken very different approaches to Russia. Finland's and the Baltic states' long-standing awareness of Russian pressure stands in contrast to the more cautious stance some western NATO allies have maintained.
Concrete incidents such as the dam hack in Bremanger and the coordinated Danish energy attacks are, however, making it increasingly difficult to dismiss the threat as abstract. For Norway, with its strategically vital petroleum sector and extensive coastline, this is something Norwegian authorities and the business community must treat as an ongoing operational reality — not a future risk.
The question that remains is whether the Nordic response will prove as coordinated and swift as the Russian attacks it is meant to counter.