The Nordic threat picture

In Telenor, we systematically gather security information from a diverse range of sources and use itin our broad internal security network. This information includes assessments by national authorities in our operating regions,open-source reports from major security companies, and data from partners and commercial threat intelligence services. In addition, we leverage insights from our company-wide threat communities and their extensive networks. This comprehensive approach ensures we consistently build knowledge and awareness about current and emerging threats targeting both Telenor and the broader telecommunications industry.

The rapidly changing geopolitical landscape requires us to continually align our defences with the evolving threat landscape. This alignment enables us to implement the most effective security measures, ensuring the protection of both Telenor and society during uncertain times. Since Telenor owns and operates critical infrastructure across the Nordics, a serious security incident could have severe consequences for the entire region. Therefore, we place great emphasis on continuously assessing and updating our understanding of threats.

Outlier events indicate potential security threats

To identify hybrid threats, it is important to monitor activity outside the norm, especially in relation to frequency and consequence. This is particularly important in Telenor’s northern- and eastern-most regions.

We are also closely monitoring any changes in normal day-to-day operations. By benchmarking changes against what is typical, we can identify peculiarities and outliers that may indicate threatening changes in the security environment. Since many of our customers and suppliers are dispersed across the Nordics and play very important roles in critical functions, detecting these changes is key to ensuring the security and resilience of our operations.

Increased vulnerability in the Nordics

The Nordic region has become increasingly vulnerable with war in its vicinity and active support of Ukraine. The increased Nordic contribution, both financially and with ready-to-use equipment for Ukraine, has increased the threat profile for the region.

This has positioned us as a target for more severe and destructive cyber-attacks, both by nation state hackers, as well as rogue groups, that sympathise with Russia. The increased pressure has prompted Telenor Nordics to prioritise certain security efforts, at an increased pace.

Further escalation of the security situation in Europe will likely increase the threat of destructive sabotage, whether physical or logical, that could directly or indirectly affect Telenor. We must address this uncertainty with robust systems, effective detection and a contingency mindset.

Military and political signalling are foreign policy means of pressure where the threat actor hints at their capabilities and carries out actions to imply an unspoken threat. This strategy is also used to create fear and uncertainty with the aim of influencing political decision-making, and public opinion without having to use military means in such a way that it can trigger war. It is more likely that Telenor will be (directly or indirectly) affected by security incidents by state actors in the current situation than earlier years. This is why we continuously emphasise Nordic co-operation and collaboration within security and operations.

Russia-linked cyber actors have increasingly carried out targeted attacks against European infrastructure since the war in Ukraine began. According to the EU-NATO Task Force on the Resilience of Critical Infrastructure, Russia has demonstrated that it sees critical infrastructure as a target through its actions in Ukraine. The Task Force also states that Russia is mapping critical infrastructure in the Euro-Atlantic as potential targets. The attacks that are focused on critical infrastructure and public institutions often have a stronger political dimension than before. When Distributed Denial of Service (DDoS) attacks are used, they are often executed by so-called “hacktivists”. Such coordinated DDoS attacks have also been seen in the Nordic countries, often associated with activity or political decisions that Russia opposes. Other targets have included companies that actively contribute to supporting Ukraine in the war.

For Telenor, it is necessary to evaluate the different regions in the Nordics in terms of inherent geographical risk. Although we largely rely on the comprehensive and national backdrops presented by the Nordic intelligence and security services in their annual unclassified threat assessments, we also see a need to take a closer look at our most vulnerable regions: the High North and the Baltic Sea area.

For us in Telenor Nordics, it is extremely important to be observant of local conditions that can impact the services we provide. Given the current security situation and the authorities’ warning about which sectors of society most at risk, we are especially focused on our customers in the High North and Baltic Sea areas. These regions are subject to different aspects of Russian interaction, requiring heightened vigilance.

Telenor Nordics has an active presence in Arctic regions. Operating a reliable service in the North is not only important for our customers, but an important part of Telenor’s social responsibility. In practice, we need to assess security, preparedness,and threat analysis - with a special focus on the northern regions of Norway (including Svalbard, Jan Mayen and Bjørnøya), Northern Sweden and Finland. The security situation here is more closely linked to events in Russia than in any other region in which we operate. This is a daily reality for our companies, and it’s also the feedback we receive in our dialogue with local authorities.

In Svalbard, Telenor is in a unique position as one of the largest, most important and longest-established companies. Telenor’s position and operations in Svalbard is likely of great interest to other countries that also have a presence here or wish to establish themselves in the region. Finland’s long border with Russia brings unique challenges for critical infrastructure. For example,Northern Lapland and Åland are subject to special risk management and threat assessments due to their geographical location. For all our northern regions, we consider that Telenor’s activity will be of greater interest to foreign states than before. This is likely to result in increased intelligence pressure – especially from Russian and Chinese actors.

The Arctic areas not only have climate conditions that require particularly robust services and follow-up, but they also have greater potential for sensing security policy tensions, which demands extra vigilance. At a time when infrastructure in Europe is under a higher threat level than before, with Russia, in particular,considered to pose a hybrid threat, we are closely examining our critical infrastructure and how it is linked to other critical infrastructure. The interdependencies between different parts of critical infrastructure require thorough preparedness.

Both Russia and (increasingly) China are important players in the High North. Their presence underscores the need for heightened security measures and continuous monitoring to protect our interests and maintain the integrity of our operations in this strategically significant region.

Climate change is causing the ice to melt faster, opening new sea routes. An increase in both military and civilian traffic in the High North enhances its strategic importance, especially for a country like Russia. An increased military presence from both allied states and Russia means that this area has the potential to become even more tense from a security perspective.

The Baltic Sea area is another area where Telenor operates, and where we pay close attention to the developing security situation, especially following the Russian invasion of Ukraine. This area has experienced several security incidents targeting transnational communications cables,as well as oil and gas pipelines. Subsea infrastructure, vital for communications between countries, is increasingly vulnerable to sabotage and other security threats.

While the geographical footprint of Denmark is relatively small,our eastern-most borders in the Baltic Sea is cause for caution since the NordStream2 incident in 2022. There are several communications cables connecting Denmark, Sweden, and Germany that are at risk, highlighting the need for well-defined contingency plans.

The focus of Nordic governments and NATO on critical cables has increased, and special attention is now paid to the resilience of transnational cable connections connecting and expanding from the Nordics. This increased vigilance and collaborative effort aims to enhance the security and reliability of these vital communication connections.

A constant eye on the threat picture

Continuous prioritisation and updating of which threats currently used in the cyber domain is important to have relevant protection.

Reducing reliance on outdated systems that no longer receive updates and ensuring rapid patching of vulnerabilities are essential strategies.

A reminder of this occurred in the summer of 2024, when a faulty software update from CrowdStrike led to a global IT outage. This incident affected over 8.5 million devices, grounded thousands of flights, disrupted hospital systems, and knocked banks and media outlets offline. The widespread chaos underscored how critical it is to keep systems updated and patched to mitigate such vulnerabilities and prevent significant disruptions.

A proactive approach helps mitigate risks and ensures that our security measures remain effective against evolving threats.

On the lookout for indicators of mapping

Indicators are the “tracks” we follow to come to the right conclusion in our security work. Assessing safety reports and analysing what this says about a situation is important. When we in Telenor detect indicators that someone is mapping our business, it is taken very seriously. Mapping activities can involve actions such as taking pictures of an installation or suspiciously contacting employees. The indicators can appear both in the digital and physical domains. Since mapping has no immediate harmful effect, there is a risk that it will be overlooked and downgraded in favour of more immediate needs. However, recognising and responding to these indicators is essential for maintaining security. Mapping is often among the first steps a threat actor takes before further action.

While mapping does not automatically mean a malicious act will be carried out, it can suggest that someone is planning or creating the impression that such actions are possible. Threat actors might engage in repeated mapping to gather information for potential future use, giving them the ability to strike when desired. Indicators of mapping, whether in the physical or digital domain, must be taken seriously. Mapping is done for a reason, and can provide valuable insight into how to manage security work. Although some mapping may be done to disturb or draw attention elsewhere, its occurrence indicates potential interest from a threat actor. Given the current security situation, it is important to take mapping indicators very seriously.

Raising awareness among employees, customers, and suppliers is important in order to receive reports of “suspicious incidents” and to be able to identify whether mapping is in progress.