Cybersecurity Experts Warn of Attack Surge Around Norway’s Royal Funeral

When Norway gathers in Oslo on Wednesday 9 September 2026 for the funeral of King Harald, the capital will be under one of the most extensive security operations in the country’s history. Around 3,000 police officers have been mobilised, snipers will be positioned on rooftops, and police checkpoints will control access to the city centre as heads of state and members of royal families from around the world arrive to pay their respects. Incident commander Tomm Berger of the Oslo Police District has described the operation as one of the most extensive ever mounted in Norway, according to the Norwegian News Agency (NTB). Yet according to cybersecurity researchers, the most visible layer of protection, the physical cordon around the ceremony, addresses only half of the threat picture. The digital sphere surrounding a major public event is itself a battleground, and it is one where hostile actors can operate at low cost, from a distance, and with a global audience already assembled.

Basel Katt, Professor and cybersecurity expert at the Norwegian University of Science and Technology (NTNU), who also heads the Department of Information Security and Communication Technology at NTNU in Gjøvik, believes it is likely that the funeral will prompt further cyberattacks. His reasoning rests on a well-documented pattern: whenever public attention and institutional resources concentrate on a single event, the risk of attacks increases considerably. The security authorities, he notes, will significantly step up their digital preparedness in parallel with the physical operation, which means they are well prepared to deal with potential incidents. But preparation does not eliminate the underlying dynamic. Events of national and international significance create a predictable window of opportunity, and adversaries who study that window know exactly when it opens and closes. The professor warns that attacks with serious consequences remain a realistic possibility during the coming days.

The historical record supports that expectation. One of the best-known cyberattacks tied to a major event targeted the 2018 Winter Olympics in South Korea. The event was struck by a computer worm known as Olympic Destroyer, which disrupted Wi-Fi access at the various venues as well as ticketing systems. The attack is technically instructive because it did not attempt to steal data or extort the organisers. Instead, it sabotaged the operational infrastructure that a modern, connected event depends upon, degrading the experience for spectators and forcing staff onto manual workarounds at the worst possible moment. A worm of this kind spreads automatically across networks once it gains an initial foothold, which means a single point of entry can cascade into widespread disruption of services that appear, on the surface, to be unrelated to one another.

Royal occasions have also been exploited directly through social engineering. Following the death of Queen Elizabeth II in 2022, fairly sophisticated phishing attacks were carried out. Many British citizens received emails that appeared to have been sent by Microsoft, encouraging them to share personal memories of the Queen with the public. The format closely resembled the kind of initiative that might be launched by a public broadcaster such as Norway’s NRK, which invites people to submit their memories of significant national moments. But the emails were fake, and before users could share their memories they were required to provide sensitive information, fooling many in the process. The technique is a textbook example of pretexting: the attacker borrows the credibility of a trusted brand and the emotional momentum of a national event to lower the victim’s guard. Grief, curiosity and the desire to participate in a collective moment all serve as powerful levers that bypass the scepticism people might apply to an ordinary unsolicited email.

Katt emphasises that the likelihood of disinformation campaigns also increases sharply during events of this kind. Such campaigns could involve newly created social media accounts spreading false information, or manipulated images and videos designed to create a misleading impression of how events are unfolding. The technical barrier to producing convincing fabricated content has fallen dramatically, and the sheer volume of authentic imagery generated by a large public ceremony gives fabricators abundant raw material to alter, recontextualise or splice. Because the event unfolds in real time and audiences are actively searching for updates, false content can circulate faster than corrections can catch up with it. Newly registered accounts with no posting history can be deployed in coordinated batches to amplify a false narrative, exploiting the way recommendation algorithms reward sudden surges of engagement regardless of the content’s accuracy.

Importantly, the motivation behind such attacks is not necessarily to disrupt the event itself. Katt explains that the campaigns are not necessarily personal attacks against the Royal Family or the late King. More often, it is about exploiting the attention these events attract to promote the attackers’ own agenda. They may want to spread a particular message, reinforce a particular ideological narrative, or simply create unrest and spread fear. In strategic terms, a major ceremony functions as an amplifier: whatever an adversary injects into the information environment during those hours reaches an audience far larger than it would on an ordinary day. That asymmetry, a modest investment of attacker effort meeting an enormous concentration of public attention, is precisely what makes event-linked cyberactivity so predictable and so attractive to a wide range of actors, from ideological groups to state-aligned operations.

The warning comes against an already active backdrop. In recent weeks, several public-sector IT services in Norway have been subjected to so-called denial-of-service (DoS) attacks, a form of cyberattack designed to make a website, network or digital service unavailable to legitimate users. The Norwegian Digitalisation Agency and a number of universities and university colleges were among those affected. Katt believes it would not be surprising to see more attacks of this kind during the funeral. A DoS attack involves taking services offline by overwhelming them with traffic, typically by flooding the target with more requests than it can process, so that genuine users are locked out. Unlike phishing attacks, the purpose of these attacks is not to gain access to sensitive information or data. The damage is measured in availability rather than confidentiality, which changes both the defensive calculus and the message the attacker sends.

That message is often the point. Katt suggests that a DoS campaign could, for example, involve a state military or non-military actor seeking to take Norway’s digital services and websites offline, with the aim of sending a signal that the nation is vulnerable to attack and that the authorities are not strong enough to protect its citizens. DoS attacks are relatively simple and inexpensive to carry out, and their most obvious consequence is often no more than a service being unavailable for a few hours. Nevertheless, such attacks can appear serious and therefore have a destabilising effect on the population. Katt describes this as a form of psychological warfare: the technical impact may be modest and temporary, but the perception of vulnerability, broadcast at the exact moment a nation is watching, can achieve strategic effects far beyond the few hours of downtime. The attack targets public confidence as much as it targets servers.

Artificial intelligence has changed the economics of all three attack categories. As with phishing attacks and disinformation campaigns, new AI tools have made it much easier to carry out DoS attacks on a large scale, the professor explains. In practice, that means convincing phishing texts can be generated in fluent, locally idiomatic language at industrial volume, fabricated images and videos can be produced quickly and cheaply, and automated tooling can coordinate traffic floods against multiple targets simultaneously. The same technologies that help defenders detect anomalies and filter malicious traffic also lower the barrier to entry for attackers, compressing the time between an attacker’s decision to act and a functioning campaign. For security authorities, this asymmetry translates into a need for heightened monitoring and rapid-response capability precisely during the hours when a major event draws the world’s eyes, and the world’s adversaries, toward a single location.

For the many people who will follow the funeral digitally, whether through television broadcasts or social media, Katt offers two pieces of practical advice. First, check where the information or requests you receive are coming from. It is generally perfectly safe to share memories and photos with an established public-service broadcaster, but if you receive a request to do so from an email address or phone number you do not recognise, and it also requires you to log in, that should set alarm bells ringing. Second, be critical of what you read or see on social media. Do not take everything at face value, he cautions, because disinformation campaigns are often spread through social media, frequently by fake profiles and automated accounts designed to manipulate perceptions and create confusion. The same vigilance that protects an individual’s credentials and personal data also weakens the amplification networks on which large-scale disinformation depends, making ordinary users an active part of the country’s digital defence during a moment of heightened national attention.

Subject of Research: Cyberattack risks and digital threat patterns surrounding major public events

Article Title: Why we should expect cyberattacks during major events

Article References: Why we should expect cyberattacks during major events. (n.d.). Original publication

Image Credits: AI Generated

DOI: Not provided

Keywords: cybersecurity, phishing, denial-of-service, disinformation, social engineering, Olympic Destroyer, Norway, King Harald funeral, NTNU, Basel Katt, psychological warfare, artificial intelligence