Norway's domestic security agency has confirmed that the Chinese state-sponsored group Salt Typhoon successfully compromised various network devices within the country. The 2026 threat assessment identifies China, Russia, and Iran as major actors conducting cyber and hybrid operations to undermine Norwegian resilience and map critical infrastructure.
The Norwegian Police Security Service has officially identified the Chinese cyber espionage actor known as Salt Typhoon as a significant threat to the nation's digital infrastructure. According to the agency’s 2026 annual assessment, this group has successfully compromised network devices across several Norwegian organizations. This activity is part of a broader trend where foreign states are increasingly employing hybrid tactics and cyber operations to bypass traditional defenses. The director general of the agency noted that Norway currently faces its most precarious security environment since the second world war due to this intensified pressure from multiple foreign intelligence services.
While China is recognized as a dominant force in the cyber domain, Russia remains the primary overall threat to Norway's national security. Russian intelligence continues to engage in persistent espionage, including the mapping of critical infrastructure and monitoring military activities on Norwegian soil. The assessment suggests that the current geopolitical climate in Europe is driving an increase in Russian operations, which range from traditional source recruitment to sophisticated influence campaigns. Officials anticipate heightened activity as Norway hosts more allied military exercises and increases its strategic importance within NATO.
China's intelligence efforts are described as substantial and systematic, focusing particularly on the collection of data from digital infrastructure and collaborative research projects. The security agency warns that Chinese services are exploiting international research and development to enhance their own military and security capabilities. Salt Typhoon has a documented history of breaching telecommunications providers globally, including high-profile cases where communications of senior political figures were intercepted. This systematic approach allows the Chinese state to track specific targets and gather sensitive information with high precision.
The threat landscape also includes Iranian intelligence services, which are expected to conduct both influence operations and more aggressive actions within Norway. The security report highlights the risk of Iran targeting Western interests through destructive cyber operations, property damage, or even targeted assassinations. These diverse threats necessitate a robust response from both the public and private sectors to bolster protective security and situational awareness. The agency stresses that foreign actors are no longer relying on a single method but are instead combining digital intrusions with human intelligence and physical sabotage.
In response to these multi-faceted challenges, the Norwegian government is calling for a significant increase in cooperation between state authorities and operators of critical infrastructure. The blending of cyber operations with traditional espionage requires a more integrated defense strategy to protect the nation's essential services and democratic resilience. As foreign intelligence services continue to improve their technical abilities and expand their reach, the need for stronger intelligence sharing and protective measures has become vital to maintaining national stability in an increasingly hostile global environment.
Source: Norwegian Intelligence Discloses Country Hit by Salt Typhoon Campaign