Danish energy sector attacks (SektorCERT)

In May 2023, 22 companies in Denmark's energy sector were breached in coordinated waves of attacks that exploited vulnerabilities in Zyxel firewalls guarding their networks. Documented in a landmark November 2023 report by SektorCERT — the Danish critical-infrastructure sector's non-profit cybersecurity center — the campaign was described as the largest cyberattack on Danish critical infrastructure to date.

The first wave

On 11 May 2023, attackers targeted 16 Danish energy organizations, exploiting CVE-2023-28771 (CVSS 9.8), a critical OS-command-injection flaw in Zyxel's ATP, USG FLEX, VPN and ZyWALL/USG firewalls. The vulnerability let unauthenticated attackers execute commands directly on the perimeter firewall. 11 organizations were successfully compromised, with attackers reading device configurations and usernames. SektorCERT's sector-wide sensor network detected the activity quickly, and all affected networks were secured by the end of the day.

The second wave

Beginning 22 May 2023, a second, more sophisticated wave deployed new tooling and exploited two Zyxel zero-days — CVE-2023-33009 and CVE-2023-33010 — which were not patched until 24 May. According to SektorCERT, the attackers in this phase reached the industrial control systems of multiple companies. To protect operations, some operators deliberately disconnected from the wider grid and ran in island mode — generating and distributing power locally without external network connectivity.

Attribution debate

SektorCERT's report raised the possibility of state involvement, noting overlaps with infrastructure associated with Sandworm, the Russian GRU unit behind prior attacks on Ukraine's grid. However, a January 2024 analysis by Forescout challenged that conclusion, arguing the Danish activity was most likely part of broader, opportunistic exploitation of internet-exposed Zyxel devices worldwide rather than a single coordinated Sandworm campaign. The attribution remains contested.

Why it matters

The SektorCERT case is a defining study in critical-infrastructure perimeter risk. The very firewalls deployed to protect energy operators became the attack surface, and a single widely deployed product line exposed dozens of utilities at once. It also demonstrated the value of sector-wide collective defense: SektorCERT's shared sensor network gave Denmark unusual visibility, enabling rapid detection and coordinated containment that limited physical impact. The episode accelerated European scrutiny of edge-device security and the patching discipline required for the firewalls and VPNs guarding essential services.