In May 2023, Denmark suffered the largest cyberattack against critical infrastructure in its history, after threat actors believed to be Russia-affiliated exploited a critical vulnerability impacting the Zyxel firewalls of twenty-two (22) different companies. The attack was highly sophisticated and targeted, and all victim organizations were exploited simultaneously. The initial vulnerability, tracked as CVE-2023-28771, is a command injection flaw which was exploited to achieve remote code execution (RCE), allowing the threat actors to conduct deep reconnaissance in vulnerable industrial control system (ICS) infrastructure of eleven (11) organizations. Later that month, a second wave of attacks exploited two (2) zero-day Zyxel vulnerabilities (CVE-2023-33009 and CVE-2023-33010), allowing threat actors to takeover over vulnerable endpoints, leveraging them in distributed denial-of-service (DDoS) attacks via the notorious “Mirai” and “MooBot” botnets. SektorCERT, a non-profit organization supported by Danish critical infrastructure companies, originally identified the malicious behavior against ICSs connecting the attacks, attributing them to the hacking arm of Russia’s GRU (tracked as Sandworm). The second wave of attacks utilized previously unknown means and infrastructure and cannot currently be confirmed with high-confidence to be associated with the Russian threat actors. Further details of the attack campaign can be found in the SectorCERT report linked below. CTIX analysts will continue to publish information about cutting edge attacks against critical infrastructure.