Russian Legion

Russian Legion is a newly announced pro-Russian hacktivist alliance that emerged publicly in late January 2026 and immediately framed a campaign (“OpDenmark”) targeting Denmark with coercive political messaging and denial-of-service (DDoS) disruption. Open reporting consistently describes the coalition as led by the hacktivist brand “Cardinal” and comprising “The White Pulse,” “Russian Partizan,” and “Inteid.”

The alliance’s publicly reported modus operandi is availability disruption paired with intimidation: a time-bound ultimatum to Danish decision makers, escalating rhetoric (“DDoS is only the beginning”), and “phase” announcements to signal continued pressure. Available reporting indicates the observed campaign activity during the initial period consisted of DDoS operations, including disruption/claim linkages involving Denmark’s health portal (sundhed.dk) via Inteid.

Confidence is high that Russian Legion functions as a coalition brand coordinating DDoS-centric campaigns and psychological pressure in the Denmark context (Jan–Feb 2026). Confidence is medium for any capability beyond DDoS (e.g., “real cyber attacks”), as reporting reviewed emphasizes claims and deterrence messaging rather than corroborated intrusion artifacts.