While global attention remains fixed on conflicts in the Middle East, geopolitical shifts continue to unfold in the Arctic. Greenlandic and Danish officials are currently in talks with the Trump administration in Washington DC over Greenland’s future. These discussions follow a sharp escalation in January 2026, when US President Donald Trump renewed and intensified his long-standing interest in the island. This time, the rhetoric went further than before: hints at potential military and economic pressure sent shockwaves across Europe and heightened concerns about the stability of the transatlantic alliance.
This blog examines how these developments have influenced the cyber threat landscape in and around Greenland over the past year. It explores the interplay between geopolitics and cyber activity, highlights the main threat vectors, and considers what may lie ahead as tensions continue to evolve.
Following our last briefing in January 2025, Greenland confirmed that its parliamentary elections were scheduled for March 2025 [source]. The election was won by the centre-right, pro-business Demokraatit party, with party leader Jens-Frederik Nielsen heading the coalition government in the Naalakkersuisut [source]. Although Nielsen campaigned on a gradual path toward independence, the sharp external pressure from the United States had, for now, pushed independence debates to the background. Instead, Nuuk and Copenhagen moved closer, agreeing on new measures for welfare and economic development, and a refreshed defence partnership across the Kingdom [source].
Tensions surged in early January 2026 when President Trump renewed US interest in Greenland. Although Greenland had already been referenced in the December 2025 National Security Strategy, this renewed focus was accompanied by threats of military action and punitive tariffs against states opposing a potential US takeover [source] [source]. These statements followed Washington’s recent intervention in Venezuela and highlighted American willingness to pursue its geopolitical aims, prompting strong concern among European leaders. However, the situation eased somewhat at the World Economic Forum in Davos, where President Trump announced that the US would not use military force to secure Greenland or impose tariffs for now and suggested movement toward a ‘framework for a future deal’ [source]. European leaders nonetheless continued to criticise US belligerence, calling on especially middle powers to uphold international norms [source].
Image Text: Trump post emphasises Greenland’s strategic importance on 14 January 2026 and a White House ‘Valentine’s card’ shared on X on 14 February 2026 [source].
On 20 March 2026, Greenlandic and Danish negotiators met the Trump administration in Washington to discuss that framework [source]. As of 25 March 2026, few details have been released, but talks are expected to build on the 1951 US Denmark defence agreement and include discussions of Greenland’s role in the Trump administration’s ‘Golden Dome’ missile defence proposals [source].
Amid these developments, military and diplomatic activity in the Arctic has intensified. NATO launched its ‘Arctic Sentry’ mission to bolster allied presence, running alongside Norway’s ‘Cold Response 26’ and Denmark’s ‘Arctic Endurance’ deployments—the latter recently revealed to be a more extensive operation, reportedly preparing for the possibility of a full-scale US offensive [source] [source]. On the diplomatic front, France and Canada opened consulates in Nuuk, signalling closer cooperation in the High North, while NATO and European partners have increasingly highlighted the need to strengthen collaboration, maintain a robust presence, and enhance resilience across the Arctic [source] [source].
These developments have also been evident in the cyber domain, with the following activity observed between from February 2025 to 25 March 2026:
1. Disruptive Activity
While low-level hacktivist activity targeting Greenland had occurred prior to the recent escalations, claimed distributed-denial-of-service (DDoS) attacks against Greenlandic entities began to increase around the time of the elections. Since February 2025, SecAlliance has documented 41 incidents affecting a range of sectors in Greenland, most prominently government, transport, and media/entertainment. Key targets have included BANK of Greenland (Grønlandsbanken), the telecommunications provider Tusass, the national broadcaster KNR, and Air Greenland. By contrast, Danish organisations have faced heavier targeting, with hacktivist groups claiming over 1,600 victims during the same period. Much of this activity is believed to be linked to Denmark’s military and economic support for Ukraine rather than Greenland specifically. Across both countries, most incidents have been short-lived and caused little to no disruption. However, there have been cases where hacktivist activity has had broader impacts: pro-Russian groups such as NoName057(16) and Z-Pentest have reportedly disrupted water supply systems in Denmark, demonstrating the potential for these operations to extend beyond website outages and affect critical infrastructure [source].
Image Text: Hacktivist listings targeting Greenland, alongside statement on disruptive actions by NoName057(16) and Z-Pentest in Denmark [source].
2. Influence Operations
As expected, the electoral period saw an uptick in influence operations. Around the Greenlandic elections, Danish intelligence identified multiple instances of online disinformation and misinformation, including fake social media profiles impersonating Greenlandic and Danish politicians, as well as genuine statements being reused or taken out of context to push specific narratives [source]. Much of this activity appeared to support the pro-independence movement, deepening tensions between Greenland and Denmark and fuelling friction with the United States. This was notably done through narratives that portrayed US ambitions as neo-colonial and framed Denmark as Washington's subordinate.
Following the escalation in January 2026, known Russian influence networks amplified similar themes. Tactics included impersonating trusted Western media and research institutions, disseminating content via pro-Kremlin Telegram channels and affiliated outlets, and reusing familiar disinformation formats such as fake Charlie Hebdo covers [source]. Messaging followed official Russian lines, highlighting how information operations are used in a deliberate, layered manner to advance Russia’s foreign policy objectives. Additional reports have highlighted Russian influence operations linked to the Danish parliamentary elections. Notably, the account ‘Danskeren rundt om hjørnet’ (‘Dane Around the Corner’) amplified pro-Russian narratives in response to debates that arose during the election period [source].
Image Text: Pro-Russian accounts identified spreading disinformation. Further details available in the linked blog [source].
3. Espionage
While espionage activity is rarely visible to the public, with reporting remaining reliant on secondary sources, there have been clear indications of increased intelligence activity around Greenland. Ahead of the Greenlandic elections, the Trump administration reportedly directed US agencies to step up their focus on Greenland, supported by reporting of both physical deployments and expanded intelligence and influence assets throughout the reporting period [source] [source]. In response, Danish intelligence raised the threat level associated with US-linked espionage and influence operations to match that of Russia and China [source]. While it was initially seen as less of a concern, given that the US is a NATO ally, apprehension has grown around this capability, particularly as the United States already enjoys privileged access to key infrastructure on Greenland through its military and defence installations, backed by extensive situational awareness via NATO. This access gives Washington a significant advantage in accessing relevant intelligence—an increasing point of concern amid deteriorating relations between Copenhagen and Washington. The perception of such capabilities being deployed elsewhere, for example, in US interventions in Venezuela and Iran, has only heightened unease about how similar assets might be used in Greenland, even as such intentions remain speculative [source] [source].
At the same time, the identified Russian influence operations strongly suggest that Moscow is almost certainly conducting espionage to support these campaigns. This is further reinforced by ongoing statements from Russian officials and aligned media narratives questioning Greenland’s status, highlighting Russia’s close attention to Arctic politics [source]. Additional reports of likely Russian activity targeting Denmark ahead of the parliamentary elections underline this sustained focus [source].
4. Hybrid Operations
Hybrid tactics, or so-called grey-zone warfare, has become increasingly prominent across Europe. While Greenland has not yet been directly affected, Denmark has experienced significant drone activity, raising concerns about both intelligence collection and potential disruption [source]. It is highly likely that similar threats will emerge in Greenland and the wider Arctic in the medium term, particularly given the island’s continued vulnerability due to limited infrastructure underpinning critical services [source]. These concerns are expected to grow as Nuuk accelerates digitalisation and expands its strategic footprint, including new space infrastructure in Kangerlussuaq [source] [source]. Beyond acting as a tool of intimidation, as likely seen with Russian drone activity in Europe, these threats can be used to influence outcomes, for example via false-flag operations, potentially causing both disruptive and destructive impacts on target [source].
At present, three interconnected factors will largely determine how both the political and cyber landscapes develop in the short to medium term:
1. The composition and priorities of Denmark’s new government
2. The outcome of Greenlandic–Danish–US negotiations
3. The resilience and cohesion of Greenlandic and Danish alliances
As of 25 March 2026, Denmark has held elections in which Prime Minister Mette Frederiksen’s Social Democrats (Socialdemokratiet) secured the most votes, despite recording their worst result since 1903 [source]. While Frederiksen remains in a position to form a third-term government, lengthy negotiations are anticipated to determine the composition of her cabinet and set out policy priorities. A key question is whether the current leadership will remain in place to continue negotiations with the Trump administration, as any immediate change could disrupt or delay talks. Frederiksen has taken a firm stance against US demands, raising concerns that a successor may struggle to maintain the same position under pressure from Washington. However, as Foreign Minister Lars Løkke Rasmussen’s Moderate party (Moderaterne) holds key mandates for a new government, there is a realistic possibility for both Frederiksen and Rasmussen to remain in their current positions, without changing Denmark's international positioning [source]. A centre-left coalition could also include the Danish Social Liberal Party (Radikale Venstre), which has expressed support for initiating independence discussions with Greenland, likely advancing the timeline of such talks, particularly given recent developments in the Faroe Islands [source] [source]. However, if the Moderates align with the right, a more inward-looking government could emerge, complicating efforts to strengthen ties with European allies—an important factor in maintaining stability and resilience in the Arctic [source].
These factors will be key in shaping Greenland’s cyber threat landscape. Core threats—espionage, influence operations, and hacktivism—are expected to persist, while threats of hybrid and high-impact disruptive or destructive activity may rise in the medium to long term. If Nuuk, Copenhagen, and Washington reach an agreement, Russian intelligence activity in Greenland will almost certainly increase, particularly following the recent expiration of the New START Agreement, which leaves strategic nuclear deployments effectively unconstrained [source]. If negotiations fail, attention will likely turn to the US and the possibility of a more adversarial approach toward Greenland and Denmark. Any kinetic or cyber aggression from Washington is not guaranteed, as shifting priorities, such as ongoing strikes in the Middle East, and potential constraints from the upcoming midterm elections, could limit immediate action. Still, the situation is being closely monitored by states worldwide, both to navigate the broader international political landscape and for actors like Russia and China to identify potential avenues for exploitation, escalate tensions, and test NATO cohesion.
In conclusion, Greenland clearly remains a strategic focus for Trump. While the timeline may now be extended due to new Middle East engagements, the US is more attentive than ever to its strategic sphere of influence. The question is no longer whether an escalation in the Arctic will occur, but when and in what form, particularly if ongoing diplomatic efforts fail to meet US objectives. In cyberspace, activity is highly likely to persist across the full spectrum, ranging from low-level hacktivism to influence campaigns and intelligence collection operations, all of which serve to reinforce geopolitical positioning. While US actions have made Washington the central focus for potential adversarial action against Greenland, threats posed by states like Russia and China, both seeking to strengthen their position and influence and advance their own geopolitical goals, still loom in the background. These developments demonstrate that the Arctic, including Greenland, faces an increasingly complex threat environment, one that can only be managed through robust alliances and coordinated defence measures to safeguard regional stability and resilience.
