Police did not name the suspects but said they were aged 18 and 19.
Police attorney Erik Moestue told The Associated Press on Wednesday that the attacks targeted the websites of Norwegian bank DNB and the Norwegian Police Security Service as well as betting and news sites in Norway.
He declined to name the websites outside of Norway that were targeted, saying the investigation was ongoing.
Denial-of-service attacks jam websites with bogus traffic, effectively making them unreachable. Such attacks are easy to launch and generally do little lasting damage.