APT 28 group is ramping up information warfare against Germany

According to the German Intelligence, the APT 28 group, also known as Fancy Bear, is ramping up information warfare against Germany and the rest of West.

US intelligence agencies blame the Russian government for ramping up infowar against the US and the West. According to the US Government, Russian-state hackers hacked the Democratic National Committee (DNC) and other political organizations worldwide.

Hackers conducted campaigns to interfere with the internal affairs of foreign states, last victim in order of time is Germany, this is the opinion of the Germany’s chief of domestic intelligence who warned of this threat last week.

On December 8, the Germany’s Bundesamt für Verfassungsshutz (BfV) has issued a press release warning of a rise in Russian propaganda and hacking campaigns.

“We see aggressive and increased cyber spying and cyber operations that could potentially endanger German government officials, members of parliament and employees of democratic parties,” reads a statement issued by Hans-Georg Maassen, head of the BfV agency

The goal of Russian hackers is to spread uncertainty, strengthen extremist groups and parties, with the intent of “weaken or destabilise the Federal Republic of Germany.”

Both the heads of the German foreign intelligence agency (BND), Bruno Kahl, and the domestic intelligence agency (BfV), Hans-Georg Maassen, have warned about increasing Russian cyber operations in the country.

Foto: Johannes Simon/ ddp

Social media are becoming a new battlefield, the BfV observed a spike in propaganda activities as part of PSYOps and noted an increased number of “spear phishing attacks against German political parties and parliamentary groups.” The German intelligence confirmed that hackers are using the strain of malware that were used to broke in the system of the US Democratic National Committee.

“Spear-phishing against political parties and parliamentary groups have increased dramatically. They are attributed to the APT 28 campaign, which was also responsible for the DNC hack. APT 28 successfully exfiltrated data from the German Bundestag in 2015.”

In March security experts at Trend Micro, who follow a long time the operations of the Russian-linked Pawn Storm cyber spies (aka APT 28, Sednit, Sofacy, Fancy Bear and Tsar Team) discovered that the Russian spies targeted the political party of Chancellor Angela Merkel, the Christian Democratic Union.

Some experts speculate that also the recent attack against the Deutsche Telekom routers was powered is linked to Russia.

The German Parliament, the Bundestag, was targeted by hackers that also hit a number of German politicians, including the Chancellor Angela Merkel.

“Such cyber-attacks, or hybrid conflicts as they are known in Russian doctrine, are now part of daily life and we must learn to cope with them.” commented the Chancellor Angela Merkel.

“There are findings that cyber-attacks take place which have no other meaning than to create political uncertainty. There is a kind of pressure on public discourse and on democracy, which is unacceptable.”Kahl told the Süddeutsche Zeitung, “Attribution to a state actor is technically difficult, but there is some evidence that it is at least tolerated or desired by the state.”

The German intelligence observed a rise in Russian online propaganda in Germani since the start of the Ukraine crisis.

“Since the start of the Ukraine crisis, we have seen a significant increase in Russian propaganda and disinformation campaigns in Germany.” reads a statement issued by the BfV.

The German intelligence has explicitly blamed the APT28 as the threat actors behind the hacking campaign used for disinformation activities, the group appears to be specialized in false flag activities. Something similar occurred when Russian Hackers have broken into the French TV5 pretending to be an ISIS-linked group.

“This approach represents a previously unseen methodology in campaigns that are controlled by Russia.”

According to Maassen, APT 28 activity is responsible for an unprecedented disinformation campaign.

“Propaganda, disinformation, cyber-attacks, cyber espionage and cyber sabotage are part of hybrid threats against western democracies.” said Maassen warning of significant an increase in political cyber espionage.”

“Stolen information could be used in the election campaign to discredit German politicians.”

On the other side, the Kremlin denies involvement and warns the US and asked Washington clarifications for US cyber threats.

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(Security Affairs – Russia, APT 28 state-sponsored hacking)

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.

Next Waiting for a fix, stop using Netgear R7000 and R6400 routers to avoid hacks »

Previous « Lax Cybersecurity at Nuclear Facilities is a Recipe For Widespread Disaster

Published by

Pierluigi Paganini

Tags: Christian Democratic Unioncyber espionageCybercrimemalwarePawn StormRussiaSEDNITspear phishingTrend Microwatering hole

8 years ago

China-linked APT41 used Google Calendar as C2 to control its TOUGHPROGRESS malware

Google says China-linked group APT41 controlled malware via Google Calendar to target governments through a…

3 hours ago

Malware

New AyySSHush botnet compromised over 9,000 ASUS routers, adding a persistent SSH backdoor.

GreyNoise researchers warn of a new AyySSHush botnet compromised over 9,000 ASUS routers, adding a…

8 hours ago

Czech Republic accuses China’s APT31 of a cyberattack on its Foreign Ministry

The Czech government condemned China after linking cyber espionage group APT31 to a cyberattack on…

20 hours ago

Malware

New PumaBot targets Linux IoT surveillance devices

PumaBot targets Linux IoT devices, using SSH brute-force attacks to steal credentials, spread malware, and…

24 hours ago

Mobile

App Store Security: Apple stops $2B in fraud in 2024 alone, $9B over 5 years

Apple blocked over $9B in fraud in 5 years, including $2B in 2024, stopping scams…

1 day ago

Malware

Crooks use a fake antivirus site to spread Venom RAT and a mix of malware

Researchers found a fake Bitdefender site spreading the Venom RAT by tricking users into downloading…