US-Led Operation Disables Russian Spy Network Targeting Germany and Allies

Cyber & Information WarfareCyber AttacksHacking, malware, ransomware

Aggressor

Summary

In a US-led operation on or before 17 February 2024, German and US authorities disabled a global Russian-run cyber espionage network operated by hacker group APT28 targeting governments, military, and corporations, including in Germany.

On or before 17 February 2024, German security authorities, in cooperation with a US-led operation, successfully dismantled a global cyber espionage network operated by the Russian hacker group APT28. The group, aligned with the Russian military intelligence service GRU, had installed malware on hundreds of small routers in offices and private homes worldwide, creating a covert platform for cyber espionage. Targets included governments, military, security agencies, and corporations in Germany, other EU countries, NATO states, and the United States. The attacks focused particularly on information regarding Germany's political-strategic positioning vis-à-vis Russia and military aid to Ukraine. The implicated routers were often compromised due to use of default administrator passwords. Russian intelligence reportedly engaged criminal groups to assist in these operations. German Interior Minister Nancy Faeser emphasized the seriousness of the threat posed by Russian cyberattacks and underscored efforts to defend against them. The operation disabled the compromised devices, neutralizing their utility for further espionage activities.

Classification

Confidence: High

The article explicitly describes hostile Russian cyber espionage operations via APT28/GRU targeting Germany and allied states, and how authorities disrupted this network. This is a clear aggressor hybrid warfare signal.

Source URL

https://tagesschau.de/inland/innenpolitik/russisches-spionagenetzwerk-ausgeschaltet-100.html

Open source

Provenance

Publisher: extension
Submitted: Apr 28, 2026, 14:51 UTC
Last updated: Nov 4, 2026, 08:35 UTC
Event time: Feb 17, 2024, 00:00 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "060f7d28-272b-4d1f-a8db-88a6b31905ea",
  "url": "https://tagesschau.de/inland/innenpolitik/russisches-spionagenetzwerk-ausgeschaltet-100.html",
  "source": "extension",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Hacking, malware, ransomware",
  "country": "Germany",
  "source_reliability": "B",
  "info_credibility": "3",
  "tags": [
    "APT28",
    "Russian GRU",
    "offensive cyber operations",
    "Router malware",
    "German Interior Ministry",
    "FBI",
    "Germany",
    "EU",
    "NATO",
    "US"
  ],
  "nodes": [
    "Node 1: Borders"
  ],
  "countries": [
    "Germany"
  ],
  "where_text": "Cyberspace",
  "headline": "US-Led Operation Disables Russian Spy Network Targeting Germany and Allies",
  "description": "German and US security authorities have disabled a global Russian cyber espionage network run by hacker group APT28, linked to Russia's GRU military intelligence. The group had deployed malware on hundreds of routers globally, including in Germany, exploiting devices with default passwords to spy on governments, military, agencies, and companies. The network targeted especially political and military-strategic information related to Germany's stance toward Russia and military support for Ukraine. Russian intelligence reportedly enlisted criminal groups to assist in these hacking activities. Compromised devices were used as proxy nodes to obscure attack origins. The operation underscores the serious threat of Russian cyberattacks and the collaboration between US and German authorities to counter them.",
  "summary_short": "In a US-led operation on or before 17 February 2024, German and US authorities disabled a global Russian-run cyber espionage network operated by hacker group APT28 targeting governments, military, and corporations, including in Germany.",
  "summary_extended": "On or before 17 February 2024, German security authorities, in cooperation with a US-led operation, successfully dismantled a global cyber espionage network operated by the Russian hacker group APT28. The group, aligned with the Russian military intelligence service GRU, had installed malware on hundreds of small routers in offices and private homes worldwide, creating a covert platform for cyber espionage. Targets included governments, military, security agencies, and corporations in Germany, other EU countries, NATO states, and the United States. The attacks focused particularly on information regarding Germany's political-strategic positioning vis-à-vis Russia and military aid to Ukraine. The implicated routers were often compromised due to use of default administrator passwords. Russian intelligence reportedly engaged criminal groups to assist in these operations. German Interior Minister Nancy Faeser emphasized the seriousness of the threat posed by Russian cyberattacks and underscored efforts to defend against them. The operation disabled the compromised devices, neutralizing their utility for further espionage activities.",
  "actor_primary": "APT28",
  "target_primary": null,
  "location_text": "Germany and multiple NATO and EU states",
  "location_region": null,
  "location_coordinates_lat": 51.165691,
  "location_coordinates_lon": 10.451526,
  "location_precision": "Regional",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The article explicitly describes hostile Russian cyber espionage operations via APT28/GRU targeting Germany and allied states, and how authorities disrupted this network. This is a clear aggressor hybrid warfare signal.",
  "event_time_utc": "2024-02-17T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "pm24h",
  "created_at": "2026-04-28T14:51:00.339Z",
  "updated_at": "2026-11-04T08:35:32.139Z",
  "reliability_band": "strong",
  "location_precision_band": "regional",
  "time_precision_band": "within_24h",
  "severity_band": "significant",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}

Public assessmentReliability: StrongSeverity: SignificantAttribution: HighSingle sourceTime: Same dayLocation: Regional

Source reliability

Info credibility

Event time

Feb 17, 2024, 00:00 UTC

Event time confidence

pm24h

Location

Germany and multiple NATO and EU states

Primary actor

APT28

Country

Germany

Countries

Germany

Tags

APT28, Russian GRU, offensive cyber operations, Router malware, German Interior Ministry, FBI, Germany, EU, NATO, US

Nodes

Node 1: Borders

Loading signal...

{ "id": "060f7d28-272b-4d1f-a8db-88a6b31905ea", "url": "https://tagesschau.de/inland/innenpolitik/russisches-spionagenetzwerk-ausgeschaltet-100.html", "source": "extension", "status": "approved", "category": "Cyber & Information Warfare", "subcategory": "Cyber Attacks", "incident_type": "Hacking, malware, ransomware", "country": "Germany", "source_reliability": "B", "info_credibility": "3", "tags": [ "APT28", "Russian GRU", "offensive cyber operations", "Router malware", "German Interior Ministry", "FBI", "Germany", "EU", "NATO", "US" ], "nodes": [ "Node 1: Borders" ], "countries": [ "Germany" ], "where_text": "Cyberspace", "headline": "US-Led Operation Disables Russian Spy Network Targeting Germany and Allies", "description": "German and US security authorities have disabled a global Russian cyber espionage network run by hacker group APT28, linked to Russia's GRU military intelligence. The group had deployed malware on hundreds of routers globally, including in Germany, exploiting devices with default passwords to spy on governments, military, agencies, and companies. The network targeted especially political and military-strategic information related to Germany's stance toward Russia and military support for Ukraine. Russian intelligence reportedly enlisted criminal groups to assist in these hacking activities. Compromised devices were used as proxy nodes to obscure attack origins. The operation underscores the serious threat of Russian cyberattacks and the collaboration between US and German authorities to counter them.", "summary_short": "In a US-led operation on or before 17 February 2024, German and US authorities disabled a global Russian-run cyber espionage network operated by hacker group APT28 targeting governments, military, and corporations, including in Germany.", "summary_extended": "On or before 17 February 2024, German security authorities, in cooperation with a US-led operation, successfully dismantled a global cyber espionage network operated by the Russian hacker group APT28. The group, aligned with the Russian military intelligence service GRU, had installed malware on hundreds of small routers in offices and private homes worldwide, creating a covert platform for cyber espionage. Targets included governments, military, security agencies, and corporations in Germany, other EU countries, NATO states, and the United States. The attacks focused particularly on information regarding Germany's political-strategic positioning vis-à-vis Russia and military aid to Ukraine. The implicated routers were often compromised due to use of default administrator passwords. Russian intelligence reportedly engaged criminal groups to assist in these operations. German Interior Minister Nancy Faeser emphasized the seriousness of the threat posed by Russian cyberattacks and underscored efforts to defend against them. The operation disabled the compromised devices, neutralizing their utility for further espionage activities.", "actor_primary": "APT28", "target_primary": null, "location_text": "Germany and multiple NATO and EU states", "location_region": null, "location_coordinates_lat": 51.165691, "location_coordinates_lon": 10.451526, "location_precision": "Regional", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The article explicitly describes hostile Russian cyber espionage operations via APT28/GRU targeting Germany and allied states, and how authorities disrupted this network. This is a clear aggressor hybrid warfare signal.", "event_time_utc": "2024-02-17T00:00:00.000Z", "end_time_utc": null, "event_time_confidence": "pm24h", "created_at": "2026-04-28T14:51:00.339Z", "updated_at": "2026-11-04T08:35:32.139Z", "reliability_band": "strong", "location_precision_band": "regional", "time_precision_band": "within_24h", "severity_band": "significant", "attribution_confidence_band": "high", "attribution_basis": "single_source" }