US-Led Operation Disables Russian Spy Network Targeting Germany and Allies

On or before 17 February 2024, German security authorities, in cooperation with a US-led operation, successfully dismantled a global cyber espionage network operated by the Russian hacker group APT28. The group, aligned with the Russian military intelligence service GRU, had installed malware on hundreds of small routers in offices and private homes worldwide, creating a covert platform for cyber espionage. Targets included governments, military, security agencies, and corporations in Germany, other EU countries, NATO states, and the United States. The attacks focused particularly on information regarding Germany's political-strategic positioning vis-à-vis Russia and military aid to Ukraine. The implicated routers were often compromised due to use of default administrator passwords. Russian intelligence reportedly engaged criminal groups to assist in these operations. German Interior Minister Nancy Faeser emphasized the seriousness of the threat posed by Russian cyberattacks and underscored efforts to defend against them. The operation disabled the compromised devices, neutralizing their utility for further espionage activities.