{
  "id": "1b110b28-9cfe-46f5-ac7c-a8caec38d7a6",
  "url": "https://tagesschau.de/ausland/cyberangriffe-russland-gru-ghostwriter-101.html",
  "source": "extension",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Hacking, malware, ransomware",
  "country": "Germany",
  "source_reliability": "A",
  "info_credibility": "3",
  "tags": [
    "GRU",
    "Russia",
    "cyberattacks",
    "Phishing",
    "Ghostwriter",
    "Bundestag",
    "German Bundestag",
    "offensive cyber operations"
  ],
  "nodes": [
    "Node 2: 5th Column"
  ],
  "countries": [
    "Germany"
  ],
  "where_text": "Cyberspace",
  "headline": "German Government sharply criticizes Russia for cyberattacks on Bundestag members",
  "description": "In early September 2021, the German Federal Government publicly condemned Russian cyberattacks targeting German Bundestag members, attributing them with reliable evidence to the Russian military intelligence agency GRU, specifically linked to the 'Ghostwriter' cyber group. These attacks, occurring at least for the third time around the Bundestag elections, involved phishing campaigns aimed at compromising personal and official email accounts of members from the Union and SPD parties, with the intent to steal sensitive information or disseminate fabricated false information. The German government held direct diplomatic discussions with the Russian Foreign Ministry, demanding an immediate halt to these illicit cyber activities and warning of further retaliatory measures. This incident echoes the massive 2015 cyberattack on the Bundestag attributed to Russian actors.",
  "summary_short": "In September 2021, the German government condemned Russian GRU-linked cyberattacks on Bundestag members' emails using phishing to steal data or spread disinformation ahead of elections.",
  "summary_extended": "Ahead of the 2021 Bundestag elections, German parliamentarians were targeted for at least the third time by cyberattacks attributed to foreign intelligence services. The Federal Government specifically accused the Russian state military intelligence service GRU, linked to the 'Ghostwriter' group, of orchestrating phishing attacks against members of the Union and SPD parties to exfiltrate sensitive information or distribute false narratives. The attacks focused on private and official email accounts and used carefully crafted emails with malicious attachments or links to implant spyware. The government publicly condemned these acts as unacceptable and a risk to national security, demanding cessation in direct discussions with Russian officials and warning of potential further actions. This follows previous known Russian cyber operations, including the large-scale 2015 Bundestag hack.",
  "actor_primary": "Ghostwriter cyber actors of the Russian military intelligence service GRU",
  "target_primary": null,
  "location_text": "Bundestag, Berlin",
  "location_region": "Berlin",
  "location_coordinates_lat": 52.5186,
  "location_coordinates_lon": 13.3762,
  "location_precision": "Approximate",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The article explicitly states that Russian military intelligence (GRU) linked cyberattacks targeted German Bundestag members, with statements from government officials and direct diplomatic responses, clearly indicating hostile aggressor activity.",
  "event_time_utc": "2021-09-06T14:05:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "exact",
  "created_at": "2026-04-28T13:45:00.621Z",
  "updated_at": "2026-11-04T08:35:32.139Z",
  "reliability_band": "strong",
  "location_precision_band": "approximate",
  "time_precision_band": "exact",
  "severity_band": "moderate",
  "attribution_confidence_band": "high",
  "attribution_basis": "independent_sources"
}

{
  "id": "1b110b28-9cfe-46f5-ac7c-a8caec38d7a6",
  "url": "https://tagesschau.de/ausland/cyberangriffe-russland-gru-ghostwriter-101.html",
  "source": "extension",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Hacking, malware, ransomware",
  "country": "Germany",
  "source_reliability": "A",
  "info_credibility": "3",
  "tags": [
    "GRU",
    "Russia",
    "cyberattacks",
    "Phishing",
    "Ghostwriter",
    "Bundestag",
    "German Bundestag",
    "offensive cyber operations"
  ],
  "nodes": [
    "Node 2: 5th Column"
  ],
  "countries": [
    "Germany"
  ],
  "where_text": "Cyberspace",
  "headline": "German Government sharply criticizes Russia for cyberattacks on Bundestag members",
  "description": "In early September 2021, the German Federal Government publicly condemned Russian cyberattacks targeting German Bundestag members, attributing them with reliable evidence to the Russian military intelligence agency GRU, specifically linked to the 'Ghostwriter' cyber group. These attacks, occurring at least for the third time around the Bundestag elections, involved phishing campaigns aimed at compromising personal and official email accounts of members from the Union and SPD parties, with the intent to steal sensitive information or disseminate fabricated false information. The German government held direct diplomatic discussions with the Russian Foreign Ministry, demanding an immediate halt to these illicit cyber activities and warning of further retaliatory measures. This incident echoes the massive 2015 cyberattack on the Bundestag attributed to Russian actors.",
  "summary_short": "In September 2021, the German government condemned Russian GRU-linked cyberattacks on Bundestag members' emails using phishing to steal data or spread disinformation ahead of elections.",
  "summary_extended": "Ahead of the 2021 Bundestag elections, German parliamentarians were targeted for at least the third time by cyberattacks attributed to foreign intelligence services. The Federal Government specifically accused the Russian state military intelligence service GRU, linked to the 'Ghostwriter' group, of orchestrating phishing attacks against members of the Union and SPD parties to exfiltrate sensitive information or distribute false narratives. The attacks focused on private and official email accounts and used carefully crafted emails with malicious attachments or links to implant spyware. The government publicly condemned these acts as unacceptable and a risk to national security, demanding cessation in direct discussions with Russian officials and warning of potential further actions. This follows previous known Russian cyber operations, including the large-scale 2015 Bundestag hack.",
  "actor_primary": "Ghostwriter cyber actors of the Russian military intelligence service GRU",
  "target_primary": null,
  "location_text": "Bundestag, Berlin",
  "location_region": "Berlin",
  "location_coordinates_lat": 52.5186,
  "location_coordinates_lon": 13.3762,
  "location_precision": "Approximate",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The article explicitly states that Russian military intelligence (GRU) linked cyberattacks targeted German Bundestag members, with statements from government officials and direct diplomatic responses, clearly indicating hostile aggressor activity.",
  "event_time_utc": "2021-09-06T14:05:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "exact",
  "created_at": "2026-04-28T13:45:00.621Z",
  "updated_at": "2026-11-04T08:35:32.139Z",
  "reliability_band": "strong",
  "location_precision_band": "approximate",
  "time_precision_band": "exact",
  "severity_band": "moderate",
  "attribution_confidence_band": "high",
  "attribution_basis": "independent_sources"
}