{
  "id": "55593a94-c686-4031-baf9-7f380c133dfc",
  "url": "https://tagesschau.de/investigativ/br-recherche/russische-hacker-103.html",
  "source": "extension",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Hacking, malware, ransomware",
  "country": "Germany",
  "source_reliability": "B",
  "info_credibility": "3",
  "tags": [
    "Russian hackers",
    "FSB",
    "offensive cyber operations",
    "Snake group",
    "German Foreign Office hack",
    "Bundestag hack",
    "GRU",
    "Malware",
    "Center-Inform",
    "Atlas des FSB"
  ],
  "nodes": [
    "Node 2: 5th Column"
  ],
  "countries": [
    "Germany"
  ],
  "where_text": "Cyberspace",
  "headline": "Traces of Russian elite hackers lead to FSB",
  "description": "The elite hacker group 'Snake' (also known as 'Turla' or 'Uroburos') has conducted cyber espionage operations globally for almost twenty years, employing advanced malware attributed to highly skilled developers. In Germany, they compromised the IT system of the Federal Foreign Office via an initial breach of a federal university in North Rhine-Westphalia in late 2017, extracting sensitive documents on Germany's Eastern Europe policy. BR and WDR investigative teams uncovered personal traces linking malware developers 'vlad' and 'urik' to Russian nationals affiliated with Center-Inform, a company integrated into 'Atlas des FSB', a firm officially bearing the FSB name between 2004 and 2007. One developer openly claimed FSB employment and involvement in computer espionage. German authorities are prosecuting the group for secret-service espionage. A similar case led to a 2020 arrest warrant for Dimitri Badin, associated with the GRU, for the 2015 cyberattack on the Bundestag that targeted parliamentary email accounts and data, including those of Chancellor Merkel. Russian officials deny accusations, calling them media speculation. Attribution is difficult due to evidence secrecy and intelligence source protection, but investigative evidence strongly implicates Russian state-sponsored actors.",
  "summary_short": "The hacker group 'Snake', responsible for cyberattacks on the German Foreign Office and other targets, is linked to the Russian FSB intelligence agency according to BR and WDR investigations.",
  "summary_extended": "The cyber espionage group known as 'Snake' or 'Turla' has operated for nearly two decades, targeting governments, military, and diplomatic networks worldwide with sophisticated malware. German security services suspect 'Snake' hacked into the German Federal Foreign Office's networks, accessing documents about Berlin's Eastern European policy. Investigative journalists from BR and WDR traced the group's development to Russian nationals linked to the Federal Security Service (FSB), notably through individuals associated with companies 'Center-Inform' and 'Atlas des FSB'. These companies officially carried the FSB name between 2004 and 2007. German authorities, including the Bundeskriminalamt (BKA) and the Federal Prosecutor General, are investigating the group for clandestine espionage activities. Previously, a warrant was issued in 2020 against Dimitri Badin, linked to the Russian GRU, for the 2015 Bundestag hack which compromised email accounts of parliamentarians and government officials, including former Chancellor Merkel. The Russian embassy dismisses these allegations as speculation. Attribution remains officially unconfirmed but intelligence and investigative findings strongly point to Russian state actors.",
  "actor_primary": "Snake",
  "target_primary": null,
  "location_text": "Berlin",
  "location_region": null,
  "location_coordinates_lat": 52.52,
  "location_coordinates_lon": 13.405,
  "location_precision": "Approximate",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The article explicitly describes Russian state-linked hacker group 'Snake' conducting cyber espionage attacks within Germany, including the German Foreign Office, and investigative tracing to the FSB. German authorities are prosecuting the hackers, and attribution is strongly supported by investigative findings.",
  "event_time_utc": "2017-12-31T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "pm24h",
  "created_at": "2026-04-28T13:45:00.447Z",
  "updated_at": "2026-11-04T08:35:32.139Z",
  "reliability_band": "strong",
  "location_precision_band": "approximate",
  "time_precision_band": "within_24h",
  "severity_band": "moderate",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}

{
  "id": "55593a94-c686-4031-baf9-7f380c133dfc",
  "url": "https://tagesschau.de/investigativ/br-recherche/russische-hacker-103.html",
  "source": "extension",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Hacking, malware, ransomware",
  "country": "Germany",
  "source_reliability": "B",
  "info_credibility": "3",
  "tags": [
    "Russian hackers",
    "FSB",
    "offensive cyber operations",
    "Snake group",
    "German Foreign Office hack",
    "Bundestag hack",
    "GRU",
    "Malware",
    "Center-Inform",
    "Atlas des FSB"
  ],
  "nodes": [
    "Node 2: 5th Column"
  ],
  "countries": [
    "Germany"
  ],
  "where_text": "Cyberspace",
  "headline": "Traces of Russian elite hackers lead to FSB",
  "description": "The elite hacker group 'Snake' (also known as 'Turla' or 'Uroburos') has conducted cyber espionage operations globally for almost twenty years, employing advanced malware attributed to highly skilled developers. In Germany, they compromised the IT system of the Federal Foreign Office via an initial breach of a federal university in North Rhine-Westphalia in late 2017, extracting sensitive documents on Germany's Eastern Europe policy. BR and WDR investigative teams uncovered personal traces linking malware developers 'vlad' and 'urik' to Russian nationals affiliated with Center-Inform, a company integrated into 'Atlas des FSB', a firm officially bearing the FSB name between 2004 and 2007. One developer openly claimed FSB employment and involvement in computer espionage. German authorities are prosecuting the group for secret-service espionage. A similar case led to a 2020 arrest warrant for Dimitri Badin, associated with the GRU, for the 2015 cyberattack on the Bundestag that targeted parliamentary email accounts and data, including those of Chancellor Merkel. Russian officials deny accusations, calling them media speculation. Attribution is difficult due to evidence secrecy and intelligence source protection, but investigative evidence strongly implicates Russian state-sponsored actors.",
  "summary_short": "The hacker group 'Snake', responsible for cyberattacks on the German Foreign Office and other targets, is linked to the Russian FSB intelligence agency according to BR and WDR investigations.",
  "summary_extended": "The cyber espionage group known as 'Snake' or 'Turla' has operated for nearly two decades, targeting governments, military, and diplomatic networks worldwide with sophisticated malware. German security services suspect 'Snake' hacked into the German Federal Foreign Office's networks, accessing documents about Berlin's Eastern European policy. Investigative journalists from BR and WDR traced the group's development to Russian nationals linked to the Federal Security Service (FSB), notably through individuals associated with companies 'Center-Inform' and 'Atlas des FSB'. These companies officially carried the FSB name between 2004 and 2007. German authorities, including the Bundeskriminalamt (BKA) and the Federal Prosecutor General, are investigating the group for clandestine espionage activities. Previously, a warrant was issued in 2020 against Dimitri Badin, linked to the Russian GRU, for the 2015 Bundestag hack which compromised email accounts of parliamentarians and government officials, including former Chancellor Merkel. The Russian embassy dismisses these allegations as speculation. Attribution remains officially unconfirmed but intelligence and investigative findings strongly point to Russian state actors.",
  "actor_primary": "Snake",
  "target_primary": null,
  "location_text": "Berlin",
  "location_region": null,
  "location_coordinates_lat": 52.52,
  "location_coordinates_lon": 13.405,
  "location_precision": "Approximate",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The article explicitly describes Russian state-linked hacker group 'Snake' conducting cyber espionage attacks within Germany, including the German Foreign Office, and investigative tracing to the FSB. German authorities are prosecuting the hackers, and attribution is strongly supported by investigative findings.",
  "event_time_utc": "2017-12-31T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "pm24h",
  "created_at": "2026-04-28T13:45:00.447Z",
  "updated_at": "2026-11-04T08:35:32.139Z",
  "reliability_band": "strong",
  "location_precision_band": "approximate",
  "time_precision_band": "within_24h",
  "severity_band": "moderate",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}