German Federal Office for the Protection of the Constitution warns of massive Russian cyberattacks targeting German government and critical infrastructure, including the Bundestag network breach.

Cyber & Information WarfareCyber AttacksHacking, malware, ransomware

Aggressor

Summary

The German Federal Office for the Protection of the Constitution (BfV) has warned about ongoing massive cyberattacks by Russian intelligence services targeting Germany. These operations span between seven and eleven years and have evolved from espionage to include sabotage efforts. A notable case is the 2015 attack on the Bundestag's internal network attributed to the Russian group 'Sofacy/APT 28', which involved malware delivered via infected emails, enabling weeks-long data exfiltration before the network was reset. Additionally, the BfV highlighted concerns about the 'Sandworm' campaign targeting governmental bodies, telecom operators, energy suppliers, and educational institutions with sabotage motives. The German government asserts it is well prepared and protected through strong IT security strategies and dedicated cyber defense units in the military. The state-led nature of these Russian cyber operations is explicitly emphasized by German authorities.

Classification

Confidence: High

The article clearly identifies Russian intelligence services as the aggressors conducting cyber espionage and sabotage against German governmental and critical infrastructure networks, with direct attribution to specific campaigns and confirmed incidents such as the Bundestag attack.

Source URL

https://tagesschau.de/inland/verfassungsschutz-warnt-vor-cyberattacken-aus-russland-101.html

Open source

Provenance

Publisher: extension
Submitted: Apr 28, 2026, 13:45 UTC
Last updated: Nov 4, 2026, 08:35 UTC
Event time: May 12, 2016, 00:00 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "809eb012-1844-4a78-bf99-ff103843c015",
  "url": "https://tagesschau.de/inland/verfassungsschutz-warnt-vor-cyberattacken-aus-russland-101.html",
  "source": "extension",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Hacking, malware, ransomware",
  "country": "Germany",
  "source_reliability": "A",
  "info_credibility": "3",
  "tags": [
    "Russian Cyberattacks",
    "Sofacy",
    "APT 28",
    "Sandworm",
    "German Bundestag",
    "offensive cyber operations",
    "Cyber Sabotage",
    "German Federal Office for the Protection of the Constitution",
    "Germany",
    "Hybrid Warfare"
  ],
  "nodes": [
    "Node 1: Borders"
  ],
  "countries": [
    "Germany"
  ],
  "where_text": "Cyberspace",
  "headline": null,
  "description": "The German Federal Office for the Protection of the Constitution (BfV) issued a warning on May 13, 2016, about large-scale cyberattacks from Russian intelligence directed at German targets, shifting from espionage to sabotage. The BfV confirmed that the 2015 cyberattack on the Bundestag's internal network was linked to the Russian 'Sofacy/APT 28' group, which accessed parliamentary computers and extracted data for weeks. Another notable threat is the 'Sandworm' campaign focused on sabotage targeting government, telecom, energy, and educational sectors. The German Interior Ministry and Defense Ministry state that robust protection measures and specialized cyber-defense units are in place to counter these threats.",
  "summary_short": "German Federal Office for the Protection of the Constitution warns of massive Russian cyberattacks targeting German government and critical infrastructure, including the Bundestag network breach.",
  "summary_extended": "The German Federal Office for the Protection of the Constitution (BfV) has warned about ongoing massive cyberattacks by Russian intelligence services targeting Germany. These operations span between seven and eleven years and have evolved from espionage to include sabotage efforts. A notable case is the 2015 attack on the Bundestag's internal network attributed to the Russian group 'Sofacy/APT 28', which involved malware delivered via infected emails, enabling weeks-long data exfiltration before the network was reset. Additionally, the BfV highlighted concerns about the 'Sandworm' campaign targeting governmental bodies, telecom operators, energy suppliers, and educational institutions with sabotage motives. The German government asserts it is well prepared and protected through strong IT security strategies and dedicated cyber defense units in the military. The state-led nature of these Russian cyber operations is explicitly emphasized by German authorities.",
  "actor_primary": "Sofacy/APT 28",
  "target_primary": null,
  "location_text": "Germany",
  "location_region": null,
  "location_coordinates_lat": 51.165691,
  "location_coordinates_lon": 10.451526,
  "location_precision": "Regional",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The article clearly identifies Russian intelligence services as the aggressors conducting cyber espionage and sabotage against German governmental and critical infrastructure networks, with direct attribution to specific campaigns and confirmed incidents such as the Bundestag attack.",
  "event_time_utc": "2016-05-12T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "pm24h",
  "created_at": "2026-04-28T13:45:00.798Z",
  "updated_at": "2026-11-04T08:35:32.139Z",
  "reliability_band": "strong",
  "location_precision_band": "regional",
  "time_precision_band": "within_24h",
  "severity_band": "significant",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}

Public assessmentReliability: StrongSeverity: SignificantAttribution: HighSingle sourceTime: Same dayLocation: Regional

Source reliability

Info credibility

Event time

May 12, 2016, 00:00 UTC

Event time confidence

pm24h

Location

Germany

Primary actor

Sofacy/APT 28

Country

Germany

Countries

Germany

Tags

Russian Cyberattacks, Sofacy, APT 28, Sandworm, German Bundestag, offensive cyber operations, Cyber Sabotage, German Federal Office for the Protection of the Constitution, Germany, Hybrid Warfare

Nodes

Node 1: Borders

Loading signal...

{ "id": "809eb012-1844-4a78-bf99-ff103843c015", "url": "https://tagesschau.de/inland/verfassungsschutz-warnt-vor-cyberattacken-aus-russland-101.html", "source": "extension", "status": "approved", "category": "Cyber & Information Warfare", "subcategory": "Cyber Attacks", "incident_type": "Hacking, malware, ransomware", "country": "Germany", "source_reliability": "A", "info_credibility": "3", "tags": [ "Russian Cyberattacks", "Sofacy", "APT 28", "Sandworm", "German Bundestag", "offensive cyber operations", "Cyber Sabotage", "German Federal Office for the Protection of the Constitution", "Germany", "Hybrid Warfare" ], "nodes": [ "Node 1: Borders" ], "countries": [ "Germany" ], "where_text": "Cyberspace", "headline": null, "description": "The German Federal Office for the Protection of the Constitution (BfV) issued a warning on May 13, 2016, about large-scale cyberattacks from Russian intelligence directed at German targets, shifting from espionage to sabotage. The BfV confirmed that the 2015 cyberattack on the Bundestag's internal network was linked to the Russian 'Sofacy/APT 28' group, which accessed parliamentary computers and extracted data for weeks. Another notable threat is the 'Sandworm' campaign focused on sabotage targeting government, telecom, energy, and educational sectors. The German Interior Ministry and Defense Ministry state that robust protection measures and specialized cyber-defense units are in place to counter these threats.", "summary_short": "German Federal Office for the Protection of the Constitution warns of massive Russian cyberattacks targeting German government and critical infrastructure, including the Bundestag network breach.", "summary_extended": "The German Federal Office for the Protection of the Constitution (BfV) has warned about ongoing massive cyberattacks by Russian intelligence services targeting Germany. These operations span between seven and eleven years and have evolved from espionage to include sabotage efforts. A notable case is the 2015 attack on the Bundestag's internal network attributed to the Russian group 'Sofacy/APT 28', which involved malware delivered via infected emails, enabling weeks-long data exfiltration before the network was reset. Additionally, the BfV highlighted concerns about the 'Sandworm' campaign targeting governmental bodies, telecom operators, energy suppliers, and educational institutions with sabotage motives. The German government asserts it is well prepared and protected through strong IT security strategies and dedicated cyber defense units in the military. The state-led nature of these Russian cyber operations is explicitly emphasized by German authorities.", "actor_primary": "Sofacy/APT 28", "target_primary": null, "location_text": "Germany", "location_region": null, "location_coordinates_lat": 51.165691, "location_coordinates_lon": 10.451526, "location_precision": "Regional", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The article clearly identifies Russian intelligence services as the aggressors conducting cyber espionage and sabotage against German governmental and critical infrastructure networks, with direct attribution to specific campaigns and confirmed incidents such as the Bundestag attack.", "event_time_utc": "2016-05-12T00:00:00.000Z", "end_time_utc": null, "event_time_confidence": "pm24h", "created_at": "2026-04-28T13:45:00.798Z", "updated_at": "2026-11-04T08:35:32.139Z", "reliability_band": "strong", "location_precision_band": "regional", "time_precision_band": "within_24h", "severity_band": "significant", "attribution_confidence_band": "high", "attribution_basis": "single_source" }