Loading signal...
Signal
Submitted
Apr 28, 2026, 13:45 UTC
From July 2024 to June 2025, Germany experienced increased cyberattacks targeting government and businesses, with Russia identified as the primary suspected aggressor.
The BSI's mid-2024 to mid-2025 IT security report highlights a sustained high-risk environment for cyberattacks in Germany. Critical sectors like public administration, defense, law enforcement, and security faced intensified threats, including a 52% rise in DDoS attacks coinciding with major political events. Russia is regarded as the main suspected actor behind these attacks, which appear to have geopolitical and military motivations. Ransomware and data extortion remain pressing issues, though authorities have had some success against financially motivated groups such as LockBit and Alphv. Alarmingly, the number of newly discovered software vulnerabilities rose by 24%, averaging 119 per day. SMEs continue to be the most targeted, with 80% of attacks aimed at them, often exploiting poor cybersecurity postures. Furthermore, consumer fraud tactics advanced, notably through quishing, where counterfeit QR codes in public areas mislead victims into divulging payment data.
Confidence: High
The report explicitly details an ongoing high volume of cyberattacks originating predominantly from Russia, targeting key German government and defense infrastructure, alongside widespread ransomware campaigns and sophisticated fraud methods.
Source URL
https://tagesschau.de/inland/innenpolitik/bsi-lagebericht-cybersicherheit-100.html
Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.
{
"id": "8e91be1f-a8ce-438a-afb2-3820e9a319cc",
"url": "https://tagesschau.de/inland/innenpolitik/bsi-lagebericht-cybersicherheit-100.html",
"source": "extension",
"status": "approved",
"category": "Cyber & Information Warfare",
"subcategory": "Cyber Attacks",
"incident_type": "Hacking, malware, ransomware",
"country": "Germany",
"source_reliability": "A",
"info_credibility": "3",
"tags": [
"Germany",
"offensive cyber operations",
"DDoS attacks",
"Ransomware",
"Russia",
"Quishing",
"Public administration",
"SMEs",
"Geopolitical cyber threat"
],
"nodes": [
"Node 1: Borders",
"Node 2: 5th Column"
],
"countries": [
"Germany"
],
"where_text": "Cyberspace",
"headline": "BSI Reports High Threat from Cyberattacks in Germany, Russia Identified as Main Suspected Aggressor",
"description": "Between July 2024 and June 2025, Germany faced a persistently high threat level from cyberattacks, particularly targeting public administration, defense, law enforcement, and public security sectors, according to the Federal Office for Information Security (BSI). During this period, DDoS attacks surged by 52% amid major political events like the Bundestag election and Munich Security Conference. Cybercriminal activity, frequently linked to geopolitical or military motives and suspected to be state-sponsored, was mainly attributed to Russia. Ransomware attacks and data extortion by criminal groups such as LockBit and Alphv remain significant challenges. The cybersecurity landscape is further complicated by an average of 119 new vulnerabilities discovered daily—an increase of 24% versus the previous year. Small and medium-sized enterprises (SMEs) were disproportionately affected, accounting for 80% of attacks, with many failing to implement even basic cybersecurity measures. Additionally, consumer-targeted fraud via phishing, including a rise in 'quishing' attacks using manipulated QR codes in public spaces, was reported.",
"summary_short": "From July 2024 to June 2025, Germany experienced increased cyberattacks targeting government and businesses, with Russia identified as the primary suspected aggressor.",
"summary_extended": "The BSI's mid-2024 to mid-2025 IT security report highlights a sustained high-risk environment for cyberattacks in Germany. Critical sectors like public administration, defense, law enforcement, and security faced intensified threats, including a 52% rise in DDoS attacks coinciding with major political events. Russia is regarded as the main suspected actor behind these attacks, which appear to have geopolitical and military motivations. Ransomware and data extortion remain pressing issues, though authorities have had some success against financially motivated groups such as LockBit and Alphv. Alarmingly, the number of newly discovered software vulnerabilities rose by 24%, averaging 119 per day. SMEs continue to be the most targeted, with 80% of attacks aimed at them, often exploiting poor cybersecurity postures. Furthermore, consumer fraud tactics advanced, notably through quishing, where counterfeit QR codes in public areas mislead victims into divulging payment data.",
"actor_primary": "Russia",
"target_primary": null,
"location_text": "Germany",
"location_region": null,
"location_coordinates_lat": 51.1657,
"location_coordinates_lon": 10.4515,
"location_precision": "Regional",
"is_aggressor_signal": true,
"signal_type": "HYBRID_SIGNAL",
"is_hybrid_war_signal": true,
"classification_complete": true,
"hybrid_signal_complete": true,
"classification_confidence": "High",
"classification_rationale": "The report explicitly details an ongoing high volume of cyberattacks originating predominantly from Russia, targeting key German government and defense infrastructure, alongside widespread ransomware campaigns and sophisticated fraud methods.",
"event_time_utc": "2024-07-01T00:00:00.000Z",
"end_time_utc": "2025-06-30T23:59:59.000Z",
"event_time_confidence": "pm24h",
"created_at": "2026-04-28T13:45:00.338Z",
"updated_at": "2026-11-10T02:40:39.054Z",
"reliability_band": "strong",
"location_precision_band": "regional",
"time_precision_band": "within_24h",
"severity_band": "significant",
"attribution_confidence_band": "high",
"attribution_basis": "independent_sources"
}Source reliability
A
Info credibility
3
Event time
Jul 1, 2024, 00:00 UTC
End time
Jun 30, 2025, 23:59 UTC
Event time confidence
pm24h
Location
Germany
Primary actor
Russia
Country
Germany
Countries
Germany
Tags
Germany, offensive cyber operations, DDoS attacks, Ransomware, Russia, Quishing, Public administration, SMEs, Geopolitical cyber threat
Nodes
Node 1: Borders, Node 2: 5th Column
Signal
Submitted
Apr 28, 2026, 13:45 UTC
From July 2024 to June 2025, Germany experienced increased cyberattacks targeting government and businesses, with Russia identified as the primary suspected aggressor.
The BSI's mid-2024 to mid-2025 IT security report highlights a sustained high-risk environment for cyberattacks in Germany. Critical sectors like public administration, defense, law enforcement, and security faced intensified threats, including a 52% rise in DDoS attacks coinciding with major political events. Russia is regarded as the main suspected actor behind these attacks, which appear to have geopolitical and military motivations. Ransomware and data extortion remain pressing issues, though authorities have had some success against financially motivated groups such as LockBit and Alphv. Alarmingly, the number of newly discovered software vulnerabilities rose by 24%, averaging 119 per day. SMEs continue to be the most targeted, with 80% of attacks aimed at them, often exploiting poor cybersecurity postures. Furthermore, consumer fraud tactics advanced, notably through quishing, where counterfeit QR codes in public areas mislead victims into divulging payment data.
Confidence: High
The report explicitly details an ongoing high volume of cyberattacks originating predominantly from Russia, targeting key German government and defense infrastructure, alongside widespread ransomware campaigns and sophisticated fraud methods.
Source URL
https://tagesschau.de/inland/innenpolitik/bsi-lagebericht-cybersicherheit-100.html
Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.
{
"id": "8e91be1f-a8ce-438a-afb2-3820e9a319cc",
"url": "https://tagesschau.de/inland/innenpolitik/bsi-lagebericht-cybersicherheit-100.html",
"source": "extension",
"status": "approved",
"category": "Cyber & Information Warfare",
"subcategory": "Cyber Attacks",
"incident_type": "Hacking, malware, ransomware",
"country": "Germany",
"source_reliability": "A",
"info_credibility": "3",
"tags": [
"Germany",
"offensive cyber operations",
"DDoS attacks",
"Ransomware",
"Russia",
"Quishing",
"Public administration",
"SMEs",
"Geopolitical cyber threat"
],
"nodes": [
"Node 1: Borders",
"Node 2: 5th Column"
],
"countries": [
"Germany"
],
"where_text": "Cyberspace",
"headline": "BSI Reports High Threat from Cyberattacks in Germany, Russia Identified as Main Suspected Aggressor",
"description": "Between July 2024 and June 2025, Germany faced a persistently high threat level from cyberattacks, particularly targeting public administration, defense, law enforcement, and public security sectors, according to the Federal Office for Information Security (BSI). During this period, DDoS attacks surged by 52% amid major political events like the Bundestag election and Munich Security Conference. Cybercriminal activity, frequently linked to geopolitical or military motives and suspected to be state-sponsored, was mainly attributed to Russia. Ransomware attacks and data extortion by criminal groups such as LockBit and Alphv remain significant challenges. The cybersecurity landscape is further complicated by an average of 119 new vulnerabilities discovered daily—an increase of 24% versus the previous year. Small and medium-sized enterprises (SMEs) were disproportionately affected, accounting for 80% of attacks, with many failing to implement even basic cybersecurity measures. Additionally, consumer-targeted fraud via phishing, including a rise in 'quishing' attacks using manipulated QR codes in public spaces, was reported.",
"summary_short": "From July 2024 to June 2025, Germany experienced increased cyberattacks targeting government and businesses, with Russia identified as the primary suspected aggressor.",
"summary_extended": "The BSI's mid-2024 to mid-2025 IT security report highlights a sustained high-risk environment for cyberattacks in Germany. Critical sectors like public administration, defense, law enforcement, and security faced intensified threats, including a 52% rise in DDoS attacks coinciding with major political events. Russia is regarded as the main suspected actor behind these attacks, which appear to have geopolitical and military motivations. Ransomware and data extortion remain pressing issues, though authorities have had some success against financially motivated groups such as LockBit and Alphv. Alarmingly, the number of newly discovered software vulnerabilities rose by 24%, averaging 119 per day. SMEs continue to be the most targeted, with 80% of attacks aimed at them, often exploiting poor cybersecurity postures. Furthermore, consumer fraud tactics advanced, notably through quishing, where counterfeit QR codes in public areas mislead victims into divulging payment data.",
"actor_primary": "Russia",
"target_primary": null,
"location_text": "Germany",
"location_region": null,
"location_coordinates_lat": 51.1657,
"location_coordinates_lon": 10.4515,
"location_precision": "Regional",
"is_aggressor_signal": true,
"signal_type": "HYBRID_SIGNAL",
"is_hybrid_war_signal": true,
"classification_complete": true,
"hybrid_signal_complete": true,
"classification_confidence": "High",
"classification_rationale": "The report explicitly details an ongoing high volume of cyberattacks originating predominantly from Russia, targeting key German government and defense infrastructure, alongside widespread ransomware campaigns and sophisticated fraud methods.",
"event_time_utc": "2024-07-01T00:00:00.000Z",
"end_time_utc": "2025-06-30T23:59:59.000Z",
"event_time_confidence": "pm24h",
"created_at": "2026-04-28T13:45:00.338Z",
"updated_at": "2026-11-10T02:40:39.054Z",
"reliability_band": "strong",
"location_precision_band": "regional",
"time_precision_band": "within_24h",
"severity_band": "significant",
"attribution_confidence_band": "high",
"attribution_basis": "independent_sources"
}Source reliability
A
Info credibility
3
Event time
Jul 1, 2024, 00:00 UTC
End time
Jun 30, 2025, 23:59 UTC
Event time confidence
pm24h
Location
Germany
Primary actor
Russia
Country
Germany
Countries
Germany
Tags
Germany, offensive cyber operations, DDoS attacks, Ransomware, Russia, Quishing, Public administration, SMEs, Geopolitical cyber threat
Nodes
Node 1: Borders, Node 2: 5th Column