Germany's Foreign Ministry summoned the Russian embassy chargé d'affaires following confirmed cyberattacks by Russian state-aligned group APT28 against the SPD and critical sectors dating back to 2022.

Cyber & Information WarfareCyber AttacksHacking, malware, ransomware

Aggressor

Summary

Following cyberattacks attributed by German intelligence to the Russian military intelligence agency GRU's hacker group APT28, targeting the Social Democratic Party (SPD) and various critical sectors including logistics, armaments, aerospace, and IT services across Germany and other European countries including Ukraine, Germany's Foreign Ministry summoned the Russian chargé d'affaires in Berlin on May 3, 2024. The attacks exploited a Microsoft Outlook vulnerability from as early as March 2022 and were part of a broader campaign against government institutions and businesses. The German government and European Union officials condemned these operations as unacceptable state-sponsored cyber aggression violating international norms. The United States also aligned with Germany, attributing the attacks specifically to APT28. Russia denied involvement. German Interior Minister Nancy Faeser emphasized the threat to democracy and highlighted the deployment of enhanced protective measures against hybrid threats. SPD leadership expressed defiance, citing the attacks as recognition of their democratic resolve and support for Ukraine.

Classification

Confidence: High

The article clearly describes hostile Russian state-aligned cyberattack activity against Germany and its political institutions with concrete attribution to APT28/GRU by credible government sources. The diplomatic response confirms official recognition of aggression.

Source URL

https://tagesschau.de/inland/spd-cyberangriff-russland-102.html

Open source

Provenance

Publisher: extension
Submitted: Apr 28, 2026, 13:25 UTC
Last updated: Nov 4, 2026, 08:35 UTC
Event time: May 3, 2024, 00:00 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "ae0a1d4d-cdcf-4802-bdf0-fe4ab598febb",
  "url": "https://tagesschau.de/inland/spd-cyberangriff-russland-102.html",
  "source": "extension",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Hacking, malware, ransomware",
  "country": "Germany",
  "source_reliability": "A",
  "info_credibility": "3",
  "tags": [
    "Russia",
    "Germany",
    "cyberattacks",
    "APT28",
    "GRU",
    "SPD",
    "Hybrid Warfare",
    "offensive cyber operations",
    "Diplomatic Response",
    "Microsoft Outlook Vulnerability"
  ],
  "nodes": [],
  "countries": [
    "Germany"
  ],
  "where_text": "Cyberspace",
  "headline": null,
  "description": "On May 3, 2024, Germany's Foreign Ministry summoned the acting chargé d'affaires of the Russian embassy in Berlin in response to confirmed cyberattacks conducted by the Russian state-linked hacker group APT28 (Fancy Bear), attributed to the GRU. These cyberattacks, ongoing since at least March 2022, exploited vulnerabilities in Microsoft Outlook to infiltrate email accounts of the SPD party leadership and targeted German and other European government agencies, logistics, defense, aerospace, IT firms, and civilian organizations, as well as Ukrainian targets. Government spokespeople condemned the attacks as unacceptable breaches of international cyber norms. EU and US representatives echoed these condemnations and warned Russia to cease malicious activities. Russia denied involvement through the embassy's Telegram channel. Interior Minister Nancy Faeser stressed the threat to German democracy and declared elevated security measures. SPD politicians demanded stronger European security coordination. This incident aligns with a pattern of hostile Russian cyber operations in Europe and follows previous attacks linked to APT28, including the 2015 Bundestag hack and US Democratic Party intrusion in 2016.",
  "summary_short": "Germany's Foreign Ministry summoned the Russian embassy chargé d'affaires following confirmed cyberattacks by Russian state-aligned group APT28 against the SPD and critical sectors dating back to 2022.",
  "summary_extended": "Following cyberattacks attributed by German intelligence to the Russian military intelligence agency GRU's hacker group APT28, targeting the Social Democratic Party (SPD) and various critical sectors including logistics, armaments, aerospace, and IT services across Germany and other European countries including Ukraine, Germany's Foreign Ministry summoned the Russian chargé d'affaires in Berlin on May 3, 2024. The attacks exploited a Microsoft Outlook vulnerability from as early as March 2022 and were part of a broader campaign against government institutions and businesses. The German government and European Union officials condemned these operations as unacceptable state-sponsored cyber aggression violating international norms. The United States also aligned with Germany, attributing the attacks specifically to APT28. Russia denied involvement. German Interior Minister Nancy Faeser emphasized the threat to democracy and highlighted the deployment of enhanced protective measures against hybrid threats. SPD leadership expressed defiance, citing the attacks as recognition of their democratic resolve and support for Ukraine.",
  "actor_primary": "APT28",
  "target_primary": null,
  "location_text": "Berlin",
  "location_region": null,
  "location_coordinates_lat": 52.52,
  "location_coordinates_lon": 13.405,
  "location_precision": "Approximate",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The article clearly describes hostile Russian state-aligned cyberattack activity against Germany and its political institutions with concrete attribution to APT28/GRU by credible government sources. The diplomatic response confirms official recognition of aggression.",
  "event_time_utc": "2024-05-03T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "pm24h",
  "created_at": "2026-04-28T13:25:36.242Z",
  "updated_at": "2026-11-04T08:35:32.139Z",
  "reliability_band": "strong",
  "location_precision_band": "approximate",
  "time_precision_band": "within_24h",
  "severity_band": "moderate",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}

Public assessmentReliability: StrongSeverity: ModerateAttribution: HighSingle sourceTime: Same dayLocation: Approximate

Source reliability

Info credibility

Event time

May 3, 2024, 00:00 UTC

Event time confidence

pm24h

Location

Berlin

Primary actor

APT28

Country

Germany

Countries

Germany

Tags

Russia, Germany, cyberattacks, APT28, GRU, SPD, Hybrid Warfare, offensive cyber operations, Diplomatic Response, Microsoft Outlook Vulnerability

Loading signal...

{ "id": "ae0a1d4d-cdcf-4802-bdf0-fe4ab598febb", "url": "https://tagesschau.de/inland/spd-cyberangriff-russland-102.html", "source": "extension", "status": "approved", "category": "Cyber & Information Warfare", "subcategory": "Cyber Attacks", "incident_type": "Hacking, malware, ransomware", "country": "Germany", "source_reliability": "A", "info_credibility": "3", "tags": [ "Russia", "Germany", "cyberattacks", "APT28", "GRU", "SPD", "Hybrid Warfare", "offensive cyber operations", "Diplomatic Response", "Microsoft Outlook Vulnerability" ], "nodes": [], "countries": [ "Germany" ], "where_text": "Cyberspace", "headline": null, "description": "On May 3, 2024, Germany's Foreign Ministry summoned the acting chargé d'affaires of the Russian embassy in Berlin in response to confirmed cyberattacks conducted by the Russian state-linked hacker group APT28 (Fancy Bear), attributed to the GRU. These cyberattacks, ongoing since at least March 2022, exploited vulnerabilities in Microsoft Outlook to infiltrate email accounts of the SPD party leadership and targeted German and other European government agencies, logistics, defense, aerospace, IT firms, and civilian organizations, as well as Ukrainian targets. Government spokespeople condemned the attacks as unacceptable breaches of international cyber norms. EU and US representatives echoed these condemnations and warned Russia to cease malicious activities. Russia denied involvement through the embassy's Telegram channel. Interior Minister Nancy Faeser stressed the threat to German democracy and declared elevated security measures. SPD politicians demanded stronger European security coordination. This incident aligns with a pattern of hostile Russian cyber operations in Europe and follows previous attacks linked to APT28, including the 2015 Bundestag hack and US Democratic Party intrusion in 2016.", "summary_short": "Germany's Foreign Ministry summoned the Russian embassy chargé d'affaires following confirmed cyberattacks by Russian state-aligned group APT28 against the SPD and critical sectors dating back to 2022.", "summary_extended": "Following cyberattacks attributed by German intelligence to the Russian military intelligence agency GRU's hacker group APT28, targeting the Social Democratic Party (SPD) and various critical sectors including logistics, armaments, aerospace, and IT services across Germany and other European countries including Ukraine, Germany's Foreign Ministry summoned the Russian chargé d'affaires in Berlin on May 3, 2024. The attacks exploited a Microsoft Outlook vulnerability from as early as March 2022 and were part of a broader campaign against government institutions and businesses. The German government and European Union officials condemned these operations as unacceptable state-sponsored cyber aggression violating international norms. The United States also aligned with Germany, attributing the attacks specifically to APT28. Russia denied involvement. German Interior Minister Nancy Faeser emphasized the threat to democracy and highlighted the deployment of enhanced protective measures against hybrid threats. SPD leadership expressed defiance, citing the attacks as recognition of their democratic resolve and support for Ukraine.", "actor_primary": "APT28", "target_primary": null, "location_text": "Berlin", "location_region": null, "location_coordinates_lat": 52.52, "location_coordinates_lon": 13.405, "location_precision": "Approximate", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The article clearly describes hostile Russian state-aligned cyberattack activity against Germany and its political institutions with concrete attribution to APT28/GRU by credible government sources. The diplomatic response confirms official recognition of aggression.", "event_time_utc": "2024-05-03T00:00:00.000Z", "end_time_utc": null, "event_time_confidence": "pm24h", "created_at": "2026-04-28T13:25:36.242Z", "updated_at": "2026-11-04T08:35:32.139Z", "reliability_band": "strong", "location_precision_band": "approximate", "time_precision_band": "within_24h", "severity_band": "moderate", "attribution_confidence_band": "high", "attribution_basis": "single_source" }