Signal
Submitted
Feb 1, 2026, 00:14 UTC
In June 2025, two German Bundeswehr suppliers suffered cyberattacks linked to Russian hacker groups, prompting active investigations amid rising Russian cyber threats to German military infrastructure.
In June 2025, German media sources WDR, NDR, and Süddeutsche Zeitung reported two significant cyber incidents targeting Bundeswehr suppliers. A Hessian satellite communication contractor experienced a ransomware attack potentially compromising confidential Bundeswehr classified and operational data, although the Bundeswehr later assessed limited damage. Simultaneously, an engineering firm in Lower Saxony working on sensitive Bundeswehr infrastructure and operational defense plans was hacked, with unknown data losses. German law enforcement, including state criminal police in Hesse and North Rhine-Westphalia, conducts forensic investigations. Security sources attribute the attacks to Russian cybercriminals, possibly sharing tools with Russian state intelligence, reflecting blurred lines between crime and espionage. The Bundeswehr Cyber Security Center and Military Counterintelligence Office oversee defense and mitigation efforts. In parallel, the Bundeswehr has faced an increase in DDoS and phishing attacks since the 2022 Russian invasion of Ukraine, attributed to Russian APT groups like GRU-affiliated APT28. Chancellor Merz publicly acknowledged Russia's ongoing hybrid warfare campaign targeting Germany, characterized by espionage, sabotage, and extensive disinformation operations.
Confidence: High
The source explicitly attributes recent cyberattacks on Bundeswehr suppliers to Russian-linked hacker groups, outlines ongoing forensic and law enforcement investigations, and includes official statements from defense and government officials confirming the cyber threat and its Russian origin, supporting a high confidence classification of an aggressor cyber attack targeting military infrastructure.
Source URL
https://tagesschau.de/investigativ/ndr-wdr/cyberangriffe-bundeswehr-russland-100.html
Source reliability
A
Info credibility
2
Event time
Jun 15, 2025, 00:00 UTC
Event time confidence
unknown
Location
Hesse and Lower Saxony (Germany)
Region
Hesse, Lower Saxony
Primary actor
APT28
Country
Germany
Countries
Germany
Tags
Bundeswehr, cyberattacks, Ransomware, Russia, APT28, GRU, Cybercrime, Espionage, Military Infrastructure, Hybrid Warfare, DDoS, Phishing
Nodes
Node 1: Borders, Node 2: 5th Column
Signal
Submitted
Feb 1, 2026, 00:14 UTC
In June 2025, two German Bundeswehr suppliers suffered cyberattacks linked to Russian hacker groups, prompting active investigations amid rising Russian cyber threats to German military infrastructure.
In June 2025, German media sources WDR, NDR, and Süddeutsche Zeitung reported two significant cyber incidents targeting Bundeswehr suppliers. A Hessian satellite communication contractor experienced a ransomware attack potentially compromising confidential Bundeswehr classified and operational data, although the Bundeswehr later assessed limited damage. Simultaneously, an engineering firm in Lower Saxony working on sensitive Bundeswehr infrastructure and operational defense plans was hacked, with unknown data losses. German law enforcement, including state criminal police in Hesse and North Rhine-Westphalia, conducts forensic investigations. Security sources attribute the attacks to Russian cybercriminals, possibly sharing tools with Russian state intelligence, reflecting blurred lines between crime and espionage. The Bundeswehr Cyber Security Center and Military Counterintelligence Office oversee defense and mitigation efforts. In parallel, the Bundeswehr has faced an increase in DDoS and phishing attacks since the 2022 Russian invasion of Ukraine, attributed to Russian APT groups like GRU-affiliated APT28. Chancellor Merz publicly acknowledged Russia's ongoing hybrid warfare campaign targeting Germany, characterized by espionage, sabotage, and extensive disinformation operations.
Confidence: High
The source explicitly attributes recent cyberattacks on Bundeswehr suppliers to Russian-linked hacker groups, outlines ongoing forensic and law enforcement investigations, and includes official statements from defense and government officials confirming the cyber threat and its Russian origin, supporting a high confidence classification of an aggressor cyber attack targeting military infrastructure.
Source URL
https://tagesschau.de/investigativ/ndr-wdr/cyberangriffe-bundeswehr-russland-100.html
Source reliability
A
Info credibility
2
Event time
Jun 15, 2025, 00:00 UTC
Event time confidence
unknown
Location
Hesse and Lower Saxony (Germany)
Region
Hesse, Lower Saxony
Primary actor
APT28
Country
Germany
Countries
Germany
Tags
Bundeswehr, cyberattacks, Ransomware, Russia, APT28, GRU, Cybercrime, Espionage, Military Infrastructure, Hybrid Warfare, DDoS, Phishing
Nodes
Node 1: Borders, Node 2: 5th Column