APT28 under suspicion – Russia is said to be behind the hacker attack on the SPD

The SPD announced in June 2023 that email accounts of the SPD party leadership had already been the target of a cyber attack in January. This was made possible by a security breach at the software company Microsoft that was still unknown at the time of the attack, the SPD said at the time – and: “It cannot be ruled out that an outflow of data from individual email inboxes has taken place. .”

The attack was attributed to hacker group APT28
According to Baerbock, the federal government’s investigations, led by the Ministry of Foreign Affairs, have now been completed. “Today we can clearly attribute this attack from last year to the APT28 group, which is controlled by the Russian secret service GRU,” the Green politician said. “This is completely unacceptable and will not go without consequences.” Baerbock did not say what the consequences might be.

According to the German Office for the Protection of the Constitution, the APT28 group has been active worldwide since at least 2004, especially in the field of cyber espionage. In the past, it has also led disinformation and propaganda campaigns in cyberspace and is “one of the most active and dangerous cyber actors in the world.” The German Federal Office for the Protection of the Constitution clearly attributes APT28 to the Russian military intelligence service GRU.

The group, which also goes by the name “Fancy Bear,” was blamed for a major cyberattack on the German Bundestag in 2015 and later in the US for an attack on the Democratic Party before the 2016 presidential election, led by the Republican candidate . Donald Trump won.

All German secret services involved
According to information from the dpa, all German secret services were involved in the German government’s investigations: the Office for the Protection of the Constitution, the Federal Intelligence Service and the Military Counterintelligence Service. According to current information, the attack on the SPD would have been part of an APT28 campaign in several European countries aimed at government services and companies related to energy supply, IT, armaments or space.

The North Atlantic Council, NATO’s main decision-making body, expressed “deep concern” Thursday about increasing Russian cyber attacks, but did not provide details. A statement spoke of “hostile activities” against Germany, Estonia, Latvia, Lithuania, Poland, the Czech Republic and Great Britain.

“These incidents are part of an intensification of Russia’s activities across the Euro-Atlantic region, including in alliance territory and through proxies. These include acts of sabotage, acts of violence, cyber and electronic disruptions, disinformation campaigns and other hybrid operations,” the statement said. The activities posed “a threat to the security of allies.”