Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
German agencies have joined warnings about Russian-linked cyber activity, but the advisories describe separate campaigns—not one operation against all critical infrastructure. A May 2025 advisory focused on a GRU unit’s cyber-espionage targeting of Western logistics and technology organizations. A December 2025 advisory addressed pro-Russia hacktivists attacking critical infrastructure, while a July 2026 U.S. National Security Agency release summarized separate guidance on exploitation by Russia’s FSB Center 16. The actors, targets and recommended defenses differ.
What German officials mean by Russian hybrid threats
The Bundeswehr’s 6 August 2025 overview describes Russian activity in cyberspace and the information space as part of a broader hybrid threat that can include cyber espionage, sabotage, influence operations and proxy activity. It says EU and NATO countries, along with Ukraine, are regular targets, and that activity against Germany has increased in the context of German support for Ukraine. These categories are related, but they are not interchangeable: an espionage campaign, a website-disrupting DDoS attack and a disinformation effort require different analysis and response.
The Bundeswehr says phishing is a common entry point for cyber espionage: attackers seek credentials that can give them access to IT networks. It also reports pro-Russian hacktivist DDoS campaigns against Germany since late 2024. DDoS attacks can temporarily make websites or servers unavailable; that disruption is not, by itself, evidence that the attackers stole data or entered an operational control system. Bundeswehr overview, 6 August 2025.
In late 2024, Defence Minister Boris Pistorius warned: “Putin greift hybrid an. […] Wir müssen uns vorbereiten, um uns Putins Bedrohung selbstbewusst entgegenstellen zu können.” (“Putin is attacking in hybrid fashion. […] We must prepare so that we can confidently counter Putin’s threat.”) The Bundeswehr article presents the quote in the context of Germany’s broader hybrid-threat assessment.
#1 Best Overall
Three warnings, three distinct contexts
| Warning | Actor named | Focus described | Source context |
|---|---|---|---|
| 21 May 2025 | GRU 85th Main Special Service Center, military unit 26165 | Cyber espionage targeting Western logistics entities and technology companies, including some involved in assistance to Ukraine | Joint advisory involving Germany’s BND, BfV and BSI and international partners |
| 9 December 2025 | Pro-Russia hacktivists | Attacks against critical infrastructure, including OT and industrial control system incidents | Separate joint advisory with Germany’s BSI among the authoring partners |
| 13 July 2026 | Russian FSB Center 16 | Exploitation of vulnerable or poorly configured networks across several sectors | NSA release summarizing multinational guidance; the release’s listed co-sealing agencies do not include Germany’s BND or BfV |
The table distinguishes the advisories’ stated subjects; it does not establish that these threats are mutually exclusive or that each incident in a named sector belongs to one of these actors.
What the May 2025 GRU advisory says
The BSI’s official record for the 21 May 2025 joint advisory says the GRU’s 85th Main Special Service Center, military unit 26165, is associated with a campaign targeting Western logistics entities and technology companies. The advisory says these organizations have faced elevated targeting risk since 2022, particularly where they coordinate, transport or deliver foreign assistance to Ukraine. It characterizes the activity as cyber espionage-oriented and expects similar targeting and tactics to continue.
Germany’s BND, BfV and BSI participated with international partners. This attribution applies to the campaign described in this advisory; it should not be generalized to every cyber incident against critical infrastructure or treated as an attribution of the separate hacktivist and FSB warnings. BSI, “Russian GRU Targeting Western Logistics Entities and Technology Companies,” 21 May 2025.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What the December 2025 critical-infrastructure warning covers
The 9 December 2025 joint advisory, “Pro-Russia Hacktivists Conduct Attacks Against Critical Infrastructure,” addresses pro-Russia hacktivist activity, with the notice also referencing operational technology (OT) and industrial control system (ICS) incidents. It is a different warning from the May GRU advisory: the actor category and stated target context differ. The advisory is listed by U.S. agencies and includes Germany’s BSI among its authoring partners. Joint advisory, 9 December 2025.
Rank #3
Critical infrastructure can rely on OT and ICS to monitor or control physical processes. A disruption to a public-facing website and an incident affecting those systems are not the same outcome. The available notice establishes the advisory’s subject, but does not support treating every hacktivist incident as a successful compromise of industrial controls.
What the July 2026 FSB network guidance recommends
In a 13 July 2026 release, the NSA summarized allied guidance on the FSB’s Center 16, which it says continues to exploit vulnerable or poorly configured networks. The release names the defense industrial base, communications, energy, financial services, government facilities and healthcare among affected sectors. This is a separate advisory context from the two 2025 warnings; the NSA release’s listed co-sealing agencies do not include Germany’s BND or BfV.
The multinational guidance summarized by the NSA recommends these network-hardening actions:
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute- Implement SNMPv3.
- Use strong, unique passwords.
- Disable Cisco Smart Install.
- Block TFTP, SMI and SNMP protocols at the firewall.
- Upgrade software and firmware images to patch vulnerabilities.
These are configuration and maintenance measures, not a recommendation to buy a particular consumer router. Administrators should assess the guidance against their own network architecture and operational requirements. NSA release, “Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting,” 13 July 2026.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How organizations can use the warnings
The advisories point to different defensive priorities. The measures below follow the threats described; they are not a single checklist issued by all the agencies.
Best Value
- For phishing and espionage risk: Make credential theft harder through sound identity and access controls, and train staff to recognize phishing. The Bundeswehr identifies phishing and stolen credentials as a common route into IT networks.
- For exposed or poorly configured network equipment: Review device configuration, firmware and the protocol controls specified in the July 2026 guidance. Apply changes in a way that accounts for dependencies in production networks.
- For OT and ICS environments: Treat operational systems as distinct from ordinary IT and public websites. Assess suspected incidents for effects on monitoring or physical processes, not just service availability.
- For DDoS disruption: Plan for temporary loss of website or server availability, while distinguishing that symptom from evidence of espionage or an OT compromise.
What the warnings do—and do not—establish
The cited publications describe campaign scope, target categories and defensive actions, but they do not provide a directly relevant total or rate of Russian cyberattacks on German critical infrastructure. They therefore support understanding the threats and their differences, not a numeric estimate of incident frequency. The three advisories also do not establish that all Russian-linked activity is centrally directed by one actor or that every reported incident has the same objective.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
