Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
On May 3, 2024, German Foreign Minister Annalena Baerbock said Germany had attributed a prolonged cyberespionage campaign to APT28, a group German officials linked to Russia’s military intelligence service, the GRU. She warned that the activity “will have consequences,” but did not announce a specific measure. The attribution was Germany’s official claim, not a court finding.
What Germany accused Russia of
Speaking at a news conference in Adelaide, Baerbock said: “Russian state hackers attacked Germany in cyberspace.” German officials attributed the campaign to APT28, also known as Fancy Bear, and linked the group to the GRU. Officials said the attackers exploited a previously unknown vulnerability in Microsoft Outlook to access email accounts.
The political focus was the Social Democratic Party of Germany (SPD), then the leading party in Chancellor Olaf Scholz’s governing coalition. The reported targets extended beyond the party: AP said they included the SPD executive committee, other German government authorities, foundations and associations, German defense and aerospace companies, and targets connected with the war in Ukraine. The account of the campaign chronology and targets here follows AP’s reporting on German officials’ statements; the underlying ministry statement was not directly available in the reviewed sources.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
When the campaign and SPD email access occurred
The dates describe different stages, rather than one incident date. AP reported that Germany’s Interior Ministry said the broader campaign began at least as early as March 2022. AP placed access to SPD headquarters emails in December 2022, while Euronews reported that the particular attack under discussion took place in January 2023.
#1 Best Overall
- March 2022: The broader campaign reportedly began, according to Germany’s Interior Ministry as reported by AP.
- December 2022: AP reported that SPD headquarters emails began to be accessed.
- January 2023: Euronews dated the specific attack it described to this month.
What “will have consequences” meant
Baerbock said the attack was “absolutely intolerable and unacceptable and will have consequences.” She did not say what Germany would do. The EU condemned the campaign against Germany and Czechia, and NATO said allies were prepared to coordinate responses to cyberthreats. Those statements established a broader diplomatic response, but did not specify a German measure at the Adelaide news conference.
How the incident fit wider APT28 targeting
German and Czech officials said APT28 had also targeted Czech institutions. NATO said the group had targeted national government entities and critical-infrastructure operators in Lithuania, Poland, Slovakia and Sweden. These claims situate the German case in wider cross-border activity; they do not establish a victim count or quantified damage for the German campaign.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.A separate U.S. operation involving APT28 infrastructure
In January 2024, the U.S. Department of Justice announced a court-authorized operation disrupting a botnet of hundreds of compromised small-office/home-office routers used by GRU Unit 26165, also known as APT28 and Fancy Bear, among other aliases. DOJ said other criminal actors had installed Moobot malware on Ubiquiti Edge OS routers using publicly known default administrator passwords, and GRU operators later adapted the botnet for espionage. This was a separate operation—not the remediation of the SPD intrusion—and its router figures are not a count of German victims.
DOJ’s advice to owners concerned about those affected routers was to factory-reset them, update firmware, change default credentials and avoid exposing remote management. That guidance pertains to the router operation, not to readers generally or to the German email incident.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
