The alert came from the Federal Office for the Protection of the Constitution (BfV), which said the attacks were carried out by APT28, a group widely associated with Russian military intelligence, News.Az reports, citing Reuters.
According to German authorities, the hacking group, also known as Fancy Bear, exploited vulnerabilities in routers made by TP-Link.
The campaign reportedly affected thousands of devices worldwide, including around 30 in Germany. In some cases, authorities confirmed that systems had been compromised, prompting operators to replace the affected hardware.
The attacks were aimed at a range of sensitive sectors, including:
- Military networks
- Government institutions
- Critical infrastructure systems
Officials warned that such access could allow attackers to monitor communications or gather intelligence from key organizations.
The warning was issued in coordination with multiple intelligence partners, including Germany’s foreign intelligence service, the Federal Intelligence Service (BND), and the Federal Bureau of Investigation (FBI) in the United States.
APT28 has long been linked by Western governments to Russia’s GRU military intelligence agency, although Moscow has repeatedly denied involvement in cyberattacks.
German officials noted that the group has previously targeted major institutions in the country, including:
- The national parliament
- The Social Democratic Party of Germany (SPD)
- Air traffic control systems
The latest warning highlights ongoing concerns about vulnerabilities in widely used consumer and enterprise hardware, especially devices like routers that can serve as entry points into larger networks.
Authorities are urging organizations to update firmware, replace outdated equipment, and strengthen cybersecurity measures to guard against similar attacks in the future.
