Loading story…
Germany’s cabinet approved a draft intelligence reform bill that would significantly expand the powers of the foreign intelligence service BND and the domestic intelligence agency BfV, giving them authority to move beyond passive collection into active cyber operations. The proposal would allow longer retention and analysis of communications data, online searches of devices, covert home entry by the BfV, and limited manipulation of data on compromised systems in imminent-danger cases. It would also authorize action against clearly identified attacker-controlled IT systems such as command-and-control infrastructure, while shifting approval for the most intrusive measures to the Unabhängiger Kontrollrat.
The overhaul would additionally permit hacking foreign systems, disrupting hostile supply chains, disabling infrastructure, and conducting deception operations, while requiring telecommunications carriers and digital service providers to assist intelligence activities. The government says the changes are needed to counter hybrid threats, terrorism, hostile state activity, and other modern IT-based dangers; critics argue the bill marks a major expansion of surveillance and offensive state powers that could face constitutional challenges. A provision that would have required the BSI to share security vulnerabilities with intelligence agencies was removed before the draft was submitted.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Germany’s cabinet approved draft legislation described as a sweeping overhaul of spy laws, granting the BND and BfV new active cyber and disruption powers. The bill would allow actions such as hacking foreign systems, sabotaging hostile supply chains, disabling hostile infrastructure, and conducting deception operations under statutory limits and oversight provisions.
Before the reform draft was finally submitted, a provision that would have required Germany’s BSI to pass security vulnerabilities to intelligence services was removed. The clause was politically sensitive because it could have indirectly funneled reported flaws to the BND.
Interior Minister Alexander Dobrindt and Chancellery Minister Nina Warken presented proposed amendments to the BND Act and the Verfassungsschutz Act that would significantly expand the powers of Germany’s intelligence services. The proposal includes broader retention and analysis of communications data, online searches of devices, and more intrusive cyber measures against attacker-controlled systems.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcetherecord.media
Open sourceheise.de
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
German lawmakers are advancing draft legislation to significantly expand the Bundesnachrichtendienst’s (**BND**) hacking and surveillance authorities, including intercepting full internet communications (not just metadata), retaining collected data for up to six months, and extending the agency’s offensive mandate to hack foreign internet service providers to obtain target information when companies do not cooperate. Reporting indicates the proposal is partly aimed at reducing reliance on the US **NSA** for threat intelligence and bringing Germany’s capabilities in line with other European services; it would also broaden who can be surveilled, including foreigners inside Germany and certain journalists tied to foreign state-run media, and would enable intrusive operations such as deploying a “federal trojan.” Separately, Ukrainian and German law enforcement reported disrupting a Russian-affiliated ransomware operation, identifying and searching two suspects in Ukraine alleged to have served as “hash cracker” specialists who extracted/cracked password hashes, used stolen credentials for lateral movement and privilege escalation, and supported ransomware deployment and data exfiltration for extortion. Authorities seized digital devices and cryptocurrency assets and said an alleged Russian organizer has been identified, with foreign partners suggesting possible links to the **Conti** ransomware ecosystem. A third item—a *Citizen Lab* job posting—does not report a specific incident and is primarily recruitment content, despite referencing prior research on targeted phishing and spyware threats.
Jul 2, 2026
Germany’s federal government signaled a shift toward a more **offensive posture** in response to cyberattacks. Interior Minister **Alexander Dobrindt** said Germany intends to “strike back,” including actions abroad to disrupt attackers and destroy their infrastructure, with operations to be carried out jointly by intelligence services and the **Bundeskriminalamt (BKA)**. The Interior Ministry also plans a new defense center for **hybrid threats**, prepared by the domestic intelligence service, to improve coordination across government levels; Dobrindt framed the move as a response to persistent attacks on institutions, critical infrastructure, and companies, often attributed to groups linked to state services (including Russia). Separately, the **Staatliche Kunstsammlungen Dresden** (a network of 15 museums) reported continued operational impacts from a **cyberattack**, with museums remaining open but key services still impaired, including `online ticketing`, card payments on-site, the online shop, and visitor services. Police and the state criminal office initiated investigations, and the Dresden public prosecutor indicated the case may be handled by Saxony’s specialized cybercrime unit (ZCS). The UK government’s discussion of building a **digital ID** system in-house is policy/technology governance reporting and does not describe a specific cyber incident or vulnerability tied to the German developments.
Jul 12, 2026
Civil society groups in Germany, including Amnesty International and the Chaos Computer Club, urged the government to withdraw draft laws that would expand digital policing powers through **biometric internet searches** and automated analysis of large police datasets using systems such as **Palantir**. Critics said the proposals from the justice and interior ministries lack judicial oversight, transparency, documentation requirements, and clear limits on data scope and analytical methods, creating risks of mass surveillance, discriminatory profiling, and intrusive scrutiny of victims, witnesses, and uninvolved people. Germany’s independent data protection authorities also concluded that the measures, as drafted, are incompatible with constitutional requirements and could effectively sidestep the EU AI Act’s ban on mass facial-image processing into biometric databases. At the EU level, a coalition led by **BEUC** and 31 other organizations warned that the proposed **AI Omnibus** could dilute safeguards by exempting sectors such as medical devices, radio equipment, toys, and machinery from the AI regulation’s direct scope. The groups argued that existing sector-specific product rules do not address AI-specific harms including discrimination, opacity, and the evolving behavior of AI systems, and said the change would create regulatory gaps, fragmentation, and legal uncertainty rather than simplification. They warned that weakening the framework would undermine consumer protection, fundamental rights, and trust in European AI governance as trilogue negotiations continue.
Jun 29, 2026