Loading story…
Germany formally blamed Russia for the 2015 cyberattack on the Bundestag, identifying Russian national Dmitry Badin as a suspected operative of the GRU’s Unit 26165, also known as APT28 or Fancy Bear. Federal prosecutors obtained an international arrest warrant accusing him of intelligence activity and data espionage, while Berlin summoned the Russian ambassador and said it had hard evidence tying Moscow to the intrusion.
Investigators said the breach began with spearphishing emails disguised as United Nations messages about the Ukraine conflict, leading to malware infections inside the parliamentary network. The attackers allegedly escalated privileges, used tools including Mimikatz, and exfiltrated at least 16 GB of data, including large volumes of lawmakers’ emails, before the operation was stopped. Germany also pushed for EU-wide sanctions under the bloc’s cyber sanctions regime, making the case one of Europe’s most prominent state-linked cyber attribution actions.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
The European Union imposed sanctions on Russia's GRU and officers Dmitry Badin and Igor Kostyukov for their roles in the 2015 Bundestag hack. The measures included travel bans, asset freezes, and a prohibition on EU citizens and businesses conducting transactions with the sanctioned entities.
Germany's federal prosecutor obtained an international arrest warrant for Dmitrij Badin, accusing him of intelligence activity and data espionage in connection with the 2015 Bundestag hack. German investigators assessed him as a leading figure behind the operation and linked him to GRU unit 26165, also known as APT28 or Fancy Bear.
A Dutch counterintelligence operation targeting suspected GRU unit 26165 operatives attacking the OPCW produced seized laptops and phones that later provided valuable information to German investigators examining the Bundestag hack.
German responders stopped the Bundestag intrusion after attackers had moved laterally, harvested passwords with tools including Mimikatz, and exfiltrated at least 16 gigabytes of data. The stolen material included tens of thousands of parliamentarians' emails.
An IT security company warned Germany's domestic intelligence service about suspicious server communications involving Bundestag systems, after which the BfV informed the BSI. The BSI then sent a team to Berlin to support the Bundestag administration, and the parliament's entire IT system was temporarily shut down during the response.
German prosecutors allege Dmitrij Badin created malware identified as VSC.exe and deployed it minutes later during the Bundestag intrusion. Prosecutors say the malware was used to steal access credentials as the attackers escalated privileges inside the network.
The cyberattack on the German Bundestag began with spearphishing emails sent to multiple members, using fake United Nations-themed messages about the Ukraine conflict to deliver malware. The intrusion targeted the Bundestag network, which then had more than 5,600 computers and about 12,000 registered users.
Germany's foreign ministry summoned the Russian ambassador over the Bundestag cyberattack and said Berlin would push for EU-level sanctions against those responsible. Chancellor Angela Merkel told parliamentarians Germany had hard evidence that Russia was behind the attack and called it outrageous.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
tagesschau.de
Open sourcezdnet.com
Open sourcepolitico.eu
Open sourcesueddeutsche.de
Open sourcebellingcat.com
Open sourcesecureworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Germany publicly accused Russia of orchestrating a cyberattack against Deutsche Flugsicherung, the state-owned air traffic control authority, and conducting a coordinated disinformation campaign aimed at influencing the upcoming federal election. The German Foreign Ministry stated it had clear evidence linking the August 2024 cyberattack to APT28 (Fancy Bear), a group associated with Russia’s GRU military intelligence, and attributed the election interference to the Storm 1516 threat actor. In response, Germany summoned the Russian ambassador, announced plans for countermeasures in coordination with EU partners, and supported new sanctions targeting those involved in hybrid attacks. The Russian embassy has denied the allegations, while European officials have warned of a broader campaign of Russian cyber operations targeting critical infrastructure and political processes across the continent. These developments come amid heightened concern over nation-state cyber threats in Europe, with both France and Germany reporting recent attacks attributed to foreign actors. The French Ministry of Interior is investigating a suspected nation-state breach of its email servers, though details remain limited. European authorities have documented a surge in nation-state-backed cyberattacks, with the EU Agency for Cybersecurity reporting 46 such incidents between July 2024 and July 2025. Officials across Europe have condemned Russia’s use of hybrid tactics, including cyberattacks and disinformation, as part of a broader strategy to destabilize Western democracies.
Jun 29, 2026
German lawmakers are advancing draft legislation to significantly expand the Bundesnachrichtendienst’s (**BND**) hacking and surveillance authorities, including intercepting full internet communications (not just metadata), retaining collected data for up to six months, and extending the agency’s offensive mandate to hack foreign internet service providers to obtain target information when companies do not cooperate. Reporting indicates the proposal is partly aimed at reducing reliance on the US **NSA** for threat intelligence and bringing Germany’s capabilities in line with other European services; it would also broaden who can be surveilled, including foreigners inside Germany and certain journalists tied to foreign state-run media, and would enable intrusive operations such as deploying a “federal trojan.” Separately, Ukrainian and German law enforcement reported disrupting a Russian-affiliated ransomware operation, identifying and searching two suspects in Ukraine alleged to have served as “hash cracker” specialists who extracted/cracked password hashes, used stolen credentials for lateral movement and privilege escalation, and supported ransomware deployment and data exfiltration for extortion. Authorities seized digital devices and cryptocurrency assets and said an alleged Russian organizer has been identified, with foreign partners suggesting possible links to the **Conti** ransomware ecosystem. A third item—a *Citizen Lab* job posting—does not report a specific incident and is primarily recruitment content, despite referencing prior research on targeted phishing and spyware threats.
Jul 2, 2026
Western governments, investigators, and private-sector researchers have linked **Russia’s GRU**, including **Unit 26165** and other associated officers, to a broad campaign of cyber intrusions, destructive malware operations, and close-access hacking against political, diplomatic, and critical targets. Public reporting tied Unit 26165—also known as **Fancy Bear**—to the 2018 attempted compromise of the **OPCW** in The Hague, where Dutch authorities disrupted four Russian operatives allegedly equipped to target the organization’s Wi‑Fi network, and to earlier operations against anti-doping bodies and the device of **Yulia Skripal** using **`X-Agent`** malware. CrowdStrike previously attributed the intrusion into the **Democratic National Committee** to Russian actors associated with the same broader threat cluster. U.S., UK, and independent disclosures have expanded that picture by naming individual GRU officers and units allegedly involved in attacks on **Ukrainian critical infrastructure**, **France’s Macron campaign**, the **2018 Winter Olympics**, **NotPetya** victims, and reconnaissance that supported missile strikes on **Mariupol**, including the theatre attack. In 2020, the FBI publicized charges against six GRU officers for destructive malware and international cyberattacks, while Bellingcat used leaked Russian vehicle registration data to connect several indicted hackers to known GRU addresses tied to **Unit 74455** and related military intelligence infrastructure. The UK later imposed sanctions on multiple GRU units and 18 officers, describing the activity as part of a long-running Russian cyber and hybrid campaign against Ukraine, the UK, and other countries.
Aug 15, 2026