Germany

This page covers cyber threats to Germany. It brings together official German texts (the Federal Office for Information Security BSI, the Federal Criminal Police Office BKA, the Federal Government, the Foreign Office, the domestic intelligence service BfV and the state parliament of Saxony-Anhalt), US advisories and Brandefense research. Where an official source names Germany as a target, the page says who said it and when.

Threat groups that official sources link to Germany

Each group below has a profile in our threat group library. Attribution is stated as given by the named body.

APT28: the Federal Government said on 3 May 2024 that APT28 ran a campaign against the executive committee of the SPD, and attributed APT28 to the Russian military intelligence service GRU. The same statement says APT28 is also responsible for the 2015 attack on the German Bundestag. The Foreign Office had said on 28 May 2020 that a suspect was strongly suspected, as a member of APT28, of the Bundestag attack.

Lazarus Group: the US advisory AA21-048A lists Germany among the countries where AppleJeus malware was used against organizations since January 2020, in sectors including energy, finance, government, industry, technology and telecommunications. The FBI, CISA and Treasury attribute the Lazarus Group to North Korean state-sponsored actors.

Incidents on record

The incidents listed below are the major ones that German authorities or the organizations themselves reported, with national impact. Where sources differ, the incident page says so. Small incidents are not listed.

What the BSI and BKA report

The BSI describes the IT security situation in Germany in its 2025 report as tense. It says public administration was one of the main targets of cyber espionage, that reported ransomware attacks stayed largely unchanged at 950, and that small and medium-sized companies made up 80 percent of reported attacks. It also says exploitation of vulnerabilities in web attack surfaces gained in prominence and that many authorities, companies and other organizations still make it too easy for attackers. The BKA says cyber offenses reached a new high in 2024, that ransomware remains the defining threat, and that DDoS campaigns by hacktivist and state actors target critical infrastructure and political institutions.

How attackers target Germany: Brandefense research

Banking and fraud. The Germany Threat Landscape Report summary says the landscape is shaped by attacks on financial institutions, widespread infostealer malware and a dark web market for phishing tools and stolen data. It says criminals phish through social media, SMS and voice calls, and points to supply chain weaknesses in healthcare and manufacturing. Our post on the OCTO banking trojan lists Germany among the countries whose financial institutions it targets. The Strela Stealer analysis says that malware targets only Germany, Spain, Basque Country, Saudi Arabia and Poland.

Ransomware. The Q2 2026 ransomware groups post names Germany among the most frequently targeted countries of the LockBit ecosystem and among the primary geographic targets of other top groups. Our Medusa analysis lists Germany among six countries where Medusa buys access, and the AvosLocker summary lists Germany among its targets.

State-linked and hacktivist. The Weekly Security News Archive for the first half of 2023 reports that the pro-Russian group Noname057(16) launched DDoS attacks on energy companies based in Germany and Sweden, naming RWE and Vattenfall. Our Winter Vivern profile lists Germany among its geographic focus, and the Mythic Leopard post lists Germany among targeted countries.

How Brandefense helps

In plain words, Cyber Threat Intelligence is how a security team learns which groups and malware are aimed at its country and sector. Dark Web Monitoring is how it learns that staff or customer logins and payment cards are for sale, and Phishing Monitoring is how it finds fake sites that copy its brand.

Law and national strategy

The BSI Act first entered into force on 20 August 2009. The IT Security Act of July 2015 added a duty for operators of critical infrastructure to report significant IT security incidents to the BSI. The NIS-2 implementation law was announced on 5 December 2025 and took effect the next day. The BSI says about 29,500 entities now fall under its supervision, against about 4,500 organizations before. Covered entities must register, report significant incidents to the BSI and put risk management measures in place.

How incident response is organized

The BSI is the central reporting office for IT security within the federal administration. The National Cyber Defence Centre sits within the BSI. The BfV and the domestic intelligence services of the federal states form the domestic intelligence community. The Federal Prosecutor’s Office handles state security cases such as espionage. The BKA says it initiated and led Operation Endgame. In the Anhalt-Bitterfeld case of 2021 the BSI sent a crisis team and a specialist team to the district.

The German official texts opened give no attack counts beyond the BSI and BKA figures above. Figures for Germany will come from Brandefense Atlas.