Glossary term
Backdoor
A backdoor is an undocumented way of gaining access to a computer system, and NIST says it is a potential security risk.
Read more
Significant cyber incident
German Bundestag network intrusion, 2015
In early May 2015 German authorities learned that attackers had compromised the internal network of the German Bundestag, the national parliament.
In short
In early May 2015 German authorities learned that attackers had compromised the internal network of the German Bundestag, the national parliament. The BSI, the federal cyber security office, found malware on workstations, stolen system credentials, backdoors and keyloggers. In May 2020 the Federal Government named a suspected APT28 member, believed to belong to the Russian military intelligence service GRU, and on 22 October 2020 the EU imposed sanctions over the attack.
What happened
In early May 2015 the domestic intelligence service (BfV) told the Bundestag and the BSI that at least two computers in the Bundestag network were compromised. The Bundestag had already seen anomalies in its network. The BSI and an external provider then investigated for the Bundestag (BSI, 2015 situation report).
The BSI found that the attackers followed the classic APT method. They installed malware on workstations, spread through the internal network with the credentials of a system account used for software distribution, and left backdoors, keyloggers and tools that take screenshots. The BSI concluded they were after selected mailboxes, among other things (BSI).
On 11 June 2015 the Bundestag President told MPs that no data had flowed out in the previous two weeks, but that this did not mean the attack was over. The analysis suggested rebuilding at least parts of the IT system, which was not expected to need new hardware (Deutscher Bundestag, 11 June 2015).
Five years later, on 28 May 2020, the Federal Foreign Office said an arrest warrant had been issued on 29 April 2020 against a Russian national, Dmitri Badin, who was strongly suspected, as a member of APT28, of the attack. On 22 October 2020 the EU Council imposed restrictive measures on two individuals and one body over the attack.
Timeline
-
Early May 2015
The BfV informs the Bundestag and the BSI that at least two Bundestag computers are compromised. The Bundestag has already noticed anomalies.
-
Early May 2015
The BSI and an external provider investigate for the Bundestag and find a classic APT intrusion.
-
May 2015
Activity found in the network includes a backdoor, keyloggers, screenshot tools and scripts that collect documents of certain file types.
-
11 June 2015
The Bundestag President says there were no data outflows in the previous two weeks, that the attack is not over, and that parts of the IT system should be rebuilt.
-
11 June 2015
The Bundestag President says the Federal Prosecutor has started to examine whether an initial suspicion exists.
-
29 April 2020
At the request of the Federal Prosecutor's Office, an arrest warrant is issued against Russian national Dmitri Badin.
-
28 May 2020
State Secretary Miguel Berger condemns the attack to the Russian ambassador and says Germany will call for EU cyber sanctions.
-
3 June 2020
The Federal Government informs the EU Council working group on cyber issues and proposes EU sanctions.
-
22 October 2020
The EU Council imposes restrictive measures on two individuals and one body over the attack. The UK enforces matching sanctions the same day.
-
3 May 2024
The Federal Government states that APT28 is also responsible for the 2015 Bundestag attack.
How the attack worked
The main technical account is the BSI situation report for 2015. It describes an intrusion that followed the classic APT pattern, the one the BSI says is used by almost all known cyber espionage groups. The BSI does not name the group in that report.
Getting in
The attackers first infected individual workstations with malware. The BSI could not trace the first infection in the logs, because logs were kept for at most seven days.
Spreading and staying
The attackers loaded further tools onto the infected systems, including publicly available tools that many groups use. One of them was used to find the credentials of a system account for software distribution, which they used to spread inside the network (Valid Accounts, T1078). A backdoor was installed on some systems so the attackers could return at any time. The BSI also found keyloggers and screenshot tools (Input Capture: Keylogging, T1056.001).
What they wanted
Self-written scripts collected documents of certain file types. From the analysis the BSI concluded the attackers were after selected e-mail mailboxes, among other things.
Mistakes
The BSI says the attackers used common methods and public tools, which may have been meant to make attribution harder. Some of their mistakes made their activity traceable and detectable.
- Infect workstationsMalware was placed on individual workstations; the first infection could not be traced because logs were kept at most seven days
- Load more toolsFurther tools, including public ones, were loaded onto infected systemsTechnique T1105 (MITRE ATT&CK, opens in a new tab)
- Use a system accountCredentials of a software-distribution system account were found and used to spreadTechnique T1078 (MITRE ATT&CK, opens in a new tab)
- Install backdoor and keyloggersA backdoor, keyloggers and screenshot tools were left on some systemsTechnique T1056.001 (MITRE ATT&CK, opens in a new tab)
- Collect documents and mailScripts gathered documents of certain file types; the BSI judged selected mailboxes were a target
ATT&CK techniques
- Technique Ingress Tool Transfer Ingress Tool Transfer is a technique where attackers bring tools or other files from outside into a network they have already broken into. T1105 · Command and Control
- Technique Input Capture Input capture is when an attacker records what a user types or enters, to steal passwords or other information. T1056 · Collection, Credential Access
- Technique Valid Accounts Valid Accounts means an attacker logs in with real credentials that were stolen or bought. T1078 · Stealth, Persistence, Privilege Escalation, Initial Access
Who says who was behind it
Who attributed it, and how firm it is
Attributed by the Federal Foreign Office, 28 May 2020: a Russian national is strongly suspected, as a member of APT28, of the attack, and there is credible evidence that he was a member of the GRU military intelligence service at the time.
Attributed by the Federal Government, 3 May 2024: APT28 is responsible for the 2015 Bundestag attack, and APT28 is attributed to the Russian Federation and more specifically to the GRU.
The UK Foreign Office, 22 October 2020, enforced sanctions against two GRU officers and GRU unit 26165, which it names APT28, as responsible for the 2015 attack.
The BSI 2015 report itself names no group. The Council of the EU press release of 22 October 2020 could not be opened for this profile; the EEAS copy of its summary was used.
Impact
BSI, 2015: at least two Bundestag computers were first reported compromised, and central systems of the internal network were affected. The BSI judged the attackers were after selected mailboxes.
Bundestag President, 11 June 2015: no further data outflows in the previous two weeks, but the attack was not over, and at least parts of the IT system were to be rebuilt, not expected to need new hardware.
UK Foreign Office, 22 October 2020: the attack targeted information systems, stole significant amounts of data and affected e-mail accounts of German MPs and the Vice Chancellor.
The amount of data stolen and the number of accounts are not given in the German sources opened.
Government and regulator response
- May 2015: The BSI and an external provider investigated for the Bundestag. The BfV supported the investigation but did not work inside the Bundestag IT system.
- 11 June 2015: The Bundestag President said parts of the IT system should be rebuilt and an external provider brought in. The Federal Prosecutor began to examine the case.
- 29 April and 28 May 2020: An arrest warrant was issued. The Federal Foreign Office summoned the Russian ambassador and said Germany would call for EU cyber sanctions.
- 3 June 2020: The Federal Government informed the EU Council working group and proposed sanctions, backed by an evidence package from German investigators. It says EU bodies did not take part in the German attribution decision.
- 22 October 2020: The EU Council imposed restrictive measures on two individuals and one body. The UK enforced matching sanctions.
- 3 May 2024: The Federal Government again named APT28 as responsible for the Bundestag attack.
Lessons
-
Keep logs long enough
The BSI could not trace the first infection because logs were kept for at most seven days. Keep security logs for months, not days.
-
Protect the accounts that push software
The attackers used the credentials of a software-distribution system account to spread. Treat such accounts as top-tier and watch their use.
-
Expect a classic APT pattern
The BSI says the attack matched the pattern used by almost all known cyber espionage groups. Plan for hunting, not only blocking.
-
Plan the clean-up
The Bundestag President said parts of the IT system should be rebuilt while forensics continued. Decide early who can order a rebuild.
-
Attribution can take years
Public naming and sanctions came in 2020 and 2024, years after the 2015 intrusion. Keep evidence and records.
-
Public tools do not mean low skill
The BSI says common public tools may have been used to make attribution harder.
What to check in your own organization
-
Log retention
Check how long authentication, mail and endpoint logs are kept. Seven days was too short in this case.
-
Software distribution accounts
List accounts that can deploy software to many machines, and alert on any use outside change windows.
-
Keylogger and screenshot tools
Check that endpoint tools alert on keylogging and screen capture on workstations of senior staff and MPs or executives.
-
Mailbox access
Review who can read other people's mailboxes and alert on bulk mailbox or document collection.
-
Outbound data
Monitor for unusual outbound transfers from internal servers and workstations.
-
Rebuild plan
Write down how you would rebuild a core network, who decides, and who the external responders are.
-
Authorities contact
Know your national contact, such as the BSI in Germany, before an incident happens.
Where it happened
- Country Germany Germany faces cyber espionage by state actors, ransomware against companies and local governments, and DDoS campaigns against critical infrastructure. Europe
- Industry Government and public sector State-backed espionage, supplier breaches, attacks on exposed servers and targeted phishing against public bodies, and the rules that apply.
Questions
When did the Bundestag attack happen?
The BSI says that in early May 2015 the BfV told the Bundestag and the BSI that at least two computers were compromised. The EU Council describes the attack as taking place in April and May 2015.
Who was behind it?
The Federal Government attributes it to APT28, which it attributes to the Russian military intelligence service GRU (3 May 2024). The Federal Foreign Office named a suspect as an APT28 member on 28 May 2020.
What did the EU do?
On 22 October 2020 the Council imposed restrictive measures on two individuals and one body over the attack.
Was data stolen?
The UK Foreign Office says significant amounts of data were stolen. The Bundestag President said on 11 June 2015 that no further data outflows had been seen in the previous two weeks.
How did the attackers get in?
The BSI could not trace the first infection because of short log retention. It says the attackers began with malware on individual workstations.
In our research
- APT28 Threat group
Sources
- Die Lage der IT-Sicherheit in Deutschland 2015 Bundesamt für Sicherheit in der Informationstechnik (BSI)
- Bundestagspräsident Lammert informiert Abgeordnete über Angriff auf das Datennetz des Parlaments (11 June 2015) Deutscher Bundestag
- Federal Foreign Office on the hacker attack on the German Bundestag (28 May 2020) Federal Foreign Office
- Antwort der Bundesregierung, Drucksache 19/20902 (8 July 2020) Deutscher Bundestag
- Malicious cyber-attacks: EU sanctions two individuals and one body over 2015 Bundestag hack (22 October 2020) European External Action Service
- UK enforces new sanctions against Russia for cyber attack on German Parliament (22 October 2020) UK Foreign, Commonwealth & Development Office
- Attribution of a Russian cyber campaign (3 May 2024) Federal Government of Germany
- Russische Cyberangriffe: Borrell spricht von böswilligem Verhalten (3 May 2024) European Commission Representation in Germany
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.