Glossary term
Threat attribution
Threat attribution is the process of linking an attack or a campaign to the group or state believed to be behind it.
Read more
Significant cyber incident
APT28 attack on the SPD executive, attributed by Germany in May 2024
The APT28 attack on the SPD executive was publicly attributed by the German Federal Government on 3 May 2024.
In short
The APT28 attack on the SPD executive was publicly attributed by the German Federal Government on 3 May 2024. Germany attributes APT28 to the Russian military intelligence service GRU. According to the government, the actor used an Outlook vulnerability not yet known, over a relatively long period, to compromise numerous e-mail accounts. Germany summoned the Russian chargé d'affaires and recalled its ambassador for consultations.
What happened
On 3 May 2024 the Federal Government condemned a campaign by the state-sponsored actor APT28 that targeted the executive committee of the SPD. It said its national attribution procedure had concluded that APT28 used a critical vulnerability in Microsoft Outlook, not identified at the time, over a relatively long period to compromise numerous e-mail accounts (Federal Government, 3 May 2024).
The statement says the same campaign also targeted government authorities and companies in logistics, armaments, the air and space industry and IT services, and foundations and associations. It was directed at entities in Germany, other European countries and targets in Ukraine. CERT-EU dates the attack on SPD executive e-mail accounts to 2023.
The government attributes APT28 to the Russian Federation, and more specifically to the GRU, based on information from its intelligence services. It also called APT28 responsible for the 2015 Bundestag attack. Czechia said on the same day that its institutions were targets of such a campaign, and the EU High Representative spoke for the EU and its member states.
The sources opened do not give the date of the first intrusion, the number of accounts, or what was read or taken. The exact number of victims is not stated.
Timeline
-
2023
CERT-EU dates the attack on various e-mail accounts of the SPD executive to 2023. The exact dates are not given in the sources opened.
-
3 May 2024
The Federal Government publishes its attribution of the APT28 campaign and condemns it, with the support of the EU, NATO and partners.
-
3 May 2024
The Foreign Office summons the acting chargé d'affaires of the Russian embassy.
-
3 May 2024
Czechia confirms that its institutions were targets of a similar campaign. The EU High Representative condemns the campaign for the EU and its member states.
-
6 May 2024
The Foreign Office says the foreign minister decided to recall the German ambassador for consultations after the attribution.
-
May 2024
The Council of the EU releases a statement strongly condemning the cyberattacks, as reported by CERT-EU in its June 2024 brief.
How the attack worked
The official account is short. The sources opened give no technical report, so only what the Federal Government states is set out here.
The way in
The Federal Government says APT28 used a critical vulnerability in Microsoft Outlook that was not identified at the time. It used it over a relatively long period to compromise numerous e-mail accounts. The statement does not give a CVE number or describe the exploit steps.
Who was targeted
Besides the SPD executive committee, the campaign targeted government authorities and companies in logistics, armaments, air and space, and IT services, and foundations and associations, in Germany, other European countries and Ukraine.
How the finding was reached
The government says its national attribution procedure concluded APT28 was behind the campaign, based on reliable information from its intelligence services.
- Unknown Outlook flawAPT28 used a critical Microsoft Outlook vulnerability that was not identified at the time
- Mail accounts compromisedOver a relatively long period, numerous e-mail accounts were compromised, including accounts of the SPD executive
- Several sectors targetedGovernment authorities and companies in logistics, armaments, air and space, and IT services were also targeted
- National attributionGermany’s attribution procedure named APT28 and tied it to the GRU
Who says who was behind it
Who attributed it, and how firm it is
Attributed by the Federal Government of Germany, 3 May 2024: APT28 is attributed to the Russian Federation and more specifically to the Russian military intelligence service GRU, based on information from the German intelligence services.
Statement of the EU High Representative for the EU and its member states, 3 May 2024, as reported by the European Commission Representation in Germany: condemns the campaign by APT28, which it describes as Russian-controlled.
CERT-EU, June 2024: reports that the German foreign minister attributed the attack to Russia-linked APT28.
Impact
Federal Government, 3 May 2024: numerous e-mail accounts were compromised over a relatively long period. The campaign also targeted government authorities and companies in logistics, armaments, the air and space industry and IT services, and foundations and associations.
The government called attacks on political parties, state institutions and critical infrastructure firms a threat to democracy and national security.
The number of accounts, the data read or taken, and the dates of the intrusion are not stated in the sources opened.
Government and regulator response
- 3 May 2024: The Federal Government published its attribution and condemned the campaign in the strongest terms. The Foreign Office summoned the acting Russian chargé d’affaires and reserved the right to take further consequences. It pointed to the EU cyber diplomacy toolbox, which includes sanctions.
- 3 May 2024: The EU High Representative condemned the campaign for the EU and its member states. Czechia confirmed it was also targeted.
- 6 May 2024: The Foreign Office said the foreign minister decided to recall the German ambassador to Russia for consultations. It called this a usual step after comparable events.
- May 2024: The Council of the EU released a statement strongly condemning the attacks, as reported by CERT-EU.
Lessons
-
Unknown flaws hit the best-run offices
The government says the Outlook flaw was not identified at the time of use. Defense cannot rely on patching alone.
-
Long dwell time is possible
The government says the actor was active for a relatively long period. Plan for detection after the fact, such as reviewing mailbox sign-ins.
-
Political bodies are targets
The government names a governing party, authorities and foundations as targets. Parties and associations need the same mailbox protection as firms.
-
Mail is a core asset
The campaign was about e-mail accounts. Limit who can read whom, and watch for unusual mailbox access.
-
Targets can be a chain
The same campaign reached logistics, armaments, air and space and IT services firms. Suppliers to state bodies should expect the same attention.
-
Attribution is a political act
Germany combined a public statement, a summons and an ambassador recall. Prepare the communications side of a state-linked incident.
What to check in your own organization
-
Mail client patching
Confirm how fast Outlook and mail server updates reach every machine, and who is exempt.
-
Mailbox sign-in review
Search mailbox audit logs for unusual sign-ins, forwarding rules and delegate access on leadership accounts.
-
Multi-factor authentication
Check that every mail account, including those of leadership and shared mailboxes, requires strong authentication.
-
Detection of exploit behavior
Ask your security team what alerts would fire if a mail client were exploited before a patch exists.
-
Suppliers and associates
List foundations, associations and service firms with access to your mail and shared data, and ask how they secure it.
-
Logging
Check how long mail and sign-in logs are kept, since long campaigns need long history.
-
Contact with authorities
Know which national body to call if you suspect a state-linked intrusion.
Where it happened
- Country Germany Germany faces cyber espionage by state actors, ransomware against companies and local governments, and DDoS campaigns against critical infrastructure. Europe
- Industry Government and public sector State-backed espionage, supplier breaches, attacks on exposed servers and targeted phishing against public bodies, and the rules that apply.
Questions
Who did Germany blame?
The Federal Government attributed the campaign to APT28 and tied APT28 to the Russian military intelligence service GRU (3 May 2024).
What was attacked?
Various e-mail accounts of the SPD executive committee, per the Federal Government and CERT-EU. The same campaign also targeted authorities and companies in several sectors.
How was it done?
The government says APT28 used a critical vulnerability in Microsoft Outlook that was not yet identified, over a relatively long period.
What did Germany do?
It summoned the acting Russian chargé d'affaires on 3 May 2024 and recalled its ambassador for consultations, as the Foreign Office said on 6 May 2024.
Did the EU react?
Yes. The EU High Representative condemned the campaign for the EU and its member states, and CERT-EU reports a statement from the Council of the EU.
Is there a link to the Bundestag attack?
The Federal Government said APT28 is also responsible for the 2015 Bundestag attack.
In our research
- Threat attribution Glossary term
Sources
- Attribution of a Russian cyber campaign (3 May 2024) Federal Government of Germany
- Erklärungen des Auswärtigen Amts in der Regierungspressekonferenz vom 03.05.2024 Auswärtiges Amt
- Erklärungen des Auswärtigen Amts in der Regierungspressekonferenz vom 06.05.2024 Auswärtiges Amt
- Russische Cyberangriffe: Borrell spricht von böswilligem Verhalten (3 May 2024) European Commission Representation in Germany
- Cyber Brief 24-06 - May 2024 CERT-EU
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.