The Germany cybersecurity threat landscape is shaped by attacks on financial institutions, widespread infostealer malware and a dark web market for phishing tools and stolen data. This report summary says criminals phish through social media, SMS and voice calls, and that stolen payment cards and credentials stay on sale. It also points to supply chain weaknesses in healthcare and manufacturing.
(…)Financial institutions remain primary targets due to their critical role in digital transactions and the substantial value of customer data they manage. Cybercriminals increasingly employ sophisticated phishing techniques, notably through social media platforms, SMS phishing (smishing), and voice phishing (vishing), using realistic imitations of legitimate banking websites and applications. Simultaneously, the continued circulation of over 220,000 active compromised German-issued payment cards detected by Brandefense highlights serious vulnerabilities within fraud detection systems.
(…)The widespread presence of infostealer malware, notably in sectors such as e-commerce, retail, and manufacturing, underscores the ongoing risk of credential theft and subsequent unauthorized access to corporate networks. The continued sale of tailored phishing tools, large scale financial data sets, and compromised credentials on the dark web indicates sustained criminal interest and capability to exploit German financial institutions and their customers.
- Gain a Clear View of Germany’s Cyber Threat landscape
See how supply chain vulnerabilities in healthcare and manufacturing threaten the stability of the finance sector. - Understand Motives and Methods Behind the Threats
Uncover advanced phishing tactics, dark web activity, and the surge in stolen banking data targeting German institutions. - Access Strategic Recommendations for National Cyber Resilience
Explore strategic recommendations for fraud detection, threat monitoring, and phishing-resistant user awareness.
What Does the Germany Threat Landscape Report Cover?
The report is a country-focused assessment of cyber threats to Germany for 2024 to 2025, with a focus on the financial sector. It was prepared by the Brandefense analyst team and covers phishing, ransomware, stolen payment cards, infostealer malware and dark web activity. It ends with recommendations for defenders.
Key Findings the Report States
- Stolen cards: 357,747 German-issued cards were found in a global set of over 40 million compromised cards. Of these, 222,859 remain active.
- Ransomware: the report counts 25 publicly reported incidents in Q1 2024 and 15 in Q1 2025. It says the fall of LockBit in 2025 is attributed to coordinated law enforcement action.
- Infostealers: E-commerce leads the sector ranking, followed by Retail and Manufacturing.
- Dark web chatter: about 3.53 million mentions of Germany were seen between January and May 2025.
- Criminal offers: sample listings include a phishing script for a German bank priced at 600 euros and bank detail records priced at 5.49 euros each.
How Phishing Works Against German Banks
The report describes fake bank ads, smishing, vishing and phishing pages that copy photoTAN reactivation. Victims enter credentials and scan a fake code, so attackers capture both in real time. The report says defenders should monitor digital platforms for fraudulent content, use behavior-based anti-phishing tools and strengthen authentication with MFA and biometrics.
What the Report Recommends
- Set up automated incident response to invalidate and replace compromised payment cards.
- Monitor dark web forums and illicit marketplaces continuously.
- Run simulated phishing campaigns and measure how well they work.
- Strengthen third-party risk management.
For wider context, the German BSI publishes a yearly report on the state of IT security in Germany, and CISA explains how double extortion works in ransomware incidents.
Reports on other countries are listed under Brandefense country threat landscape reports.