Back Globalbankingandfinance

Germany Issues Warning Over Russian APT28 Cyber Spying Campaign - Global Banking & Finance Review®

Globalbankingandfinance • April 7, 2026

Germany’s domestic intelligence agency (BfV), with support from BND and the U.S. FBI, has warned that the Russian-linked cyber‑espionage group APT28 (Fancy Bear) compromised multiple vulnerable TP‑Link routers—including 30 in Germany—to conduct spying on military, government and critical infra

BERLIN, April 7 (Reuters) - Germany’s domestic intelligence agency warned on Tuesday of cyberattacks by the Russian state-linked hacker group APT28, saying it had compromised vulnerable TP-Link internet routers to spy on military, government and critical infrastructure targets.

The Federal Office for the Protection of the Constitution (BfV) said the warning was issued with partners including Germany's foreign intelligence agency, BND, and the U.S. FBI.

APT28, also known as "Fancy Bear", is attributed by Western governments to Russia’s military intelligence service, the GRU.

The group attacked several thousand routers globally, the BfV said, including around 30 vulnerable devices in Germany.

In some cases, compromise was confirmed, prompting operators to replace affected routers.

APT28 previously carried out cyberattacks on Germany’s parliament, the centre-left SPD political party and air traffic control authorities, the BfV said.

(Reporting by Andreas Rinke; Writing by Maria Martinez; Editing by Jamie Freed)

Germany's domestic intelligence agency warned of cyberattacks by the Russian state-linked hacker group APT28, targeting military, government, and critical infrastructure.

APT28, also known as Fancy Bear, is a hacker group attributed by Western governments to Russia’s military intelligence service, the GRU.

APT28 compromised vulnerable TP-Link internet routers to spy on selected targets, including several thousand routers worldwide and around 30 in Germany.

The warning was issued by Germany's Federal Office for the Protection of the Constitution, with partners including the BND and the U.S. FBI.

Operators replaced affected routers after confirmation of compromise in some cases.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

APT28 Exploits Vulnerable Routers for Global DNS Hijacking Campaign Russian cyber group APT28, also known as Fancy Bear, has been exploiting vulnerabilities in TP-Link and MikroTik routers to conduct large-scale DNS hijacking operations. This campaign, which has affected over 18,000 devices across 120 countries, allows attackers to intercept internet traffic and steal sensitive information, including passwords and access tokens. The group has been leveraging known vulnerabilities, such as CVE-2023-50224, to modify DNS settings and redirect users to malicious servers. The U.S. Department of Justice and FBI recently announced the takedown of a significant portion of this infrastructure in an operation dubbed 'Operation Masquerade.' The attacks have primarily targeted military, government, and critical infrastructure sectors. Authorities are urging users to update their devices and follow security best practices to mitigate risks. The NCSC and Microsoft have issued advisories detailing the ongoing threat and the need for immediate action. 100 sources 78

Extracted Entities

Germany Issues Warning Over Russian APT28 Cyber Spying Campaign - Global Banking & Finance Review®

The full story

Extracted Entities

APT Groups (2)

Companies (2)

Countries (2)

Industries (1)