Finance
Germany Intelligence Agency Warns of Russian APT28 Cyber Spying
Published by Global Banking & Finance Review®
Posted on April 7, 2026
1 min readLast updated: April 7, 2026
Add as preferred source on GoogleQuick Summary
Germany’s domestic intelligence agency (BfV), with support from BND and the U.S. FBI, has warned that the Russian-linked cyber‑espionage group APT28 (Fancy Bear) compromised multiple vulnerable TP‑Link routers—including about 30 in Germany—to conduct spying on military, government and critical infra
Germany Warns of Russian APT28 Cyber Spying Targeting Critical Infrastructure
German Intelligence Issues Alert on Russian Cyber Espionage
By Maria Martinez
Overview of the Warning
BERLIN, April 7 (Reuters) - Germany’s domestic intelligence agency warned on Tuesday of cyberattacks by the Russian state-linked hacker group APT28, saying it had compromised vulnerable TP-Link internet routers to spy on military, government and critical infrastructure targets.
Agencies Involved in the Alert
The Federal Office for the Protection of the Constitution (BfV) said the warning was issued with partners including Germany's foreign intelligence agency, BND, and the U.S. FBI.
About APT28 (Fancy Bear)
APT28, also known as "Fancy Bear", is attributed by Western governments to Russia’s military intelligence service, the GRU.
Scope of the Attacks
The group attacked several thousand routers globally, the BfV said, including around 30 vulnerable devices in Germany.
Confirmed Compromises and Response
In some cases, compromise was confirmed, prompting operators to replace affected routers.
APT28's Previous Activities in Germany
APT28 previously carried out cyberattacks on Germany’s parliament, the centre-left SPD political party and air traffic control authorities, the BfV said.
(Reporting by Andreas Rinke; Writing by Maria Martinez; Editing by Jamie Freed)
Key Takeaways
- •APT28 exploited TP‑Link and MikroTik routers via known vulnerabilities (e.g. CVE‑2023‑50224) to hijack DNS settings and intercept traffic (techcrunch.com).
- •The threat is widespread—involving thousands of routers globally—with Germany confirming around 30 local compromises prompting router replacements (techcrunch.com).
- •This operation aligns with APT28’s longstanding GRU‑linked cyber‑espionage campaigns targeting parliaments, political parties, air traffic authorities, and critical infrastructure (ncsc.gov.uk)
References
Frequently Asked Questions about Germany intelligence agency warns of Russian APT28 cyber spying
1What did Germany's intelligence agency warn about?
Germany's domestic intelligence agency warned of cyberattacks by the Russian state-linked hacker group APT28, targeting military, government, and critical infrastructure.
2Who is APT28 and what is their affiliation?
APT28, also known as Fancy Bear, is a hacker group attributed by Western governments to Russia’s military intelligence service, the GRU.
3How were the cyberattacks carried out?
APT28 compromised vulnerable TP-Link internet routers to spy on selected targets, including several thousand routers worldwide and around 30 in Germany.
4Which organizations issued the cyberattack warning?
The warning was issued by Germany's Federal Office for the Protection of the Constitution, with partners including the BND and the U.S. FBI.
5What actions were taken after compromised routers were discovered?
Operators replaced affected routers after confirmation of compromise in some cases.
