APT 28 group is ramping up information warfare against Germany

11.12.2016 securityaffairs APT

According to the German Intelligence, the APT 28 group, also known as Fancy Bear, is ramping up information warfare against Germany and the rest of West.
US intelligence agencies blame the Russian government for ramping up infowar against the US and the West. According to the US Government, Russian-state hackers hacked the Democratic National Committee (DNC) and other political organizations worldwide.

Hackers conducted campaigns to interfere with the internal affairs of foreign states, last victim in order of time is Germany, this is the opinion of the Germany’s chief of domestic intelligence who warned of this threat last week.

On December 8, the Germany’s Bundesamt für Verfassungsshutz (BfV) has issued a press release warning of a rise in Russian propaganda and hacking campaigns.

“We see aggressive and increased cyber spying and cyber operations that could potentially endanger German government officials, members of parliament and employees of democratic parties,” reads a statement issued by Hans-Georg Maassen, head of the BfV agency

The goal of Russian hackers is to spread uncertainty, strengthen extremist groups and parties, with the intent of “weaken or destabilise the Federal Republic of Germany.”

Both the heads of the German foreign intelligence agency (BND), Bruno Kahl, and the domestic intelligence agency (BfV), Hans-Georg Maassen, have warned about increasing Russian cyber operations in the country.

Foto: Johannes Simon/ ddp

Social media are becoming a new battlefield, the BfV observed a spike in propaganda activities as part of PSYOps and noted an increased number of “spear phishing attacks against German political parties and parliamentary groups.” The German intelligence confirmed that hackers are using the strain of malware that were used to broke in the system of the US Democratic National Committee.
“Spear-phishing against political parties and parliamentary groups have increased dramatically. They are attributed to the APT 28 campaign, which was also responsible for the DNC hack. APT 28 successfully exfiltrated data from the German Bundestag in 2015.”

In March security experts at Trend Micro, who follow a long time the operations of the Russian-linked Pawn Storm cyber spies (aka APT 28, Sednit, Sofacy, Fancy Bear and Tsar Team) discovered that the Russian spies targeted the political party of Chancellor Angela Merkel, the Christian Democratic Union.

Some experts speculate that also the recent attack against the Deutsche Telekom routers was powered is linked to Russia.

The German Parliament, the Bundestag, was targeted by hackers that also hit a number of German politicians, including the Chancellor Angela Merkel.

“Such cyber-attacks, or hybrid conflicts as they are known in Russian doctrine, are now part of daily life and we must learn to cope with them.” commented the Chancellor Angela Merkel.

“There are findings that cyber-attacks take place which have no other meaning than to create political uncertainty. There is a kind of pressure on public discourse and on democracy, which is unacceptable.”Kahl told the Süddeutsche Zeitung, “Attribution to a state actor is technically difficult, but there is some evidence that it is at least tolerated or desired by the state.”

The German intelligence observed a rise in Russian online propaganda in Germani since the start of the Ukraine crisis.

“Since the start of the Ukraine crisis, we have seen a significant increase in Russian propaganda and disinformation campaigns in Germany.” reads a statement issued by the BfV.

The German intelligence has explicitly blamed the APT28 as the threat actors behind the hacking campaign used for disinformation activities, the group appears to be specialized in false flag activities. Something similar occurred when Russian Hackers have broken into the French TV5 pretending to be an ISIS-linked group.

“This approach represents a previously unseen methodology in campaigns that are controlled by Russia.”

According to Maassen, APT 28 activity is responsible for an unprecedented disinformation campaign.

“Propaganda, disinformation, cyber-attacks, cyber espionage and cyber sabotage are part of hybrid threats against western democracies.” said Maassen warning of significant an increase in political cyber espionage.”

“Stolen information could be used in the election campaign to discredit German politicians.”

On the other side, the Kremlin denies involvement and warns the US and asked Washington clarifications for US cyber threats.