Germany Responds to Alleged Russian Cyberattack on Air Traffic Control

Key Findings:

• Germany summoned Russia's ambassador over alleged cyberattacks on its air traffic control authority and a disinformation campaign ahead of national elections.

• The German government has clear evidence linking an August 2024 cyberattack on Deutsche Flugsicherung, the country's air traffic control authority, to the Russia-nexus group APT28 (aka Fancy Bear).

• Germany also accused Moscow of attempting to influence and destabilize Germany's federal election through a disinformation campaign tracked as Storm 1516.

• The German Foreign Ministry spokesperson said the objective of these Russian cyber and disinformation operations is "to sow division, erode trust, provoke societal rejection, and undermine confidence in democratic institutions."

• Germany says it will take a series of countermeasures in close coordination with European partners, including supporting new individual sanctions against hybrid actors.

Background

The German government summoned Russia's ambassador after accusing Moscow of cyber attacks against its air traffic control authority and running a disinformation campaign ahead of February's election.

The Foreign Ministry spokesperson said the Russian military intelligence service GRU is responsible for the August 2024 cyberattack on Deutsche Flugsicherung, the country's air traffic control authority. This attack was carried out by the Russia-linked hacking group APT28, also known as Fancy Bear.

Additionally, the German government accused Russia of attempting to influence and destabilize the country's federal election through a disinformation campaign tracked as Storm 1516. This campaign has also interfered in elections beyond Germany, including in the U.S. state of Georgia.

Cyberattack on Air Traffic Control

The German government announced it has clear evidence linking the August 2024 cyberattack on Deutsche Flugsicherung, the country's air traffic control authority, to the Russia-nexus group APT28 (Fancy Bear). The Foreign Ministry spokesperson stated that "our intelligence findings prove that the Russian military intelligence service GRU bears responsibility for this attack."

Disinformation Campaign Before Elections

Germany also accused Moscow of attempting to influence and destabilize the country's federal election through a disinformation campaign tracked as Storm 1516. This campaign has targeted various political figures, including the Green Party's candidate Robert Habeck and the Christian Democrat candidate Friedrich Merz, who is now Chancellor.

The disinformation campaign involved the spread of "artificially generated fictitious investigative research, deepfake image sequences," fake websites of journalists, and invented witness statements across multiple platforms.

Response and Countermeasures

The German government said it possesses "absolutely solid proof" of Russian involvement in these hybrid threats, which it claims endanger national security. Berlin will take "a series of countermeasures to make Russia pay a price for its hybrid actions, in close coordination with our European partners."

This includes supporting new individual sanctions against hybrid actors and enhancing monitoring of Russian diplomats traveling within the Schengen Area to improve intelligence sharing and mitigate security risks.

Sources

• https://securityaffairs.com/185650/apt/germany-calls-in-russian-ambassador-over-air-traffic-control-hack-claims.html

• https://www.kyivpost.com/post/66146

• https://www.france24.com/en/video/20251212-berlin-summons-russian-ambassador-over-increase-in-hybrid-attacks

• https://therecord.media/germany-summons-russian-ambassador-cyberattack-disinformation