BERLIN – Germany accused Russia on May 3 of launching cyber attacks on its defence and aerospace firms and ruling party, as well as targets in other countries, and warned there would be unspecified consequences.

Russia’s embassy in Berlin dismissed the accusations – which were echoed by the Czech Republic, the Nato defence alliance and the US State Department – calling them “another unfriendly step aimed at inciting anti-Russian sentiments in Germany”.

Nato said the campaign had also targeted government bodies, “critical infrastructure operators” and other entities in Lithuania, Poland, Slovakia and Sweden.

The accusations come at a time of heightened anxiety in Europe over suspected Russian hackers and spies since Moscow’s invasion of Ukraine in 2022, and in the run-up to European elections.

Germany’s government said it summoned Russia’s envoy to protest against what it said was a campaign launched two years ago by a group linked to Moscow’s GRU military intelligence agency.

The attacks targeted Germany’s governing Social Democrats (SPD) as well as companies in the logistics, defence, aerospace and information technology sectors, the Interior Ministry said in a statement.

Servers of companies in critical sectors had been compromised, a ministry spokesman added, without naming the companies or going into further details on the damage.

German Interior Minister Nancy Faeser said: “These attacks are not just aimed at individual parties or specific politicians, but at shaking confidence in our democracy.”

A spokesperson for Germany’s Foreign Ministry said Germany and its partners will not tolerate the attacks and “will use the entire spectrum of measures to prevent, deter and respond to Russia’s aggressive behaviour in cyberspace”.

Fancy Bear and Goose Egg

The Czech Republic said a number of its entities that it did not name had been hit by the Russian campaign since 2023.

“In the context of the upcoming European elections, national elections in a number of European countries and the ongoing Russian aggression against Ukraine, these acts are particularly serious and reprehensible,” the Czech Foreign Ministry said.

In a separate statement, Britain accused Russia of undermining democratic processes, without going into further detail.

Germany’s SPD had previously said the e-mail accounts of senior members had been targeted, but that it was not clear whether data had been stolen.

The Interior Ministry in Berlin said a group called “Fancy Bear” or APT28, which reports to the GRU, exploited a then-unknown vulnerability in Microsoft Outlook over a longer period of time in order to compromise e-mail accounts.

An international operation led by the US Federal Bureau of Investigation (FBI) in January had prevented devices compromised in the attacks from being misused for cyber-espionage operations worldwide, Berlin said.

A German spokesperson for Microsoft referred Reuters to a blog post stating that a Russian-based actor had been using a tool referred to as Goose Egg since as early as April 2019 to steal credentials.

APT28 has been active worldwide since at least 2004, primarily in the field of cyber espionage, hacking experts say.

According to Germany’s domestic intelligence agency, it is one of the most active and dangerous cyber actors worldwide.

US intelligence agencies have in the past warned about the potent cyber capabilities of actors controlled by GRU.

They have blamed Fancy Bear for hacking the e-mail accounts of presidential candidate Hillary Clinton’s staff before the 2016 election.

In 2016, the World Anti-Doping Agency accused Russian hackers of stealing confidential medical information about US Olympic athletes and publishing it online.

The FBI later seized the domain of the site – www.fancybear.net – where the information was released. REUTERS