- Thomson Reuters
- A cyberattack on Germany’s defense and interior ministry’s private network is “ongoing,” officials confirmed.
- A security breach that was “a very serious attack” was confirmed on Wednesday, but it was said to have been “brought under control.”
- Local media reported Russian cyber espionage group Fancy Bear for the attack, but German officials have not confirmed the reports.
A “serious” cyberattack on Germany’s defense and interior ministry’s private network is still ongoing, despite officials saying on Wednesday they were in control of an attack.
“It is an ongoing affair, an ongoing attack,” Armin Schuster, who chairs the parliamentary committee overseeing intelligence services, said according to the BBC.
“It is a very serious cyber-attack,” Schuster said.
The news comes a day after German officials confirmed they were investigating the breach, which was speculated to have occurred in December, but had said it was an “isolated” attack that had been “brought under control.”
Local media contributed the hack to suspected Russian cyber espionage group Fancy Bear, also known as APT28. However, German officials have not confirmed the reports.
The German Press Agency (DPA) reported, citing unnamed security sources, Russian hackers breached the government network with a piece of malware likely placed in a central government network potentially remaining for up to a year.
According to public broadcaster Deutsche Welle, hackers reportedly targeted the government’s “Informationsverbund Berlin-Bonn” (IVBB) network, a communication platform that facilitates fast and secure data exchanges within German government offices.
Domestic intelligence previously blamed Fancy Bear for a 2015 attack on its parliament systems, which were reportedly carried out to gather intelligence.
In September 2016, Germany’s Federal Office for Information Security, which manages the government’s cyber security, warned Germany to guard against cyber hackers, mentioning APT28 by name.
Fancy Bear is widely believed to be a proxy for the Russian government. According to a website affiliated with the group, Fancy Bear has been operating since at least 2008, and targets aerospace, defense, energy, government, and media, using a “sophisticated and cross-platform implant.”