**Germany Accuses Russia of Cyberattack on Air Traffic Control and Election Interference**
Germany has formally attributed a cyberattack on its air traffic control systems and a disinformation campaign targeting its 2024 federal election to Russia’s military intelligence agency, the GRU. In a press briefing on Friday, a German Foreign Ministry spokesman stated that intelligence services had "clearly identified" the involvement of the hacker group APT28 (Fancy Bear), a collective linked to the GRU, in an August 2024 attack on German Air Safety.
The spokesman also confirmed that Russia orchestrated the Storm 1516 campaign, a coordinated effort to influence the February parliamentary election—won by Chancellor Friedrich Merz’s conservatives, with the far-right AfD securing its highest-ever result. The campaign disseminated deepfake content and fabricated claims about prominent politicians, including Merz, former Foreign Minister Annalena Baerbock, and former Vice Chancellor Robert Habeck, aiming to erode public trust in democratic institutions.
German intelligence identified pro-Russian influencers, conspiracy theorists, and far-right extremists as key amplifiers of the disinformation. Fact-checking efforts by AFP’s German service debunked false narratives, including claims that AfD ballots were excluded in Leipzig and votes for the party were destroyed in Hamburg.
Russia’s embassy in Berlin dismissed the accusations as "baseless and absurd," while German officials emphasized they possessed "absolutely solid proof" of Moscow’s involvement. The head of Germany’s domestic intelligence agency, BfV, warned that such operations represent a direct attack on the country’s democratic order.
In response, Germany announced plans to impose EU-wide sanctions on hybrid actors and enhance Schengen Area travel monitoring for Russian diplomats starting in January to mitigate intelligence risks. The move aligns with broader European concerns over Russian espionage, sabotage, and cyber threats, particularly as Germany remains a leading supporter of Ukraine amid the ongoing war.
DFS Aviation Services GmbH cybersecurity rating report: https://www.rankiteo.com/company/dfs-aviation-services
"id": "DFS1765591851",
"linkid": "dfs-aviation-services",
"type": "Cyber Attack",
"date": "12/2025",
"severity": "100",
"impact": "6",
"explanation": "Attack threatening the economy of geographical region"{'affected_entities': [{'industry': 'Aviation/Transportation',
'location': 'Germany',
'name': 'German Air Traffic Control',
'type': 'Government Agency'},
{'industry': 'Politics',
'location': 'Germany',
'name': 'German Federal Election',
'type': 'Government'}],
'date_detected': '2024-08',
'description': 'Germany accused Russia of a cyberattack targeting its air '
'traffic control and spreading disinformation ahead of the '
'February 2024 general election. The attack was attributed to '
"the hacker group APT28 (Fancy Bear), linked to Russia's "
'military intelligence service GRU. The disinformation '
'campaign, Storm 1516, aimed to divide society and undermine '
'trust in democratic institutions.',
'impact': {'brand_reputation_impact': 'Undermined trust in democratic '
'institutions',
'systems_affected': 'German Air Traffic Control'},
'investigation_status': 'Attributed to APT28/GRU',
'motivation': ['Influence election',
'Destabilize democratic institutions',
'Divide society'],
'post_incident_analysis': {'corrective_actions': ['EU sanctions against '
'hybrid actors',
'Enhanced monitoring of '
"Russian diplomats' travel"],
'root_causes': 'Russian state-sponsored cyber '
'operations'},
'references': [{'source': 'AFP'}, {'source': 'German Foreign Ministry'}],
'regulatory_compliance': {'legal_actions': 'Potential EU sanctions against '
'hybrid actors'},
'response': {'communication_strategy': 'Public disclosure by German Foreign '
'Ministry'},
'stakeholder_advisories': 'German government warning of hybrid threats and '
'disinformation',
'threat_actor': 'APT28 (Fancy Bear), GRU (Russian military intelligence)',
'title': 'Cyberattack on German Air Traffic Control and Disinformation '
'Campaign Ahead of 2024 Election',
'type': ['Cyberattack', 'Disinformation Campaign']}