On Friday, Germany accused Russia of a cyberattack targeting its air traffic control and spreading disinformation ahead of February’s general election, charges dismissed by Russia as absurd and baseless.

A German Foreign Ministry spokesman said security services had proof that hacker groups run by Russia’s military intelligence service GRU were responsible for the attack and influence operations.

Attribution to APT28

Based on comprehensive analysis by German intelligence services, officials said they were able to clearly identify the handwriting behind the operations and prove Moscow’s responsibility.

The spokesman told a regular press briefing that Germany can now clearly attribute the cyberattack against German Air Safety in August 2024 to the hacker collective APT28, also known as Fancy Bear. Intelligence findings prove that the Russian military intelligence service GRU bears responsibility for this attack.

Germany’s air navigation service provider confirmed that its office communication had been hacked in August 2024. The provider said flights had not been affected.

Fancy Bear is said to have previously leaked World Anti-Doping Agency data and played a key role in the 2016 cyberattack on the US Democratic National Committee, according to security experts.

Election Interference Campaign

The spokesman also said Russia had sought to influence February’s parliamentary election, which was won by the conservatives of Chancellor Friedrich Merz, with the far-right AfD scoring its best-ever result in second place.

Germany can now state definitively that Russia, through the Storm 1516 campaign, sought to influence and destabilize the most recent federal election, the spokesman added at a press conference.

The GRU-supported Moscow think tank and other groups spread artificially generated or deepfake images and other content. The goal was to divide society and undermine trust in democratic institutions.

According to security sources, much of the material spread by the Storm 1516 campaign involved spurious claims about Merz and other prominent politicians such as former Foreign Minister Annalena Baerbock and former Vice Chancellor Robert Habeck, both prominent Greens party members.

The German government said security agencies had identified fake videos alleging ballot manipulation as part of a Russian disinformation effort just days before the election.

AFP’s German Fact Check service debunked two of the other claims in the campaign aimed at subverting trust in elections, namely that the AfD had been left off ballots in the city of Leipzig and that votes for the party in Hamburg were destroyed before they could be counted.

Sinan Selen, head of the BfV domestic intelligence agency, said in a statement that the Storm 1516 campaign shows in a very concrete way how Germany’s democratic order is being attacked. This disinformation ecosystem includes pro-Russian influencers with a wide reach, conspiracy theories, and right-wing extremist circles.

Russian Denial

The Russian Embassy in Berlin said in a statement sent to AFP that it categorically rejected that Russia was behind any of the activity.

The accusations of Russian state structures’ involvement in these incidents and in the activities of hacker groups in general are baseless, unfounded, and absurd, the statement said.

German Response

The Foreign Ministry spokesman said Germany had absolutely solid proof that Russia was behind the operations but added that he could not go into detail because this would involve discussing the work of German intelligence services.

The spokesman warned that Berlin would take a series of countermeasures to make Russia pay a price for its hybrid actions, in close coordination with European partners.

Germany would support new individual sanctions against hybrid actors on a European level, he said, without saying who they were.

From January, EU countries would monitor cross-border travel by Russian diplomats within the Schengen Area. The aim is to facilitate better information exchange and minimize intelligence risks.

Broader European Context

Governments across Europe are on high alert over alleged Russian espionage, drone surveillance, and sabotage activities, as well as cyberattacks and disinformation campaigns.

In the last year, both the UK and Romania have accused Russia of meddling in their domestic affairs, including targeting organizations that deliver foreign assistance to Ukraine and presidential elections.

Germany has been Ukraine’s second-biggest supplier of aid since Russia launched its 2022 full-scale invasion and has accused Moscow of being behind drone flights near several European airports in recent months.

The latest accusations come amid heightened concern in Europe over suspected Russian cyberattacks since Moscow launched its full-scale invasion of Ukraine in 2022.

Deteriorating Relations

Russia’s full-scale invasion of Ukraine has led to a major deterioration in relations between Berlin and Moscow.

Germany has emerged as one of Ukraine’s most vocal supporters, providing military, financial, and diplomatic support for Kyiv. Chancellor Friedrich Merz has called strongly for frozen Russian assets to be used to help protect Ukraine. He has also repeatedly accused Russia of cyber warfare against his country.

However, relations have been strained for years, even before the Russian invasion. In 2019, an ethnic Chechen was killed by a Russian national, Vadim Krasikov, in broad daylight in Berlin’s Tiergarten Park. Germany later expelled two Russian diplomats, as prosecutors suspected that he was acting on the orders of Russia’s state security agency.

While Russia is yet to respond to the latest allegations, Moscow has previously denied European allegations of a Russian sabotage or hybrid campaign.