The German government has attributed a recent cyberattack on its air traffic control and disinformation campaigns ahead of the federal election to Russia, specifically the Russian military intelligence service, the GRU. The Foreign Ministry highlighted a significant uptick in “hybrid activities” by Russia, aimed at sowing distrust and undermining democratic institutions. The cyberattack in August 2024 was linked to the hacker group “APT28” (Fancy Bear), with proof of Russia’s intent to influence the German elections.
The ongoing disinformation campaign, dubbed “Storm 1516,” is believed to be supported by the Moscow-based think tank “Center for Geopolitical Expertise.” Prior to the February 2025 snap election, fake videos alleging ballot manipulation were identified as part of this campaign. German security forces noted the dissemination of deepfake images and misleading information across various platforms.
The Russian ambassador was summoned to express Germany’s concerns and to inform him of ongoing monitoring and countermeasures against Russia’s actions. Germany plans to implement sanctions, including travel bans and asset freezes, and will monitor Russian diplomats in the Schengen Area from January 2026. A new platform for interagency coordination to mitigate future hybrid threats is also in development, acknowledging the continued risk posed by state-sponsored cyberattacks and misinformation campaigns.
