Germany summons Russian ambassador over GRU-linked cyberattacks — air traffic control and elections systems targeted

Germany has formally summoned Russia’s ambassador in Berlin after publicly attributing a series of cyber and influence operations to Moscow’s GRU military intelligence agency. The action escalates a dispute over what Berlin describes as a sustained campaign of hybrid attacks against the country, warning that there will be “consequences”.

At a government press conference on Friday, December 12, Foreign Ministry spokesman Martin Giese said Germany had observed a “massive increase” in hostile hybrid activity linked to Russia, ranging from cyberattacks and espionage to disinformation and attempted sabotage. He explained that German authorities now have clear evidence connecting the GRU to two specific incidents: a 2024 cyberattack on Germany’s air traffic control systems and interference in February’s federal election through an operation known as “Storm-1516”.

The air traffic control incident targeted Deutsche Flugsicherung, the state-owned company responsible for managing civilian air traffic in Germany. The attack was attributed to APT28, also known as Fancy Bear, a hacker group long linked by Western governments to the GRU.

While flight operations were not disrupted, German officials confirmed that internal IT systems and office communications were affected, prompting an incident response led by the Federal Office for Information Security. German officials are now explicitly tying that incident to Russia’s military intelligence apparatus. According to the foreign ministry, attribution confidence has reached a level sufficient to justify diplomatic action and coordinated countermeasures with European partners.

The second case involves Storm-1516, a covert influence campaign that German authorities say sought to interfere in the run-up to February’s election. Officials described the operation as relying on disinformation and acts of sabotage. Investigations in Germany and elsewhere in Europe have linked Storm-1516 to the use of deepfake audio and video, as well as to networks of seemingly legitimate websites seeded with neutral content that are later activated to push political narratives.

In naming both operations and linking them to the GRU, Berlin is placing responsibility directly on the Russian state. Giese said Germany, together with its European partners, would impose a series of countermeasures intended to “make Russia pay a price” for its actions. These measures include targeted sanctions against individuals, travel bans, and asset freezes.

Follow Tom's Hardware on Google News, or add us as a preferred source, to get our latest news, analysis, & reviews in your feeds.