The state-owned agency responsible for air traffic control in Germany, Deutsche Flugsicherung (DFS), has confirmed that it was the target of a cyberattack that has disrupted its office communications. The attack, discovered last week, affected the company’s administrative IT infrastructure but did not impact air traffic control operations.
The cyberattack is suspected of being orchestrated by APT28, also known as Fancy Bear, a notorious hacker group closely linked to the Russian military intelligence service GRU. APT28 has been a persistent threat in the cyber realm, targeting government agencies, political organizations, and media outlets across Europe and North America since 2004.
A DFS spokesperson confirmed the attack and stated that the organization is implementing defensive measures. The nature of the attack remains unclear, and it is not yet known whether any sensitive data was accessed or compromised.
The Federal Office for the Protection of the Constitution (BfV) has been notified, and the incident is under investigation. The BfV, which has monitored APT28’s activities for years, emphasizes the group’s ties to the GRU, suggesting that the attack may have geopolitical motivations beyond mere criminal intent. Authorities have been tight-lipped about the ongoing investigation, with the Federal Ministry of Transport overseeing DFS, referring inquiries back to the agency itself.
The involvement of APT28, if confirmed, would underscore the geopolitical dimensions of the attack. APT28 has been implicated in numerous cyberattacks with politically motivated goals, and its links to the Russian GRU suggest that such incidents may be part of broader efforts to influence international affairs and promote political instability.
