Cyber attack on German government targets more sensitive data than previous attack
A policeman guards the entrance of the German Foreign Affairs building in Berlin, Germany, Feb. 28, 2018. (EPA Photo)


The latest hack of German government networks involved complex malicious software and targeted more sensitive data than a 2015 breach of the German parliament, a leading member of Chancellor Angela Merkel's conservatives said Thursday.

Patrick Sensburg, a member of the parliamentary committee that oversees German intelligence agencies, told broadcaster ZDF it would take time to analyze the incident that the German government on Wednesday said had been "isolated" and contained.

He said it was premature to link the cyber attack -- as German media reports have done -- to a Russian hacking group known as APT28, although he said there was sufficient evidence that the group had links to a Russian spy agency.

"One has to carefully examine a software like this one that is extremely complex," Sensburg told the broadcaster.

Hackers were accessing German government servers until at least Wednesday this week, security sources told the German Press Agency on Thursday.

The attack was under the observation of German security officials, who were working to gather information on the hackers' goals and identity, sources said.

It emerged late Wednesday that Russia-linked hackers blamed for a string of high-profile cyberattacks had infiltrated the German government's secure computer network.

The hack appears to have originated from the APT28 cyberespionage group, also known as Fancy Bear, which many security experts believe has ties with the Russian government.

The government has stated that the situation has been brought under control.

German intelligence service monitoring agents are to meet shortly after noon on Thursday to discuss the Russia-linked attack, according to information received by DPA.

A statement is expected shortly afterwards from members of the Parliamentary Control Panel.

Parliament's Digital Agenda is also to discuss the case on Thursday.

"We have a sort of war going on in the Internet," Sensburg said, adding that it remained unclear whether any data was stolen as a result of the breach, and if so, what sort of data.

At the same time, he said this attack was clearly focused on more sensitive data than the 2015 hack of the Bundestag, the lower house of parliament, that resulted in the loss of 16 gigabytes of data, and which German officials have blamed on the APT28 hacking group, also known as Fancy Bear or Sofacy.

Bild newspaper said security officials were struck by the sophistication of the attack, which exceeded levels previously seen, and therefore assumed it was not carried out by the same group that carried out the 2015 hack.

Benjamin Read, head of cyber espionage analysis at FireEye, a U.S.-based cybersecurity firm, said the German incident could be part of a series of attacks carried out by APT28 against U.S. and European government-related entities in 2016 and 2017.

German intelligence officials have warned about possible meddling by Russia in last year's federal election.

Western governments and security experts have linked APT28 to a Russian spy agency, and have blamed it for an attack on the Democratic National Committee ahead of the 2016 U.S. elections.

Moscow has previously denied in any way having been involved in cyber attacks on the German political establishment.

Conservative lawmaker Roderich Kiesewetter told Die Welt newspaper the attack showed that government agencies needed more funding and personnel to be able to respond.

Top German intelligence officials have also urged lawmakers to give them greater legal authority to "hack back" in the event of cyber attacks from foreign powers.