Germany and Czechia attribute APT28 campaign incl. SPD hack to GRU

On 3 May 2024, Germany and Czechia attributed to GRU-linked APT28 a cyber campaign that exploited an Outlook vulnerability. In Germany, the campaign hit the SPD party headquarters from late December 2022, along with defence, logistics, aerospace and IT firms. Czech state institutions were also targeted. The EU and NATO issued supporting statements.

Established by. German Federal Government / Federal Ministry of the Interior (3 May 2024); Czech Ministry of Foreign Affairs (3 May 2024); EU High Representative and NATO statements the same day.

Latest. Germany has since attributed further APT28 operations, including the August 2024 attack on air traffic control provider DFS (Dec 2025).

Link to the war against Ukraine. The German government links the timing of the campaign to its support for Ukraine (start of 2023).