The accusations come at a time of strained relations between Russia and the West following Russia’s 2022 invasion of Ukraine and the European Union’s support for Kyiv.
German Foreign Minister Annalena Baerbock said a newly concluded government investigation had concluded that a 2023 cyberattack targeting members of the Social Democratic Party had been carried out by a group known as APT28.
APT28 “is steered by the military intelligence service of Russia”, Baerbock told reporters during a visit to Australia.
“In other words, it was a state-sponsored Russian cyberattack on Germany and this is absolutely intolerable and unacceptable and will have consequences.”
Berlin later summoned the acting charge d’affaires of the Russian embassy over the incident.
APT28, also known as Fancy Bear, has been accused of dozens of cyberattacks in countries around the world.
Russia denies being behind such actions.
The hacking attack on German Chancellor Olaf Scholz’s SPD party was made public last year. It has been blamed on a previously unknown vulnerability in Microsoft Outlook.
German Interior Minister Nancy Faeser said the cyber campaign was orchestrated by Russia’s military intelligence service GRU and began in 2022.
It also targeted German companies in the armaments and aerospace sectors, she said.
Such cyberattacks are “a threat to our democracy, national security and our free societies”, she said at a joint news conference in Prague with her Czech counterpart Vit Rakusan.
“We are calling on Russia again to stop these activities,” Faeser added.
Czech government officials said some state institutions had also been the target of cyberattacks blamed on APT28, again by exploiting a weakness in Microsoft Outlook.
Czech Interior Minister Rakusan said his country’s infrastructure had recently experienced “higher dozens” of such attacks.
“The Czech Republic is a target. In the long term, it has been perceived by the Russian Federation as an enemy state,” he told reporters.
The German and Czech findings triggered strong condemnation from the European Union.
“The malicious cyber campaign shows Russia’s continuous pattern of irresponsible behaviour in cyberspace, by targeting democratic institutions, government entities and critical infrastructure providers across the European Union and beyond,” EU foreign affairs chief Josep Borrell said in a statement.
The EU would “make use of the full spectrum of measures to prevent, deter and respond to Russia’s malicious behaviour in cyberspace”, he added.
State institutions, agencies and entities in other member states including in Poland, Lithuania, Slovakia and Sweden had also been targeted by APT28 in the past, the statement added.
