Active APT groups in Germany
Active APT groups that attack targets in Germany
10.03.2025
Cyber attacks that are not financially motivated but pursue strategic goals are usually not isolated individual events. Instead, there are long-term, persistent threat actors who repeatedly attack specific targets. The threat actors thus shape the threat situation. Since these attacker groups pursue certain strategic goals, the threat situation becomes to a certain extent easier to explain than if it were purely opportunistic random events. Knowing the threat actors and their current targets allows IT security teams to better assess the risk profile of their own company or institution.
On this page, the BSI presents the threat actor groups that have been active against targets in Germany in the last two years, or that have attacked targets in other European countries that could also have been attacked in Germany in a similar manner. The following table lists the threat actors‘ name with aliases, the sectors in which the thret actor is active and, if relevant, special characteristics that can facilitate detection or incident handling.
Institutions that have already implemented basic IT security measures can use this list to prioritize their own threat intelligence research.
The sources for the list are diverse, for example detections in government networks, incidents from BSI incident handling, as well as reports from partners and victims. The list is not necessarily complete, for example if confidentiality agreements exist at the request of victims or sources. In addition, there should be a certain number of unreported cases, the more professional and secretive the threat actors are. Especially in the case of advanced attackers, detection can be made more difficult and attribution to a named threat actor can remain unclear, which means that the corresponding attacks do not appear in the list.
Since the strategic goals and missions of threat actors change over time, the list is not static, but will be updated depending on the BSI's assessment.
| Threat actor and alias | Sectors, according to German WZ 2008 | Characteristics |
|---|---|---|
| APT15 / Vixen Panda / Mirage / Ke3chang / Nylon Typhoon |
| The threat actor uses its own relay network of compromised routers and VPN servers. |
| APT28 / Fancy Bear / Sofacy / Forest Blizzard |
| APT28 uses a variety of attack vectors, e. g.
|
| APT29 / Cozy Bear / Nobelium / Midnight Blizzard |
| APT29 often uses legitimate cloud services as control servers, in order to blend into legitimate network traffic. |
| APT43 / Velvet Chollima / Kimsuky / Emerald Sleet |
| The threat actor engages in social engineering and initially sends several emails without malicious code until the recipient has built up trust. Only then will malicious code or a phishing link be delivered. |
| APT44 / Sandworm / Seashell Blizzard / Voodoo Bear | ||
| Bitter / Hazy Tiger |
| Attack vector usually are CHM- or RAR-attachments. |
| Contagious Interview / Beaver Tail / Invisible Ferret / Famous Chollima |
| The threat actors pretend to be job applicants or IT-freelancers to get access to the target environment. |
| Cosmic Wolf / Sea Turtle / Marbled Dust |
| The threat actor may compromise a supply-chain entity first, in order to gather information for follow-up attacks on the intended targets. |
| Dark Hotel |
| |
| Earth Estries |
| |
| Ghostwriter / UNC1151 / Storm-0257 |
| The threat actor targets private email-accounts at commercial webmail-providers via spearphishing. |
| Labyrinth Chollima / Lazarus / Diamond Sleet |
| The threat actor often uses emails with malicious documents about supposed job offers as an attack vector. |
| Mirage Tiger |
| |
| Muddy Water / Static Kitten / Mango Sandstorm |
| |
| Mustang Panda |
| |
| Outrider Tiger Fishing Elephant |
| |
| Red Dev 61 / UTA0178 / UNC5221 |
| The attacks are usually targeted against VPN- and other internet-facing systems. |
| Rezet / Rare Wolf / Librarian Ghouls |
| The attackers send password-protected RAR-archives that contain executables with double file-endings. |
| RomCom / Storm-0978 |
| |
| Salted Earth / Sturgeon Fisher / Yoro Trooper |
| |
| Salt Typhoon |
| The threat actors compromises unsecured or outdated perimeter systems. The strategic intent and target selection in Germany is unclear. |
| Sharp Panda |
| |
| Sidewinder / Razor Tiger |
| |
| Snake / Venomous Bear / Turla / Secret Blizzard |
| |
| Storm-0558 |
| The threat actor uses their own VPN-networks in order to obfuscate their attack traffic. |
| Viceroy Tiger / Donot |
| |
| Winter Vivern / TAG-70 |
| |
| UAC-0050 |
| The threat actor sends ZIP-archives as email attachments, containing the publicly available malware Remcos. |
Furthermore, BSI observes the following threat actors because of their activity in partner countries:
- APT30 / Naikon / Raspberry Typhoon
- APT31 / Judgment Panda / Violet Typhoon
- Gallium / Softcell / Phantom Panda / Alloy Taurus / Granite Typhoon
