Hackers, Spies and Contract Killers: How Putin’s Agents Are Infiltrating Germany
In the game, Berserk Bear has a “pain factor” of 8.5 out of 10. Another Russian group, known as Fancy Bear, which is linked to the Russian military intelligence agency GRU, has a “danger index” rating of 9.5 out of 10. In 2015, the group attacked German parliament, the Bundestag, and siphoned off data from several parliamentarians, including from the parliamentary office of Angela Merkel, who was chancellor at the time.
An additional card in the quartets game is reserved for Venomous Bear, which is more widely known under the alias Snake, due to the craftiness of its members, who are thought to be under FSB control. In 2018, they found their way into the highly secured network of Germany’s Foreign Ministry. In the BfV card game, the group has been assigned 9 out of 10 points in the “capabilities” category.
Moscow’s cyberwarriors rely on a variety of different techniques. There are the more sophisticated methods, such as stealing data, quietly analyzing it and perhaps never making it public. There is the more savage approach of publishing the stolen data on the internet for all to see, such as in the case of the emails stolen from Hillary Clinton’s Democrats in 2016. And then there is sheer destruction and sabotage, such as in 2015, when the Ukrainian power grid collapsed.
Other hackers focus their attentions on launching smear campaigns, disseminating fake news and spreading disinformation. The most important of these groups is called Ghostwriter, and German officials believe the GRU is behind it.
Ghostwriter has targeted German politicians. They rely on phishing emails to infiltrate and take control of email and social media accounts. DER SPIEGEL has learned that around a dozen lawmakers in federal and state parliaments in Germany, or members of their staffs, have fallen for the group’s rather unsophisticated tactics.
An example in Poland demonstrates how nasty the group’s campaigns can be. Hackers there were able to gain access to the Facebook account of Marcin Duszek, a parliamentarian from the national-conservative Law and Justice (PiS) party, and to post compromising photos of his alleged secretary. The hackers also took control of the Twitter account belonging to politician Joanna Borowiak and, in her name, insulted supporters of abortion rights as “drug addicted prostitutes and child murderers.” On the Twitter account of Marek Suski, a senior PiS parliamentarian, Ghostwriter published a photo of a local politician wearing red lingerie.
Since the Russian invasion of Ukraine, members of Ghostwriter have been posting lies about the war on Facebook using hijacked accounts. One video, for example, seems to show a group of Ukrainian soldiers coming out of a forest and waving white flags as they surrender to the Russians. Security experts from Meta, Facebook’s parent company, later said the video was fake.