Shadows at the Gates: Understanding Germany’s Threat Landscape

Germany’s cybersecurity landscape constantly evolves, with various Advanced Persistent Threat (APT) groups consistently testing the country’s defenses. This blog utilizes data from the Federal Office for Information Security (BSI), Malware Information Sharing Platform Galaxy (MISP Galaxy), and MITRE Adversarial Tactics, Techniques, and Common Knowledge (MITRE ATT&CK) to address a key question: Which APT groups are targeting Germany, what are their motivations, and what methods do they use?

Predominant Threat Actors Targeting Germany

The available data indicates that a majority of the APT groups targeting Germany have been attributed to China and Russia. These groups primarily pursue strategic objectives, like espionage or sabotage, making it crucial for organizations to understand their risk profiles. This blog looks at 44 such groups that have been reported as being active in Germany.

TAs Active In Germany

22 out of the 44 threat actors were assessed as engaging in espionage or sabotage activities, while the motive was unassigned for the remaining 22.

Motive Distribution

Targeted Sectors and Industries

The sectors most frequently targeted by these threat actors include:

Government (General)
Private Sector (General)
Civil Society
Military
Education
Telecommunications
Medical

Collectively, these seven sectors account for 70% of the activity.

Sector Distribution

Distribution of ATT&CK Tactics

The following plot shows the distribution of ATT&CK tactics used by the threat actors, with Defense Evasion being the most widely used.

ATT&CK Tactics Distribution

Given this tactic distribution, the five most popular techniques employed by the threat actors are: Spearphishing Links, Obfuscated Information, Malicious Links, Ingress Tool Transfer, and Domains. Looking specifically at Initial Access, the most prevalent techniques are Spearphishing Links, Exploit Public-Facing Application, Compromise Software Supply Chain, Drive-by Compromise, Spearphishing Attachment, and Spearphishing via Service.

Tools Utilized by Threat Actors

Threat actors utilize a variety of tools to support their operations. In addition to Cobalt Strike, the most popular tools include Mimikatz, .NET, PsExec, Tasklist, and Empire.

Tool Distribution

Conclusion

Sophisticated threat actors employing diverse tactics, techniques, and tools continually challenge Germany’s cybersecurity landscape. By leveraging insights from BSI, MISP Galaxy, and MITRE ATT&CK, we aim to empower organizations to better understand these threats, optimize their resources, and strengthen their defensive posture.