Threat Intelligence & APT SecurityWeek 1 month ago

Berlin Won’t Pay Extortion Group Claiming Data Theft

CN
CyberNew Threat Research Desk
• Original Reporting: SecurityWeek
CyberNew Threat Intel Assessment
Assessed Severity: INFORMATIONAL
Impacted Surface
Cloud & Distributed Infrastructure
Intelligence Sector
Threat Intelligence & APT

Analyst Takeaway

"Berlin, the capital city of Germany, on Friday said it would not pay the extortion group that hacked into its network and stole large amounts of data earlier this month. The incident was discovered on August 14 and impacted the Senate Department for Mobility, Transport, Climate Protection, and Environment. To contain the attack, the department’s network was shut down on August 14, the same as was..."

Recommended Defense & Mitigation

  • Threat Monitoring: Ingest published IOCs into SIEM/EDR detection rules for continuous telemetry monitoring.
  • Security Awareness: Alert staff and maintain baseline endpoint hardening across endpoints.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)
Berlin ransomware data breach

Berlin, the capital city of Germany, on Friday said it would not pay the extortion group that hacked into its network and stole large amounts of data earlier this month.

The incident was discovered on August 14 and impacted the Senate Department for Mobility, Transport, Climate Protection, and Environment.

To contain the attack, the department’s network was shut down on August 14, the same as was the Senate Department for Urban Development, Construction, and Housing’s network.

According to official statements from governing mayor Kai Wegner and the Senate Chancellery, the data exfiltration occurred between August 7 and 12, and likely involved personal and non-public information.

Berlin has not shared further information on the attack, citing the ongoing investigation carried out by the state criminal police, federal security agencies, and the public prosecutor’s office.

On Friday, Wegner and Senator for the Interior and Sport Iris Spranger confirmed that the hackers have demanded a ransom payment, but underlined that the city would not pay.

Advertisement. Scroll to continue reading.

While the city has not named the threat actor behind the attack, the Rhysida ransomware group has claimed responsibility for the incident, briefly adding Berlin to its Tor-based leak site on August 28.

Written By Ionut Arghire

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from SecurityWeek.

Primary Advisory →