The Federal Office for the Protection of the Constitution (BfV) said the alert was issued in coordination with Germany’s foreign intelligence agency, the BND, and the U.S. Federal Bureau of Investigation.

The group, also known as “Fancy Bear,” has been attributed by Western governments to Russia’s military intelligence service, the GRU.According to the BfV, APT28 exploited weaknesses in TP-Link routers, affecting several thousand devices worldwide, including about 30 in Germany.

In some cases, authorities confirmed breaches, leading operators to replace compromised hardware.The agency said the campaign was aimed at facilitating surveillance of sensitive targets, including state institutions and key infrastructure networks.

APT28 has previously been linked to cyberattacks against Germany’s parliament, the Social Democratic Party and air traffic control systems, underscoring its long-standing role in espionage operations targeting European institutions.

German authorities urged heightened vigilance and coordination among operators to mitigate risks posed by the ongoing campaign.

The March 20 report, issued by the FBI and other federal agencies, said Iran’s government posed an elevated risk to U.S. military and government personnel, Jewish and Israeli institutions, and Iranian dissidents within the United States.

It added that while no broad threat to the general public had been identified, the potential for targeted attacks remained significant.President Donald Trump had publicly minimized the risk of Iranian retaliation on U.S. soil in recent months.

When asked on March 11 whether he was concerned about a possible attack, Trump said he was not. His rhetoric shifted this week, however, as tensions escalated, including a warning that “a whole civilization will die tonight” before he agreed to delay military action and accept a two-week ceasefire.

The intelligence document, titled “Public Safety Awareness Report,” was released weeks after reports that the White House had blocked a similar product from being made public. At the time, officials said the move was to ensure information was properly vetted.

White House spokeswoman Abigail Jackson said the administration remained focused on protecting national security and cautioned against drawing conclusions from individual law enforcement documents without broader context.

The FBI and National Counterterrorism Center did not immediately respond to requests for comment, while a spokesperson for Iran’s mission to the United Nations declined to comment.

The report, obtained through public records requests by the nonprofit Property of the People, warned of “elevated physical threats” following the outbreak of conflict. It said Iranian security services had previously attempted kidnappings and killings targeting Americans, using methods ranging from firearms to more covert tactics such as poisoning, arson and suffocation.

According to the report, Iranian operatives often rely on individuals with legal status or access within the United States and have used digital tools including social media monitoring, livestreams and mapping applications to identify and surveil potential targets. It also cited the use of cyber tactics such as phishing campaigns.

The report further warned that Iran has attempted to lure individuals to third countries closer to its territory, “almost certainly for kidnapping and eventual executions.”U.S. public opinion has remained cautious about the conflict, with a Reuters/Ipsos poll last month showing that roughly two-thirds of Americans favor ending U.S. involvement quickly, underscoring the sensitivity surrounding threat assessments and policy responses.

Law enforcement agencies were urged to remain vigilant and coordinate closely with federal authorities on any emerging threats.

The request was made by the National Investigations Agency (NIA), India’s federal anti-terrorism agency, in meetings with visiting FBI Director Christopher Wray, said the official, who works at NIA and spoke on condition of anonymity.

The issue of what New Delhi says are Sikh separatists operating against India from U.S. soil was discussed in “greater detail by a team of internal security officials from both countries”, the official said.

“India has requested the U.S. officials to share inputs on suspected individuals who have in recent years been recruited and embedded in the separatist movement,” the official said.

An NIA spokesperson said the agency did not have a comment when reached by Reuters.

The U.S. embassy’s spokesperson said meetings between Wray and Indian officials were underway and he could not share details as yet.

The movement for a Sikh homeland in northern India, crushed decades ago, has burst onto the global stage in recent months as the United States and Canada accused Indian officials of involvement in assassination plots against Sikh separatist leaders in North America.

New Delhi denies any connection to a June murder in a Vancouver suburb but has announced an investigation into U.S. concerns about an alleged plot in New York.

It says such plots were not government policy and it is not hunting down Sikh separatists abroad. At the same time, Indian security and foreign ministry officials say Sikh separatists in North America and Europe raising money, training people and campaigning for India’s division, is a concern for New Delhi.

India has also sought to distance the FBI chief’s visit – the first in years – from the New York case, saying Wray’s trip had been planned for some time.

India’s government, which has denied any involvement in the plot, sought to distance the visit from the case, saying Wray’s trip had been planned for some time.

The U.S. ambassador to India, Eric Garcetti, did not go into any details as he announced the visit at a think tank event in New Delhi on Wednesday.

Federal prosecutors in Manhattan said last week an Indian national had worked with an unnamed Indian government employee on the plot to assassinate the New York City resident who advocated for a sovereign Sikh state in northern India.

At the time, India expressed concern about the accusations, calling it contrary to government’s policy, and said it would carry out its own investigation.

The target of the assassination plot has been identified as Gurpatwant Singh Pannun, who says he holds American and Canadian citizenships.

The visit by the FBI Director had “been in the works for some time,” India’s foreign ministry spokesperson Arindam Bagchi said on Thursday.

“This is part of an ongoing security cooperation,” he added.