The Federal Office for the Protection of the Constitution (BfV) said the alert was issued in coordination with Germany’s foreign intelligence agency, the BND, and the U.S. Federal Bureau of Investigation.

The group, also known as “Fancy Bear,” has been attributed by Western governments to Russia’s military intelligence service, the GRU.According to the BfV, APT28 exploited weaknesses in TP-Link routers, affecting several thousand devices worldwide, including about 30 in Germany.

In some cases, authorities confirmed breaches, leading operators to replace compromised hardware.The agency said the campaign was aimed at facilitating surveillance of sensitive targets, including state institutions and key infrastructure networks.

APT28 has previously been linked to cyberattacks against Germany’s parliament, the Social Democratic Party and air traffic control systems, underscoring its long-standing role in espionage operations targeting European institutions.

German authorities urged heightened vigilance and coordination among operators to mitigate risks posed by the ongoing campaign.