Signal phishing — Berlin's attribution and the APT groups

We are tracking the investigation into the Signal phishing campaign against German politicians: how many were targeted, the BfV's official attribution, the technical forensics on the APT groups and Moscow's response.

Loosely tracking

0/6 fulfilled ⏳ 6 pending tracking since 26.4.2026 check by 19.10.2026

The article that started it

Predsedníčka Bundestagu a dve ministerky medzi obeťami. Berlín vyšetruje špionáž cez Signal

Najmenej 300 účtov politikov, novinárov a vojakov NATO. Generalbundesanwalt vyšetruje od februára pre špionáž, zdroje citované Spiegelom ukazujú na…

25.4.2026

What we are still watching

The scale of the targeting — how many of the 300+ are publicly confirmed, and which other ministries and MPs (Spiegel, Tagesspiegel, Politico)
Berlin's public attribution — whether the interior ministry or the BfV officially names Russia or "a state actor"
Political consequences — the Bundestag's decision on the desktop version of Signal (Lindholz, CSU)
Technical forensics — the APT group (COLDRIVER/Star Blizzard, UNC5792, UNC4221), Microsoft TI and Google TIG
Moscow's response — a denial through the foreign ministry or a diplomatic reaction (a PNG declaration by Berlin?)
Loringhoven and other affected ex-BND figures — further incidents against former intelligence officers

← All tracked stories

HotInfo Menu

📂 CATEGORIES

Signal phishing — Berlin's attribution and the APT groups

The article that started it

What we are still watching

🔥 TOP STORIES 48h