Cyber Threat Actor: Frick

The threat actor is publicly known onlyby the alias Frick and is reported to be based in Germany. No further biographical, organizational, or historical details about Frick have been disclosed in open sources. The alias and location constitute the entirety of the confirmed personal or geopolitical information available about this actor. All publicly attributed activity linked to Frick stems from a single incident that occurred in mid‑2021.

On 3 June 2021 Frick was associated with a distributed denial‑of‑service attack targeting a German information technology provider that supplies services to cooperative banks. The attack generated sufficient traffic to disrupt online banking platforms for more than eight hundred financial institutions across the country. Victims experienced noticeable website slowdowns and intermittent outages as the malicious traffic intensified over the course of the event. According to the provider’s timeline, the offensive traffic began in the morning, grew stronger through the night, and began to ease the following day. The attack produced operational challenges for several banks, explicitly mentioned as including Berliner Volksbank, before showing signs of stabilization. Throughout the incident the targeted company emphasized that customer data remained secure and highlighted its existing preparedness for such events. Isolated disruptions persisted due to ongoing defensive countermeasures implemented by the provider. The provider’s crisis team maintained continuous system monitoring to detect any potential follow‑on activity and noted that cyber incidents of this type are not uncommon in its operational environment. No malware families, specific initial‑access vectors, or distinctive tooling have been referenced in any public report concerning Frick. Likewise, no clear attribution to a state sponsor, criminal consortium, or other affiliations has been established for this actor. Consequently, the public profile of Frick remains limited to the alias Frick, the German location, and the solitary DDoS operation described above.