Die Senatorin für Gesundheit, Frauen und Verbraucherschutz

Summary

In the months surrounding a cyberattack on a German police website, the Bremen Senate disclosed that the same pro-Russian threat actor claimed responsibility for a wave of incidents targeting municipal authorities. The most disruptive was a Distributed Denial-of-Service attack that overwhelmed a police contact form with up to 18,000 requests per minute, rendering administrative websites largely inaccessible for about ninety minutes and requiring Dataport to disable the form and local search function to contain the incident. The Federal Office for Information Security issued a warning during the attack, and the Federal Criminal Police Office has since taken over central investigations into the group, which has a history of striking government, media, and private targets in support of Russian-aligned objectives. Separate but unrelated incidents in the same period included a phishing attack on the school administration that compromised two mail accounts for spam distribution, and a December botnet spamming event that exploited contact forms across affected sites. No data theft or compromise occurred during the main attack.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On 12 February, a Distributed Denial-of-Service (DDoS) attack was successfully carried out against the website of the Bremen Police, marking the first successful cyberattack on a Bremen public authority website in a four-month period. The attack was directed at the contact form hosted on the police website, which was bombarded with up to 18,000 requests per minute, overwhelming the server and causing it to fail. As a result, websites across the entire Bremen administration were either partially inaccessible or experienced significant performance issues from approximately 7:00 a.m. until about 8:30 a.m. Although the attack itself continued into the evening, the Senate reported that it was successfully repelled after roughly two hours. The IT service provider Dataport, responsible for the information technology infrastructure of the Bremen authorities, identified the contact form and the local search function on the police website as the entry points used by the attackers and subsequently disabled both features. During the attack, the Senate confirmed that there was no data theft, no data loss, and no compromise of information.

The Bremen authorities had been targeted by similar DDoS attempts in the preceding months, though these earlier efforts did not succeed. In January, two unsuccessful DDoS attacks were launched: one against the website of the Senator for Health (Gesundheitssenatorin) and another against the economic development agency (Wirtschaftsförderung). These attacks, like the February incident, involved flooding the targeted websites with a high volume of simultaneous requests designed to overload the servers, but in these cases the servers were able to handle the load without disruption. The Bremen Senate, in its response to a parliamentary minor inquiry (Kleine Anfrage) filed by the CDU parliamentary group regarding the February incident, disclosed the existence of these earlier attempts. The Senate emphasized that Germany as a whole is a major target for various forms of cyberattacks and stated that it does not see a specific connection between the individual incidents targeting Bremen, nor does it believe the attacks were directed at the Bremen administration for any particular reason. According to the Senate, cyberattacks serve dual purposes: causing actual damage and attempting to create uncertainty among the population.

At approximately 9:00 a.m. on 12 February, while the attack on the police website was still ongoing, the Bremen authorities received a warning from the Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik, BSI) regarding the specific attack in progress. The same day, the pro-Russian hacker group "NoName057(16)" claimed responsibility for the cyberattack. This group has been active since the onset of the conflict in Ukraine and has been responsible for various cyberattacks against targets in Ukraine, the United States, and several other European countries. Their attacks typically focus on websites belonging to government agencies, media outlets, and private enterprises. The group regularly publishes lists of current and intended attack targets on the messaging service Telegram, which is understood to be the source from which the BSI obtained its prior knowledge of the planned attack. The group states its objectives as impairing supporters of Ukraine and simultaneously spreading Russian propaganda. Central investigations into the hacker group are now being conducted by the Federal Criminal Police Office (Bundeskriminalamt, BKA).

In response to the successful February attack, a software update was scheduled to be deployed in late February to prevent future attacks of this method from succeeding. The update introduced an automatic throttling mechanism for incoming requests targeting internal search functions or contact forms, capable of scaling from reduced request handling to complete deactivation of the affected function when attack patterns are detected. The Bremen Senate reported that no data was stolen, lost, or compromised during the February 12 incident.

Beyond the DDoS attacks, the Bremen administration experienced other cybersecurity incidents in the same period. In late February, a successful phishing attack targeted employees of the school administration (Schulverwaltung). The attackers managed to compromise two accounts within the mail system, which were then used to send spam emails using the sender address @schulverwaltung.bremen.de. Additionally, a separate incident that had already been made public occurred in mid-December, classified as botnet spamming. In that case, large volumes of spam were sent by manipulating the contact forms on the affected websites. The Senate explicitly stated that it sees no connection between these various incidents—the successful and unsuccessful DDoS attacks, the phishing attack on the school administration, and the botnet spamming incident—treating them as separate and unrelated events.

Sources

Sources available to members: 1 source.