German Aerospace Centre

Summary

The German Aerospace Centre experienced a coordinated cyber attack involving state-sponsored hackers, deploying Trojans designed to self-destruct upon detection and malware that remained dormant for extended periods before activation. The organization reported the incident to national cyber defense authorities, with recovered malicious code containing Chinese characters and recurring typos suggesting potential involvement from China, though deliberate obfuscation left attribution inconclusive and did not exclude other state actors. The attack targeted systems handling sensitive research in space, aeronautics, and defense-related technologies, raising significant security concerns due to the centre's role in critical aerospace and armament developments.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In April 2014, the German Aerospace Centre (DLR) in Cologne detected a coordinated cyber intrusion targeting its research and administrative systems. On the Sunday preceding the incident’s public disclosure, DLR personnel identified malware on computers used by researchers and system administrators, prompting immediate contact with Germany’s National Cyber Defence Centre in Bonn for assistance. Forensic analysis revealed the attack was systematic, employing multiple Trojan variants with distinct operational profiles. Some malware components were programmed to self-destruct upon detection to hinder forensic recovery, while others remained dormant for extended periods—in some cases, several months—before activating. The intrusion methods suggested advanced planning, though the exact initial attack vector was not publicly specified. DLR’s operational response included isolating compromised systems and initiating malware analysis, though specific technical containment measures were not detailed in available reports.

Attribution efforts proved inconclusive despite technical evidence recovered during the investigation. Analysts discovered Chinese characters embedded within segments of the malicious code, alongside recurring linguistic patterns interpreted as potential typos characteristic of Mandarin speakers. However, DLR sources cautioned that these indicators could have been deliberate false flags designed to misdirect investigators, noting the NSA could not be definitively excluded as a potential actor. The incident heightened concerns within the German government due to DLR’s involvement in dual-use research domains, including armament development, rocket propulsion systems, and aeronautics technologies. Historical context complicated attribution assessments—DLR had maintained collaborative space research ties with China since at least 2008, including the SIMBOX experiment flown aboard China’s Shenzhou 8 mission in 2011. No data exfiltration scope, specific compromised projects, or long-term operational disruptions were disclosed in public reporting following the containment effort.

Sources

Sources available to members: 1 source.