Russian Aggression War against Ukraine

So far, in Germany, there have been a series of minor incidents and hacktivism campaigns related to Russia's aggression war against Ukraine. Examples of these include the disruption of remote maintenance in German wind turbines following an attack on a satellite communication company and a hacktivism attack on German mineral oil traders with a Russian parent company. However, there hasn't been a comprehensive campaign targeting German entities. On the other hand, the situation in the cyber domain of NATO partners has been somewhat tense, and in Ukraine, it has been partially critically life-threatening.

Number of Vulnerabilities Continues to Rise

In 2021, there was a ten percent increase in the number of vulnerabilities in software products compared to the previous year. More than half of these vulnerabilities had high or critical scores according to the Common Vulnerability Scoring System (CVSS). Thirteen percent of the vulnerabilities were classified as critical. Among them is the vulnerability in Log4j, as it was present in many freely available software components. IT security managers often found it difficult to assess whether the software they were using had the vulnerability. Due to the widespread use of Log4j, a large attack surface for cyber-attacks was expected.

DDoS Attacks and Advanced Persistent Threats (APTs) on the Rise

During the reporting period, there has been an increase in attacks targeting perimeter systems such as firewalls or routers. While targeted APT attacks using malware in emails typically require a high level of effort, perimeter systems are directly accessible from the internet, relatively poorly protected, and therefore more vulnerable to attack. APT groups are increasingly scanning the internet for known vulnerabilities in perimeter systems that do not yet have available patches, enabling them to launch targeted attacks.

The number of Distributed Denial of Service (DDoS) attacks has also been reported to be on the rise by various mitigation service providers. For example, the German provider Link11 recorded an approximately 41 percent increase in DDoS attacks in 2021 compared to the previous year. Particularly during the annual online shopping event Cyber Week and the holiday season, a noticeable increase in attacks was observed. The number of DDoS attacks during the Cyber Week 2021 doubled compared to the Cyber Week 2020.