Home / Blog / Credential-based Attacks / Inside Recent Cyberattacks on German Organizations

Inside Recent Cyberattacks on German Organizations

Cybercriminals don’t always need to exploit a software vulnerability to get into a network. Sometimes, a stolen password or compromised privileged Active Directory account is enough. Attackers can then use legitimate credentials to access systems, making suspicious activity harder to detect.

Recent cyberattacks affecting German organizations RENAFAN and Hegelmann, as well as parts of Berlin’s state administration, highlight the risk of identity-based threats. While the organizations haven’t publicly confirmed how attackers first gained access, the threat groups involved have a documented history of targeting credentials and identity controls.

By looking at how these groups typically operate, we can explore what other organizations can learn from these incidents. We’ll also examine the identity security measures that can help prevent similar attacks and limit the damage if an account is compromised.

Three Recent Cyberattacks Against German Organizations

Berlin Landesnetz

In August 2026, attackers breached Berlin’s state administrative network, affecting two Senate departments responsible for transport and urban development. Investigations found that data was stolen between 7 and 12 August, prompting officials to disconnect the affected departments from the state network on 14 August.

The Rhysida ransomware group claimed to have stolen 5.79 TB of data and demanded a ransom of around €2 million. Berlin refused to pay, and the attackers published the stolen data on 4 September. A second release on 6 September included access credentials; Berlin responded by further tightening security measures for certain departments.

The stolen information that may include personal data belonging to government employees, residents and businesses. A Mastodon post by The Federal Office for Information Security (BSI) linked the attack to a possible TerminalFix phishing campaign, which uses fake CAPTCHA prompts to trick users into running malicious commands. However, Berlin has not publicly confirmed the initial access method, and investigations into the breach continue.

RENAFAN

German care provider RENAFAN disclosed a cyberattack in February 2026, confirming that attackers had accessed parts of its IT environment and copied data. The Qilin ransomware group claimed responsibility for the incident.
RENAFAN isolated affected systems and brought in external security experts to investigate. While some administrative processes were disrupted, the company said care services continued across all locations.

The full extent of the stolen data remains unclear. RENAFAN said it had found no evidence of personal data being misused at the time of its announcement, but has not publicly confirmed how the attackers gained access.

Hegelmann

Logistics company Hegelmann Express reported a data breach in February 2026, confirming that attackers had gained unauthorized access to its systems and encrypted stored data. The Lynx ransomware group subsequently claimed responsibility.

The breach affected sensitive information belonging to current and former employees, contractors and business partners. Exposed records included names, addresses, identity document numbers, bank details and salary information, creating potential risks of identity theft and financial fraud.

Hegelmann notified law enforcement and data protection authorities following the incident. However, the company has not publicly confirmed how the attackers initially accessed its systems or whether any further data was compromised.

The Common Tactic of the Attackers: Identity Compromise

While the initial access methods in the three German cyberattacks remain unconfirmed, the groups associated with them have something important in common: a history of targeting credentials and abusing legitimate accounts. Understanding these tactics can help organizations identify gaps in their own defenses.

Credentials Remain an Effective Entry Point

Incident-response research into Lynx has linked the group’s initial access methods to phishing and brute-force attacks against VPN services. In one case, weak password policies and a lack of multi-factor authentication (MFA) allowed attackers to access the network using a compromised employee account.

Once attackers have working credentials, they can authenticate through legitimate services, making their activity harder to distinguish from normal user behavior.

Password spraying, brute-force attacks and credentials exposed in previous breaches all create opportunities for account compromise. Monitoring for unusual authentication activity and preventing the use of weak or compromised passwords can help close these gaps before attackers gain a foothold.

MFA Gaps Can Turn Stolen Credentials into Access

In one Qilin ransomware incident, attackers accessed a VPN using compromised credentials. The VPN wasn’t protected by MFA, allowing them to enter the network and later escalate to an Active Directory domain controller.

Rhysida has also been observed accessing VPNs with compromised credentials, particularly where MFA wasn’t enabled. Once inside, attackers used Remote Desktop Protocol (RDP) and legitimate Windows tools to move through victim environments.

But simply having MFA isn’t always enough. In a separate Qilin affiliate attack, threat actors used a phishing page to intercept an IT administrator’s credentials and one-time MFA code. This gave them access to a remote management platform and they subsequently targeted its customers.

Organizations need to consistently enforce MFA across remote access services and privileged accounts, while prioritizing phishing-resistant methods where possible. Organizations also need to review legacy systems and administrative access paths that may not have the same protections.

Active Directory is Still a Valuable Prize

Gaining initial access is often just the beginning. Attackers may then target privileged accounts and Active Directory to gain greater control over the network.

In the Qilin incident investigated by Sophos, attackers reached a domain controller and modified the default domain policy through Group Policy. They used this access to deploy scripts designed to steal credentials stored in Google Chrome browsers across connected endpoints.

Lynx affiliates also specifically target domain administrator accounts through brute-force attacks. In one investigation, attackers compromised a domain administrator account within six hours. Meanwhile, Rhysida actors have used native Windows commands to map domain environments and have exploited the Zerologon vulnerability (CVE-2020-1472) in previous attacks.

These techniques show why a successful login shouldn’t automatically mean an account or session can be trusted. Restricting privileged access, monitoring unusual authentication activity and changes to Group Policy, and checking device and session context can all help security teams spot suspicious behavior.

How Can Organizations Mitigate the Risks?

Strengthen Password Policies

Weak, reused and compromised passwords give attackers opportunities to access accounts without exploiting software vulnerabilities. Preventing these passwords from being used is an important first step.

Specops Password Policy with Breached Password Protection helps organizations enforce custom password policies in Active Directory and block more than 6 billion known compromised passwords. This reduces the risk of employees using exposed credentials and allows organizations to require resets when compromised passwords are identified.

Secure Every Access Path

The tactics associated with Qilin, Rhysida and Lynx show why organizations must support password security with additional authentication factors.

Specops Secure Access extends MFA to Windows logons, RDP and VPN connections, helping organizations protect remote access and privileged accounts. It supports single sign-on for SaaS applications through OIDC and SAML, making it easier to manage authentication across different systems.

Integration with SIEM, SOC and analytics platforms also gives security teams better visibility into authentication activity, helping them spot and investigate suspicious logins.

Verify the Device Alongside the User

Even valid credentials don’t guarantee that a device requesting access can be trusted. Checking the device alongside the user’s identity adds another layer of protection against account compromise. Specops Device Trust helps organizations verify the hardware requesting access and gives security teams greater visibility into every device connecting to the corporate network.

Harden Your Identity Security with Specops

The lessons from recent German cyberattacks are applicable to organizations everywhere. A single compromised account can give attackers a foothold in your network. Strong password policies, consistent MFA, device verification and better visibility into authentication activity all help reduce that risk.

A good place to start is by identifying your current Active Directory risk. Specops Password Auditor is a free tool that runs a read-only scan of your Active Directory to identify potential security gaps, including reused, compromised or blank passwords, as well as inactive or stale privileged accounts.

If you’re reviewing your current identity controls or looking to close gaps across Active Directory, remote access and user verification, book a demo with Specops to see how we can support the next stage of your identity security strategy.

Last updated on October 16, 2026