Loading story…
Germany and Israel have formalized a new cyber and security partnership aimed at strengthening both nations' defenses against escalating threats, particularly in the wake of a recent attack on Berlin's power grid that exposed vulnerabilities in German infrastructure. German Interior Minister Alexander Dobrindt and Israeli Prime Minister Benjamin Netanyahu signed the agreement in Jerusalem, which includes closer integration of security agencies, enhanced collaboration on cybercrime, artificial intelligence, and drone defense, and the leveraging of Israeli expertise and technology. The pact also addresses broader security concerns, such as counter-terrorism efforts against threats from Iran and its allies.
As part of the agreement, Germany will assume a leadership role in the U.S.-led Office of the Coordinator of Security for Israel and the Palestinian Authority, with Olaf Lindner, former head of German police special forces, taking a key position. The partnership underscores Germany's commitment to supporting Israel's security and reflects a strategic response to the increasing sophistication of cyberattacks and the evolving landscape of state-sponsored and non-state actor threats targeting critical infrastructure and national security interests.
See the actors and campaigns active against you right now.
4 events from the most recent confirmed update back to the earliest known activity.
Following the agreement, Germany said it wants to learn from and potentially replicate Israel's semi-automated 'cyber dome' for real-time cyber defense. The cooperation also includes plans to exchange expertise, jointly develop cyber defense tools, and establish a joint AI and cyber innovation center focused on areas such as energy and vehicle security.
German Interior Minister Alexander Dobrindt met Israeli Prime Minister Benjamin Netanyahu in Jerusalem to sign a cyber and security agreement. The pact expands cooperation on cybercrime, artificial intelligence, drone defense, counterterrorism, and closer coordination between the two countries' security agencies.
A recent arson attack on the power grid in southwest Berlin highlighted vulnerabilities in Germany's critical infrastructure protection and broader security posture. The incident became a cited driver for expanding security cooperation with Israel.
German authorities attributed an August 2024 cyberattack on the country's air traffic control authority to the Russia-linked APT28, also known as Fancy Bear. The attribution was cited as part of Germany's growing concern over state-backed cyber and espionage threats.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
3 references tracked. Mallory keeps watching after this page renders.
therecord.media
Open sourcecsoonline.com
Open sourcescworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Germany’s federal government signaled a shift toward a more **offensive posture** in response to cyberattacks. Interior Minister **Alexander Dobrindt** said Germany intends to “strike back,” including actions abroad to disrupt attackers and destroy their infrastructure, with operations to be carried out jointly by intelligence services and the **Bundeskriminalamt (BKA)**. The Interior Ministry also plans a new defense center for **hybrid threats**, prepared by the domestic intelligence service, to improve coordination across government levels; Dobrindt framed the move as a response to persistent attacks on institutions, critical infrastructure, and companies, often attributed to groups linked to state services (including Russia). Separately, the **Staatliche Kunstsammlungen Dresden** (a network of 15 museums) reported continued operational impacts from a **cyberattack**, with museums remaining open but key services still impaired, including `online ticketing`, card payments on-site, the online shop, and visitor services. Police and the state criminal office initiated investigations, and the Dresden public prosecutor indicated the case may be handled by Saxony’s specialized cybercrime unit (ZCS). The UK government’s discussion of building a **digital ID** system in-house is policy/technology governance reporting and does not describe a specific cyber incident or vulnerability tied to the German developments.
Jul 12, 2026
Germany’s cabinet approved a draft intelligence reform bill that would significantly expand the powers of the foreign intelligence service **BND** and the domestic intelligence agency **BfV**, giving them authority to move beyond passive collection into active cyber operations. The proposal would allow longer retention and analysis of communications data, online searches of devices, covert home entry by the BfV, and limited manipulation of data on compromised systems in imminent-danger cases. It would also authorize action against clearly identified attacker-controlled IT systems such as command-and-control infrastructure, while shifting approval for the most intrusive measures to the **Unabhängiger Kontrollrat**. The overhaul would additionally permit hacking foreign systems, disrupting hostile supply chains, disabling infrastructure, and conducting deception operations, while requiring telecommunications carriers and digital service providers to assist intelligence activities. The government says the changes are needed to counter hybrid threats, terrorism, hostile state activity, and other modern IT-based dangers; critics argue the bill marks a major expansion of surveillance and offensive state powers that could face constitutional challenges. A provision that would have required the **BSI** to share security vulnerabilities with intelligence agencies was removed before the draft was submitted.
Aug 16, 2026
A Bitkom survey of 1,003 German companies found that nearly 40% of organizations affected by data theft, industrial espionage, or sabotage attributed at least one incident to a foreign intelligence service, up from 28% a year earlier and 7% in 2023. China was the most frequently cited source, followed by Russia; roughly one in 10 affected firms linked incidents to Iran. Ransomware remained the most commonly reported attack type, while estimated annual losses from cyberattacks remained in the hundreds of billions of euros. Federal Office for the Protection of the Constitution President Sinan Selen warned that AI is worsening the threat environment, citing a China-linked operation assessed as entirely AI-generated. He urged stronger patching, resilience, and preventive cooperation, and said expanded intelligence powers would not create a systemic risk of zero-day vulnerabilities being withheld from Germany’s Federal Office for Information Security. Survey respondents also reported an increase in ransomware payments.
Aug 27, 2026