Threat reportRansomwareTL-2026-2206
Rhysida Ransomware Claims Berlin State Government Breach Ahead of September Election
Rhysida Ransomware Claims Berlin State Government Breach (TL-2026-2206) is a high-severity ransomware operation, first published 2026-08-29. It is attributed to Rhysida with medium confidence, affects Land Berlin (Berlin State Government) Berlin State Network, references 1 CVE (CVE-2020-1472), maps to 12 MITRE ATT&CK techniques (T1003.003, T1021.001, T1021.002), and is covered by 9 detection rules and 16 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 12MITRE ATT&CK
- Actors
- 1Rhysida
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 16Indicators of compromise
Key facts for TL-2026-2206
- Threat ID
- TL-2026-2206
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- Rhysida
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- government administration
- Target regions
- Europe, germany
- Detection rules
- 9
- Indicators of compromise
- 16
Malware and tooling in Rhysida Ransomware Claims Berlin State Government Breach
Malware and tooling: AnyDesk, rhysida, AnyDesk, PSEXEC, PortStarter, secretsdump
How Rhysida Ransomware Claims Berlin State Government Breach works
The Rhysida ransomware-as-a-service group claims to have exfiltrated 5.79TB (~1.44 million files) from two Berlin Senate departments and posted the claim to its Tor leak site on August 28, 2026, demanding roughly 30 BTC (~€2 million). Berlin officials refused to pay; the affected departments were isolated and reconnected before the September 20, 2026 state election, which officials say was unaffected.
Between August 7 and 12, 2026, unauthorized data outflows occurred from Berlin's state government network ("Landesnetz"), a fiber backbone connecting roughly 600 government, police, fire, and hospital sites. The intrusion affected two Senate departments: the Senate Department for Urban Development, Building and Housing (where the initial security gap was located, per Berlin's IT service provider ITDZ) and the Senate Department for Mobility, Transport, Climate Protection and Environment. Forensic indicators reached the Senate Chancellery around August 25-26, 2026; both departments were preemptively disconnected from the state network on August 14, 2026 and remained largely offline (phone-only external communication) until reconnection around August 23, 2026. Berlin publicly disclosed the incident on August 17-18, 2026.
On August 28, 2026, the Rhysida ransomware group posted a "Berlin, Germany" entry to its darknet (Tor) leak site, claiming 5.79 terabytes across approximately 1.44 million files, including personal data on 12,076 individuals (16,389 email addresses, 11,963 phone numbers, 148 IBANs), 5,000+ personnel and administrative-offense files, 46,500 contracts, plaintext credentials for internal systems (GebäudeAtlas, PAYONE, Z_ADMIN), court records, NDA documents, Bundesrat protocols, classified/state-secret material, water-supply vulnerability analyses, and geodata (the largest single file category, ~124,823 files). The group set a roughly seven-day countdown and demanded about 30 BTC (~€2 million). Berlin Governing Mayor Kai Wegner and Interior Senator Iris Spranger issued a joint statement refusing to pay: "The state of Berlin will not submit to extortion." Officials state that election-related systems and data were not affected, despite the timing weeks before the September 20, 2026 Berlin state parliament (Abgeordnetenhaus) election.
Rhysida is a ransomware-as-a-service operation active since at least May 2023, primarily targeting education, healthcare, manufacturing, IT, and government sectors, with prior high-profile victims including the British Library (October 2023) and Chile's army. A joint CISA/FBI/MS-ISAC advisory (AA23-319A, first issued November 2023, periodically updated) documents Rhysida's typical initial-access methods as compromised external VPN accounts lacking MFA, exploitation of the Zerologon vulnerability (CVE-2020-1472) against Active Directory domain controllers, and phishing; Security Affairs cites this advisory as the likely TTP basis for the Berlin intrusion, though the specific initial-access vector used against Berlin has not been publicly confirmed. Germany's Federal Office for Information Security (BSI), the Berlin State Criminal Police Office (LKA), and the Berlin State Prosecutor's Office are investigating; no technical network IOCs (C2 IPs/domains) specific to this intrusion have been published as of this writing.
MITRE ATT&CK techniques used in TL-2026-2206
Credential Access
T1003.003 OS Credential Dumping: NTDS
Lateral Movement
T1021.001 Remote Services: Remote Desktop Protocol; T1021.002 Remote Services: SMB/Windows Admin Shares
Persistence
T1053.005 Scheduled Task/Job: Scheduled Task
Execution
T1059.001 Command and Scripting Interpreter: PowerShell
Defense Evasion
T1070.004 Indicator Removal: File Deletion
Initial Access
T1078 Valid Accounts; T1133 External Remote Services; T1566 Phishing
defense-impairment
Command and Control
Impact
Affected products and versions in Rhysida Ransomware Claims Berlin State Government Breach
- Land Berlin (Berlin State Government) — Berlin State Network (Landesnetz) — Senate Department for Urban Development, Building and Housing; Senate Department for Mobility, Transport, Climate Protection and Environment
Vulnerable versions: State network segments as configured prior to the August 2026 incident - Microsoft — Windows Server (Netlogon Remote Protocol / Active Directory Domain Controllers)
Vulnerable versions: Windows Server domain controllers without the Zerologon patch/enforcement mode
Fixed in: Patched per MS advisory: August 2020 initial update, enforcement mode default since February 2021
Remediation for Rhysida Ransomware Claims Berlin State Government Breach
Patches
- Apply/verify the Microsoft Zerologon (CVE-2020-1472) patch, including the August 2020 initial update and February 2021 enforcement mode
Immediate actions
- Enforce MFA on all external-facing VPN and remote-access services
- Rotate credentials for all systems named in the leak claim (VPN, GebäudeAtlas, PAYONE, Z_ADMIN) and any accounts used on the affected Senate department segments
- Confirm domain controllers enforce secure RPC (Netlogon) per Microsoft's February 2021 enforcement phase for CVE-2020-1472
- Hunt for ntdsutil.exe NTDS.dit extraction, unexpected AnyDesk installs, and the 'Rhsd' scheduled task on domain-joined hosts
Workarounds
- Restrict RDP, WinRM, and PsExec usage between network segments via host-based firewall rules
- Block or tightly control remote-access tool installation (e.g., AnyDesk) on servers and domain controllers
Longer-term hardening
- Segment the Berlin state network (Landesnetz) so a single department compromise cannot reach ~600 connected sites
- Deploy EDR/monitoring on domain controllers tuned to secretsdump/ntdsutil credential-dumping behavior
- Maintain offline/immutable backups and test restoration to reduce ransom leverage
- Run regular Active Directory credential-hygiene reviews and phishing-resistant MFA rollout
CVEs associated with Rhysida Ransomware Claims Berlin State Government Breach
Timeline of Rhysida Ransomware Claims Berlin State Government Breach
- Microsoft releases the initial patch for CVE-2020-1472 (Zerologon), later cited by CISA as a common Rhysida entry vector against Active Directory domain controllers.
- Rhysida ransomware-as-a-service operation first observed in the wild, subsequently targeting education, healthcare, manufacturing, IT, and government sectors.
- CISA, FBI, and MS-ISAC publish joint advisory AA23-319A documenting Rhysida IOCs and TTPs, including VPN credential compromise, Zerologon exploitation, and phishing.
- Forensic analysis later identifies unauthorized data outflows beginning from a Berlin Senate department network, continuing through August 12.
- The Senate Department for Urban Development, Building and Housing and the Senate Department for Mobility, Transport, Climate Protection and Environment are preemptively disconnected from Berlin's state network.
- Berlin authorities publicly disclose the cyber incident affecting the two Senate departments.
- Affected departments are reconnected to the Berlin state network as forensic investigation continues.
- The affected Senate administration confirms data exfiltration occurred, following indications received by the Senate Chancellery around August 25.
- Rhysida posts a 'Berlin, Germany' entry to its Tor-based leak site, claiming 5.79TB (~1.44 million files) exfiltrated and demanding roughly 30 BTC (~€2 million) with a countdown timer.
- Berlin Governing Mayor Kai Wegner and Interior Senator Iris Spranger publicly state Berlin will not pay the ransom; BSI, LKA Berlin, and the Berlin State Prosecutor's Office continue investigating.
- Berlin state parliament (Abgeordnetenhaus) election scheduled; officials state election infrastructure and data were not affected by the breach.
Sources cited for Rhysida Ransomware Claims Berlin State Government Breach
- Rhysida ransomware group targets Berlin government ahead of vote
- Berlin Refuses to Pay Hackers Who Stole Data From the City's State Network
- #StopRansomware: Rhysida Ransomware (AA23-319A)
- Rhysida Ransomware Explained: Tactics, Techniques, and Procedures
- Cyber-Angriff trifft zwei Berliner Senatsverwaltungen
- Hackerangriff auf Berliner Senatsverwaltungen: Ermittlungen laufen, Daten-Frage weiter offen
- Berliner Senat bestätigt Erpressung: Wegner weist Ultimatum zurück – Hacker fordern laut Medienbericht zwei Millionen Euro
- Berlin state agencies: Ransomware group says it stole Berlin data, offers it for auction
- CVE-2020-1472 (Zerologon)
Detection coverage for TL-2026-2206
As of 2026-08-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2206 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.