# Rhysida Ransomware Claims Berlin State Government Breach Ahead of September Election

> The Rhysida ransomware-as-a-service group claims to have exfiltrated 5.79TB (~1.44 million files) from two Berlin Senate departments and posted the claim to its Tor leak site on August 28, 2026, demanding roughly 30 BTC (~€2 million). Berlin officials refused to pay; the affected departments were isolated and reconnected before the September 20, 2026 state election, which officials say was unaffected.

- **Published:** 2026-08-29T00:00:00Z
- **Last reviewed:** 2026-08-29T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2206
- **ID:** TL-2026-2206
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Rhysida
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2020-1472

## Description

Between August 7 and 12, 2026, unauthorized data outflows occurred from Berlin's state government network ("Landesnetz"), a fiber backbone connecting roughly 600 government, police, fire, and hospital sites. The intrusion affected two Senate departments: the Senate Department for Urban Development, Building and Housing (where the initial security gap was located, per Berlin's IT service provider ITDZ) and the Senate Department for Mobility, Transport, Climate Protection and Environment. Forensic indicators reached the Senate Chancellery around August 25-26, 2026; both departments were preemptively disconnected from the state network on August 14, 2026 and remained largely offline (phone-only external communication) until reconnection around August 23, 2026. Berlin publicly disclosed the incident on August 17-18, 2026.

On August 28, 2026, the Rhysida ransomware group posted a "Berlin, Germany" entry to its darknet (Tor) leak site, claiming 5.79 terabytes across approximately 1.44 million files, including personal data on 12,076 individuals (16,389 email addresses, 11,963 phone numbers, 148 IBANs), 5,000+ personnel and administrative-offense files, 46,500 contracts, plaintext credentials for internal systems (GebäudeAtlas, PAYONE, Z_ADMIN), court records, NDA documents, Bundesrat protocols, classified/state-secret material, water-supply vulnerability analyses, and geodata (the largest single file category, ~124,823 files). The group set a roughly seven-day countdown and demanded about 30 BTC (~€2 million). Berlin Governing Mayor Kai Wegner and Interior Senator Iris Spranger issued a joint statement refusing to pay: "The state of Berlin will not submit to extortion." Officials state that election-related systems and data were not affected, despite the timing weeks before the September 20, 2026 Berlin state parliament (Abgeordnetenhaus) election.

Rhysida is a ransomware-as-a-service operation active since at least May 2023, primarily targeting education, healthcare, manufacturing, IT, and government sectors, with prior high-profile victims including the British Library (October 2023) and Chile's army. A joint CISA/FBI/MS-ISAC advisory (AA23-319A, first issued November 2023, periodically updated) documents Rhysida's typical initial-access methods as compromised external VPN accounts lacking MFA, exploitation of the Zerologon vulnerability (CVE-2020-1472) against Active Directory domain controllers, and phishing; Security Affairs cites this advisory as the likely TTP basis for the Berlin intrusion, though the specific initial-access vector used against Berlin has not been publicly confirmed. Germany's Federal Office for Information Security (BSI), the Berlin State Criminal Police Office (LKA), and the Berlin State Prosecutor's Office are investigating; no technical network IOCs (C2 IPs/domains) specific to this intrusion have been published as of this writing.

## MITRE ATT&CK

- T1133 External Remote Services
- T1078 Valid Accounts
- T1566 Phishing
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1070.004 Indicator Removal: File Deletion
- T1112 Modify Registry
- T1003.003 OS Credential Dumping: NTDS
- T1021.001 Remote Services: Remote Desktop Protocol
- T1021.002 Remote Services: SMB/Windows Admin Shares
- T1219 Remote Access Tools
- T1490 Inhibit System Recovery

## Sources

- [Rhysida ransomware group targets Berlin government ahead of vote](https://securityaffairs.com/198064/cyber-crime/rhysida-ransomware-group-targets-berlin-government-ahead-of-vote.html)
- [Berlin Refuses to Pay Hackers Who Stole Data From the City's State Network](https://thehackernews.com/2026/08/berlin-refuses-to-pay-hackers-who-stole.html)
- [#StopRansomware: Rhysida Ransomware (AA23-319A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-319a)
- [Rhysida Ransomware Explained: Tactics, Techniques, and Procedures](https://www.picussecurity.com/resource/blog/rhysida-ransomware-explained)
- [Cyber-Angriff trifft zwei Berliner Senatsverwaltungen](https://www.behoerden-spiegel.de/2026/08/18/cyber-angriff-trifft-zwei-berliner-senatsverwaltungen/)
- [Hackerangriff auf Berliner Senatsverwaltungen: Ermittlungen laufen, Daten-Frage weiter offen](https://security-network.com/hackerangriff-berliner-senatsverwaltungen/)
- [Berliner Senat bestätigt Erpressung: Wegner weist Ultimatum zurück – Hacker fordern laut Medienbericht zwei Millionen Euro](https://www.tagesspiegel.de/berlin/berliner-senat-bestatigt-erpressung-wegner-weist-ultimatum-zuruck--hacker-fordern-laut-medienbericht-zwei-millionen-euro-15984600.html)
- [Berlin state agencies: Ransomware group says it stole Berlin data, offers it for auction](https://blog.rankiteo.com/lan1787963614-berlin-state-agencies-ransomware-august-2026/)
- [CVE-2020-1472 (Zerologon)](https://nvd.nist.gov/vuln/detail/CVE-2020-1472)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2206