Even the leader of Germany’s Cyber and Information Domain Service (CIR) is not exempt from receiving those annoying phishing emails warning that the antivirus protection he never subscribed to is about to expire.
One might expect hackers to display more sophistication, especially considering the potential targets.
On Thursday, Vice-Admiral Thomas Daum mentioned he had deleted three blatantly obvious phishing attempts from his personal email.
“I believe I am in a position to recognize the risks associated with clicking the wrong link,” Daum stated in an exclusive interview with CBC News during his visit to Ottawa.
This incident serves as a clear example of the ongoing challenges faced by Germany, its military, and other allied nations, particularly as adversaries like Russia, China, Iran, and North Korea intensify their cyberattacks.
“We are not at war, but we are also not at peace,” he noted.
Daum is in Ottawa for discussions with the Canadian military’s cyber command and senior defense officials.
While he may know which buttons to avoid, others might not be so discerning.
A new EY report suggests AI will become a major force behind cybercrime in 2026 as programs help attackers hone their scamming skills.
A report released in Germany last March detailed how Russian state hackers executed a focused phishing operation targeting the Signal messaging app.
This assault succeeded in taking over the account of a former vice president of German foreign intelligence, which was then used to distribute malware to influential contacts within the European defense and security sectors.
As both Germany and Canada embark on significant rearmament initiatives, Daum noted his country has seen a rise in supply chain attacks targeting its defense sector and associated companies.
-
Analysis
Trump rages, NATO endures: Why the alliance is harder to kill than it looks
-
Defence experts warn Canada lags far behind in efforts to secure the Arctic
Over a span of two years, one of Germany’s most prominent defense contractors, Rheinmetall, known for manufacturing armored vehicles including Leopard tanks, suffered a ransomware attack.
The full extent of the damage was revealed in 2024 and was orchestrated by the Russian-speaking Black Basta group. This attack targeted Rheinmetall’s civilian automotive branch and resulted in roughly $10.8 million in recovery expenses and lost revenue.
Daum cautions industry to bolster defenses
While reports indicated the company’s military division was largely insulated, this attack followed Rheinmetall’s announcement of a new tank production facility in Ukraine. Daum remarked that this aligns with a pattern they have observed.
“What we consistently observe are these types of attacks from Russia, which tend to escalate whenever there is an announcement about funding for Ukraine,” he explained. “There is an immediate response, and all our firewalls are under attack again.”
In March, the German Federal Public Prosecutor General disclosed that an unnamed drone manufacturer in Bavaria was the target of a significant espionage effort that resulted in the arrest of two suspected spies. The suspects—a Ukrainian male and a Romanian female—gathered confidential information both online and in-person for Russian intelligence.
Additionally, German intelligence (BfV) has raised alarms regarding increased attacks on HIL, a military maintenance logistics provider essential for servicing vehicles like the Leopard tanks, many of which are deployed in Ukraine.
Daum emphasized that there are valuable lessons for both German and Canadian industries.
“We urge the defense sector to take appropriate measures to protect themselves and to act swiftly when an incident is identified, ensuring their operations remain uninterrupted.”
Chief of the Defence Staff General Jennie Carignan tells CBC News she is close to presenting Ottawa with options on how to drastically increase the size of the military’s manpower amid government plans to spend billions on new aircraft and submarines.
In Canada, there have been reports of defense contractors being targeted.
In 2023, The Canadian Press reported a ransomware attack on Black & McDonald, a significant engineering company with multiple military contracts. Similarly, Brookfield Global Relocation Services, which assists Canadian military and foreign service members, faced a major data breach that compromised sensitive personal data.
Daum stated that the general populace also plays a crucial role in cybersecurity since even personal computers can be compromised and utilized remotely.
“I always say that the primary threat to cybersecurity is often sitting just 15 centimeters in front of the monitor,” he remarked.