The Federal Office for the Protection of the Constitution (BfV) said the alert was issued in coordination with Germany’s foreign intelligence agency, the BND, and the U.S. Federal Bureau of Investigation.

The group, also known as “Fancy Bear,” has been attributed by Western governments to Russia’s military intelligence service, the GRU.According to the BfV, APT28 exploited weaknesses in TP-Link routers, affecting several thousand devices worldwide, including about 30 in Germany.

In some cases, authorities confirmed breaches, leading operators to replace compromised hardware.The agency said the campaign was aimed at facilitating surveillance of sensitive targets, including state institutions and key infrastructure networks.

APT28 has previously been linked to cyberattacks against Germany’s parliament, the Social Democratic Party and air traffic control systems, underscoring its long-standing role in espionage operations targeting European institutions.

German authorities urged heightened vigilance and coordination among operators to mitigate risks posed by the ongoing campaign.

Speaking alongside Syrian transitional President Ahmed Al-Sharaa in Berlin, Merz said both governments were seeking to create conditions that would allow more Syrians to return voluntarily to their homeland.

Germany hosts the largest Syrian diaspora in the European Union, with more than one million Syrians, many of whom arrived during the 2015–2016 migrant influx.“We are working jointly toward more Syrians being able to return to their homeland,” Merz said at a joint press conference.

Sharaa said Damascus and Berlin were exploring a “circular” migration framework that would allow Syrians to participate in rebuilding their country while retaining the option to remain in Germany.

Such a model would enable returnees to contribute to reconstruction efforts without permanently relinquishing the economic and social stability they have established abroad, he said.

Merz said Germany intended to support Syria’s reconstruction after years of civil war, adding that a German delegation would travel to Syria in the coming days to advance cooperation.

However, he stressed that deeper bilateral engagement would depend on progress toward establishing rule-of-law institutions.

“Many joint projects in the future will depend on our finding a state governed by the rule of law,” Merz said, adding that he was confident such conditions could be achieved following discussions with Sharaa.

The federal prosecutor’s office said police searched three houses in the western canton (state) of Fribourg early Friday as part of two criminal investigations into alleged extremist activity.

The suspects are alleged to have violated Swiss law banning involvement with al-Qaida, ISIS and related organizations.

Prosecutors said the four people detained are also suspected of having “supported or participated in a criminal organization.”

They identified the four suspects only as a 28-year-old Kosovar woman, a 29-year-old Macedonian, a 26-year-old Kosovar man and a 34-year-old Swiss-Kosovar dual national.

“As they had been in contact with each other, the house searches and arrests were all carried out at the same time,” prosecutors said.