Berlin is preparing to adopt a more aggressive stance against cyber threats. Interior Minister Alexander Dobrindt announced on Tuesday that the government will introduce legislation this month to enable security services to conduct what he called “active cyberdefence” — including the ability to disrupt and destroy servers and infrastructure used in attacks against German targets.
Speaking at a press conference in Berlin, Dobrindt said the goal is to ensure that attackers, many of whom operate from abroad, can no longer use the same systems to strike again. “This means ensuring that someone attacking us from a server system, for example, to attack an energy company in Germany from abroad, will no longer be able to do so in future with that infrastructure, that server, that software or those facilities,” he explained.
Rising Tide of AI-Enabled Cybercrime
The move comes as Germany faces a sharp increase in cybercrime, with the interior ministry reporting around 334,000 registered cases in 2025. Two-thirds of these originated from foreign or unknown locations, and authorities believe the actual number is significantly higher due to underreporting. The economic damage last year exceeded €200 billion, according to the ministry.
Artificial intelligence is playing an increasingly central role in these attacks. The ministry noted that AI-based tools allow criminals “to carry out attacks faster, more precisely and more professionally.” Mark Branson, head of the German financial regulator BaFin, warned that “the new AI models can identify and even exploit many vulnerabilities in IT systems with remarkable speed,” urging companies to patch weaknesses far more quickly.
Ransomware attacks alone exceeded 1,000 last year, a 10% increase from the previous year, with extortion payments totalling more than $15 million (€12 million). Denial-of-service attacks rose by 25%, reaching 36,706 cases.
Russian Origins and Geopolitical Context
Dobrindt pointed to a significant rise in cyber activism originating from Russia since its full-scale invasion of Ukraine in 2022. This aligns with broader European concerns about state-sponsored and politically motivated cyber operations. The new law would allow German authorities to retaliate against servers used in such attacks, a step that marks a departure from purely defensive measures.
The announcement comes amid heightened tensions between Berlin and Moscow, and follows other German initiatives to bolster security, such as the 'Brave Germany' arms programme with Kyiv for joint defence technology development. It also reflects a broader European push to strengthen cyber resilience, as seen in the race for energy storage and other critical infrastructure.
The interior ministry emphasised that the proposed legislation is designed to keep pace with evolving threats. “That's why we want to expand our active cyberdefence capabilities,” Dobrindt said, signalling that Germany is prepared to move beyond passive protection and into offensive countermeasures.
BaFin's Branson also stressed the need for financial firms to accelerate their cybersecurity efforts, warning that AI-driven attacks can identify vulnerabilities with remarkable speed. The regulator is strengthening its supervision of cyber risks in the financial sector, a move that mirrors similar actions by other European watchdogs.
The new law is expected to pass through cabinet this month, though it will still require parliamentary approval. If enacted, Germany would join a small number of European countries that have explicitly authorised offensive cyber operations in response to attacks.
