According to the Spiegel magazine, the attackers have stolen documents related to EU-UK Brexit talks and records of EU-Belarus, EU-Ukraine talks. The process of stealing was reportedly under control of the German intelligence services as they had already detected the attack by the time the hackers started to steal the files.
The magazine added that the intelligence services believed the Turla hacking group was behind the attack. They also assume that there is a clear connection between Turla and the Russian Federal Security Service (FSB).
On February 28, the networks of the German foreign and defense ministries suffered cyberattacks. The initial reports suggested that the APT28 team, also known as Fancy Bears, which some believe has connections to Moscow, could be behind the attack.
Turla, a hacking group which is allegedly funded by the Russian government, has been active since at least 2008. The group's attacks usually targeted high-profile European and US institutions.
Russia has repeatedly faced accusations of hacking attempts to influence the elections in other countries and interfere in their domestic affairs. Moscow has firmly denied the accusations as baseless.