3rd June 2025
The Threat Research team has been monitoring fraud campaigns targeting German organizations since early May 2025. This campaign focuses on two notable entities: the German Central Tax Office (BZSt) and the German Social Accident Insurance Institution for Foodstuffs and Catering Industry (BGN). While these organizations are not official government public sector entities, they play significant roles in the administration of tax and social insurance matters in Germany.
The lure focuses on two areas and includes an invoice attachment.
Sophisticated German-Language Messages
The fraud emails are written in formal, well-constructed German, mimicking the tone and style of official communications from authorities. This increases the credibility of the messages and makes them more convincing to end users.
Spoofed Domains Mimicking Tax Authorities and BGN
The threat actors use lookalike domains that closely resemble legitimate German tax-related operations and BGN communications. These domains are designed to deceive recipients into believing the emails originate from official sources. Examples of spoofed domains include:
For BZSt:
For BGN:
The naming conventions of these domains align with tax-related and social insurance terminology, further enhancing their legitimacy in the eyes of the recipients.
Automated PDF Generation
The emails all contain PDF invoices which has been created using software that is known for its ability to create dynamic, customized PDFs, which the attackers use to tailor documents for individual recipients. These PDFs often contain fraudulent payment instructions.
Fraudulent Financial Details
A significant indicator of fraudulent activity in these campaigns is the inclusion of Spanish banking details in the attachments. These details are inconsistent with legitimate German operations and serve as a red flag. Examples of the fraudulent financial information include:
We have identified several attributes in the recent campaigns that have been added to our detection capabilities. We continue to monitor for changes in techniques used by this threat operation.
Predominantly German organizations across various industries
Sending Domains
bgn-abwicklung[.]de
bgn-bezahlung[.]de
bgn-einzahlung[.]de
bgn-forderung[.]de
bgn-transfer[.]de
bgn-zahlstelle[.]de
bgn-zahlungen[.]de
bzst-abwicklung[.]de
bzst-einzahlung[.]de
bzst-forderung[.]de
bzst-rechnungen[.]de
bzst-zahlung[.]de
Email Subjects
Steuererklärung 2023 – Statusprüfung empfohlen
Erinnerung an die Abgabe der Steuerunterlagen 2023
Aktuelle Informationen zu Ihrer Steuererklärung
Übersicht zur eingereichten Steuererklärung 2023
Information zur Steuererklärung 2023
Nachricht zur Bearbeitung Ihrer Steuererklärung
Hinweis zur Fristüberschreitung bei der Steuererklärung
Mitteilung zum Abgabestatus Ihrer Steuererklärung
Abgabe Ihrer Steuerunterlagen – kurzer Überblick
Steuerdokumente 2023 – ergänzende Hinweise
Discover how Mimecast’s single platform can protect your people, AI, and data.
Join thousands of security professionals using our curated alerts, expert analysis, and campaign IOCs to defend against emerging cyber threats.
Threat IntelligenceSep 1, 2026
Threat IntelligenceAug 27, 2026
