Russia has made Germany a priority espionage target, and the threat from cheap, deniable sabotage carried out by civilians paid for one-off jobs is rising, Germany's Military Counterintelligence Service (MAD) said in its 2025 annual report—the first published under a new law obliging annual disclosure. MAD blamed Germany's geostrategic position in Europe and NATO, the expansion of the Bundeswehr, and the introduction of new weapons systems. Repeated sabotage cases on German soil last year were "with high probability" Russian-run, MAD said.

For two years Berlin has publicly warned about a Kremlin campaign of arson, surveillance, and drone incursions run through cheap local proxies—mostly at press briefings and closed sessions. A January 2026 transparency law now forces that warning onto the statutory public record, sharpening the burden of an operational answer. Germany hosts NATO's logistics spine for arming Ukraine—the very hub Moscow's proxies keep aiming at.

Sabotage on the cheap

"Hybrid attacks have increased in Germany," MAD said.

The threat from "low-level agents"—residents paid small sums to plant fires or photograph military sites—has significantly increased. Recent incidents match the model: a bomb-laden drone found in August beside a Ukrainian cargo aircraft at Leipzig/Halle airport was traced this month to a Russian intelligence operative and a Belarusian petty criminal, and two Bulgarian nationals were arrested over a September suspected arson near defense-electronics firm Rohde & Schwarz in Munich. Russia's Legalresidenturen — intelligence outposts inside embassies, semi-state bodies, and press agencies—remain a central instrument of Moscow's information-gathering.

Explore further

A masked figure got into a Polish drone-parts plant—Poland now suspects a foreign spy service set the fire

Chinese drones over bases, blackmail risk for soldiers

Some drone overflights and unauthorized entries at Bundeswehr sites are attributable to Chinese intelligence, MAD said, which is also drawing on parts of the Chinese diaspora in Germany.

The service flagged travel by German soldiers to Russia and Belarus: personnel with family ties there kept visiting despite the security climate, drawing the attention of Russian and Belarusian intelligence services and creating particular exposure to blackmail and threats.

NATO fighter jets shot down a drone over Lithuania shortly after midnight on 15 September, the first time alliance aircraft have destroyed one over that country, LRT reported. The aircraft crossed in from Belarus and came down near a village in the center of the country, where military police sealed the site. Its type and operator have not been established.

What happened over Lithuania

Lithuania's National Crisis Management Center issued a yellow air alert after midnight, first for the capital and the districts around it, then for the Kaunas region further west. Italian Air Force Eurofighter Typhoons flying NATO's Baltic air policing mission from Šiauliai Air Base destroyed the drone with missile armament, Lithuania's Defense Ministry confirmed, and the army published the first images from the crash site.

The drone was over Lithuanian territory for about half an hour, crisis center head Vilmantas Vitkauskas told LRT radio. He said there is a high probability it carried an explosive charge, though the wreckage does not yet show whether it was a combat drone. Lithuania chose a yellow alert rather than red because red is used when a strike or a fall is unavoidable, he explained, and the drone was destroyed within seconds of the air defense crews reacting, over farmland with no homes nearby.

Military and civilian police are working at the site under the Shield security plan, and the area has been fenced off and guarded. President Gitanas Nausėda thanked the allied personnel for their swift response, saying that with Russia intensifying its aggression against Ukraine such readiness is vital for the region.

Whose drone it was

Nothing has been established beyond the direction it came from. The army has not commented on the drone's possible origin while the wreckage is still being collected, and the launch point also remains unreleased. Vilnius airport suspended operations during the alert, and flights from Türkiye and Iceland were delayed.

The same night as this incursion, Poland scrambled fighter jets and raised air defense readiness over Russian drone strikes on western Ukraine, and Romania did the same, with neither country recording a violation of its airspace. The day before, the Polish military recovered a drone from the Baltic Sea that its defense minister said preliminary inspection indicated was Russian and military.