Russia has made Germany a priority espionage target, and the threat from cheap, deniable sabotage carried out by civilians paid for one-off jobs is rising, Germany's Military Counterintelligence Service (MAD) said in its 2025 annual report—the first published under a new law obliging annual disclosure. MAD blamed Germany's geostrategic position in Europe and NATO, the expansion of the Bundeswehr, and the introduction of new weapons systems. Repeated sabotage cases on German soil last year were "with high probability" Russian-run, MAD said.

For two years Berlin has publicly warned about a Kremlin campaign of arson, surveillance, and drone incursions run through cheap local proxies—mostly at press briefings and closed sessions. A January 2026 transparency law now forces that warning onto the statutory public record, sharpening the burden of an operational answer. Germany hosts NATO's logistics spine for arming Ukraine—the very hub Moscow's proxies keep aiming at.

Sabotage on the cheap

"Hybrid attacks have increased in Germany," MAD said.

The threat from "low-level agents"—residents paid small sums to plant fires or photograph military sites—has significantly increased. Recent incidents match the model: a bomb-laden drone found in August beside a Ukrainian cargo aircraft at Leipzig/Halle airport was traced this month to a Russian intelligence operative and a Belarusian petty criminal, and two Bulgarian nationals were arrested over a September suspected arson near defense-electronics firm Rohde & Schwarz in Munich. Russia's Legalresidenturen — intelligence outposts inside embassies, semi-state bodies, and press agencies—remain a central instrument of Moscow's information-gathering.

Explore further

A masked figure got into a Polish drone-parts plant—Poland now suspects a foreign spy service set the fire

Chinese drones over bases, blackmail risk for soldiers

Some drone overflights and unauthorized entries at Bundeswehr sites are attributable to Chinese intelligence, MAD said, which is also drawing on parts of the Chinese diaspora in Germany.

The service flagged travel by German soldiers to Russia and Belarus: personnel with family ties there kept visiting despite the security climate, drawing the attention of Russian and Belarusian intelligence services and creating particular exposure to blackmail and threats.

Sabotage preparation, remote recruitment, and data collection on military sites account for a significant share of Poland's espionage docket, and public arrests have not dented the pace, RBC-Ukraine reported on 15 September. The published figures cover only the highest-complexity investigations, so with district prosecutors' cases counted in, the real scale of Russian activity is larger still.

Russia's covert campaign inside the EU has escalated from online disinformation into physical attacks since the full-scale invasion of Ukraine—arson at defense plants, assassination plots, and bomb-rigged drones found at European airports.

Recorded sabotage incidents across Europe tripled between 2023 and 2024 alone. Poland, as NATO's primary overland corridor for Western military aid to Ukraine, sits at the center of that pressure—its railway routes near the Rzeszów logistics hub have drawn particular attention.

What the prosecutors count as espionage

Poland's National Prosecutor's Office opened 67 criminal cases under Article 130 of the Criminal Code—espionage and activity on behalf of a foreign intelligence service—during 2025, spokesperson Przemysław Nowak told RBC-Ukraine. In the first eight months of 2026 alone, prosecutors added at least 40 more.

At that pace, 2026 could yield roughly 60 new cases, RBC-Ukraine noted, concluding that the tempo of recruitment and sabotage preparation is not slowing but staying steadily high despite public detentions and strengthened counterintelligence.

Courier bombs and expendable operatives

Earlier, Polish law enforcement exposed two Russian citizens prosecutors say worked for Russian special services. One of them planned to send an explosive device through a delivery service—part of a wider Russian sabotage campaign that recruits low-cost, expendable operatives for arson and disruption across the EU.