German industry expects Russian sabotage against the country’s companies to persist and take more forms, the deputy head of the Federation of German Industries (BDI) told Handelsblatt. His warning follows alarms from Germany’s intelligence services, which describe the country as a main target of Russia’s covert campaign in Europe.

Russia keeps striking Ukrainian cities and power plants every day while trying to weaken the European support that keeps Ukraine fighting. Germany is home to arms makers producing with and for Ukraine, so pressure on its companies targets the supply behind Ukraine’s defense.

Industry expects attacks to last and change form

The warning came from Holger Lösch, the BDI’s deputy managing director.

“German industry is preparing for the threat to persist and for attack methods to become more varied,” he told Handelsblatt. “Companies don’t end up in the crosshairs by chance,” he added.

Russian influence and sabotage operations are no longer an abstract scenario, and companies, critical infrastructure, and defense supply chains are already among their targets, Lösch said. Companies now receive more threat warnings, and their cooperation with the authorities has improved significantly, he noted. “What is still missing are joint procedures to quickly derive concrete measures from warnings,” Lösch said, calling the protection of the economy a cornerstone of national security.

German intelligence describes a Russian shadow war

The warning comes a week after a public hearing of the intelligence oversight panel of the Bundestag, Germany’s parliament, on 5 October. There, Martin Jäger, head of Germany’s Federal Intelligence Service (BND), said Russia was waging a shadow war against Germany. “Germany has become a main obstacle to Russian hegemonic power projection in Europe and thus a target of Russian action,” Jäger said. “The danger of attacks against targets in Germany remains real and present,” he warned.

Sinan Selen, head of the Federal Office for the Protection of the Constitution (BfV), Germany’s domestic intelligence agency, told the same hearing that Russia was showing a readiness for sabotage and killings.

German Chancellor Friedrich Merz said on 1 October that Germany was preparing for further hybrid attacks, “including serious ones,” and would respond “quickly and very clearly,” as it did after the drone attack at Leipzig airport.

Drone bombs, arson, and paid saboteurs on German soil

In August, a drone carrying Semtex explosives hit the wing of a Ukrainian An-124 cargo plane at Leipzig/Halle Airport but did not explode. Germany blamed Russia on 1 September, and German Foreign Minister Johann Wadephul said Germany was not at war with Russia but was a “target of war.”

German authorities suspect Russian intelligence of commissioning an arson attack near two Munich defense firms, and a confidential Federal Criminal Police Office (BKA) assessment counted more than 165 suspected sabotage cases in Germany between January and August. The same assessment recorded 747 suspicious drone incidents involving 1,068 drones over critical infrastructure, military sites, and defense companies.

Explore further

The throwaway agents Moscow sent after a Bavarian drone boss arming Ukraine—and how Germany stopped them

Germany’s Military Counterintelligence Service (MAD) warns that the threat from low-level agents, locals paid small sums for one-off jobs such as arson or photographing military sites, has increased significantly. European intelligence agencies also report that Russia is increasingly targeting defense company executives, including at smaller drone makers, and the BfV has advised some German firms to hire close protection.

As long as Germany keeps backing Ukraine, Russian pressure on its companies is unlikely to ease, and the gap between warnings and action that industry flagged leaves smaller firms, with fewer resources for security, the most exposed.

Germany is expanding drone detection at its airports with a new system operated by German air traffic control provider Deutsche Flugsicherung (DFS), the German Federal Ministry for Transport (BMV) announced on 5 October.

Germany has accused Russia of attempting a hybrid attack at Germany’s Leipzig/Halle Airport near a Ukrainian An-124 aircraft using a drone carrying explosives. Earlier, Finnish President Alexander Stubb said Europe must be prepared for “continued hybrid and sabotage attacks” by Russia, adding that Russia seeks to sow panic through such actions.

On Monday, two more sites were added—Stuttgart and Hamburg. As of Monday, seven of Germany’s eight largest airports were equipped with the new drone detection system in their approach and departure areas.

Germany seeks responses to new hybrid threats

The Federal Ministry cited the reason for the new measure: drones near airports can affect air traffic very quickly.

Federal Transport Minister Steffen Bilger and Baden-Württemberg Transport Minister Nicole Razavi were briefed on the new system at Stuttgart Airport, where it is being put into operation, the ministry said. The system creates “an important technical basis for detecting potential threats at an early stage and quickly informing the competent authorities,” Bilger said.

“With today’s commissioning of the drone detection system at Stuttgart Airport, the federal government is fulfilling a key promise: it is not only talking about the dangers posed by unmanned aircraft, but is also following through with very concrete action. Protecting critical infrastructure and ensuring the safety of passengers at Stuttgart Airport require continuous adaptation to a changing security situation,” Razavi said, according to the ministry.

The new DFS system allows drones near airports to be detected at an early stage and information about possible threats to air traffic to be passed more quickly to the relevant authorities. This helps them assess risks and respond to them more quickly, the statement said.

DFS is responsible for detecting drones in approach and departure areas, while the Federal Police and other security services are responsible for preventing threats and defending against drones. The BMV, Federal Ministry of the Interior, DFS, Federal Police and airports coordinate their work to exchange information quickly and maintain a shared picture of the situation.

No further details about how the system operates have been disclosed.

The first stage of the expansion at Germany’s eight major commercial airports will be fully implemented this week, with the systems in Stuttgart and Hamburg being put into operation, the statement said.

Explore further

A drone came down beside a Bundeswehr air base, weeks after Berlin blamed Moscow for the Leipzig airport attack

The system will also be installed at the airport where a bomb-laden drone was found

The system will also be put into operation at Leipzig/Halle Airport this week, meaning that the first stage will be fully implemented at all eight of Germany’s largest commercial airports, according to the press release.

A quadcopter drone carrying a Semtex explosive flew directly toward a parked Ukrainian An-124 Ruslan cargo aircraft and struck its wing at Leipzig/Halle Airport in Germany on the evening of 4 August, Die Zeit reported on 10 August. The drone hit the aircraft at around 19:30 local time, bounced off the wing, and fell to the ground without detonating, according to the media outlet.

Germany has accused Russia of attempting the drone attack and announced further sanctions against Russian citizens and institutions, Tagesschau reported on 1 September.

At the crime scene, investigators found the drone configuration, explosives and detonation technology that had already appeared in other Russian hybrid operations and in Russia’s war against Ukraine, Federal Interior Minister Alexander Dobrindt said during a joint press conference with Federal Foreign Minister Johann Wadephul, the media outlet reported.

The German government assumes that Germany has been and will be a target of further such Russian attacks. Germany is not at war with Russia but is a “target of war,” Foreign Minister Wadephul said, according to the outlet.

Russian troops were taking selfies beside a jet-powered Shahed launcher when a Ukrainian drone hit them. A Ukrainian drone attacked a pickup truck converted to launch Russian Shahed drones in the Donetsk airport area while its crew prepared to fire a jet-powered Geran-4, according to video from the Cursed Empire drone unit of the 100th Separate Mechanized Brigade that volunteer Serhii Sternenko published on 6 October.

Russia launches Shahed drones, including jet-powered ones, from pickup trucks and fixed launchers, and the ruined Donetsk airport, about 50 kilometers from the front line, is one of its drone bases. In September, Oboronka outlet counted that in general, Russia has at least 63 launchers at its drone bases, which are built to survive strikes.

The video shows three carefree Russian soldiers next to a pickup fitted with a launch frame.

"That was their last photo shoot," Sternenko noted, commenting on the hit on the soldiers.

The primary target

Earlier, an officer of the 1st Separate Center of the Unmanned Systems Forces, call sign “Falco,” explained that the primary goal of strikes on drone bases is to disrupt Russia's ability to launch drones.

This is done by destroying launchers and storage facilities, as well as creating an aerial threat over the drone base. Such attacks can delay drone launches indefinitely, while the destruction of infrastructure can reduce the overall number of drones launched.

But the "jewel" of anti-drone port operations is the military staff

Although these facilities are important targets, the Unmanned Systems Forces have another priority: drone operators.

“The most difficult and, at the same time, the most valuable target is the operator. They don’t stay near the launchers for long,” Falco said.

By taking out drone operators, Ukraine inflicts losses on a scarce resource. There are already relatively few of them, and Russia will have to spend additional money and time training new crews.

Drones attacked Moscow and Moscow Oblast overnight on 6 October, and a fire broke out at the Volodarskaya pipeline station, the region's largest oil depot, monitoring Telegram channels reported. The station supplies jet fuel to Moscow's main airports. Local authorities did not mention the fire, while claiming to have downed hundreds of drones.

Ukraine's long-range drones have spent years working through Russia's oil industry, and Kyiv says its strikes have now disabled more than half of Russia's refining capacity. The storage and pipeline hubs that move the remaining fuel are what keep the army, the capital, and the export flows supplied.

Fire at the Moscow region's largest fuel depot

Ukrainian monitoring channel Exilenova+ wrote that the Volodarskaya station was burning after the attack, and Ukrainian monitoring channel Supernova+ reported the strike on the depot. Exilenova+ then posted the site's coordinates near the village of Konstantinovo. Supernova+ said a storage tank was on fire, and Exilenova+, citing locals, later wrote that two tanks were burning.

Russian news Telegram channel Astra geolocated a Supernova+ video to Konstantinovo in Ramensky district. The station had not been reported attacked before, Astra said.

The station lies 40 km from central Moscow, Militarnyi reported. Drone alerts in the area began at 23:43 on 5 October. From 03:24, reports came in of Ukrainian Peklo drones flying through Oryol Oblast toward Moscow Oblast, the outlet said. Ukraine's military has not commented on the strike.

Early in the night, Exilenova+ claimed a strike on the Moscow refinery in Kapotnya. It later said the footage circulating from there was most likely archival.

Jet fuel for Vnukovo, Domodedovo, and Sheremetyevo

The station has 27 tanks with a combined capacity of about 250,000 m³, according to Militarnyi. It connects to the ring pipeline for petroleum products around Moscow, which carries aviation fuel to Vnukovo, Domodedovo, and Sheremetyevo airports. Russia's state pipeline operator Transneft has said the station can move up to 3 million tonnes of jet fuel, 2.8 million tonnes of diesel, and 1.6 million tonnes of gasoline a year.

Astra gave a lower figure: about 3 million tonnes of petroleum products a year in total, arriving from the Moscow and Ryazan refineries. Supernova+ described Volodarskaya as a branch of Transneft–Upper Volga, as did Militarnyi, while Astra named Transnefteprodukt.

Explore further

Russia has warned its cities about every strike for years. During the heaviest raid yet, on election day, it left the sirens silent

Russia claims hundreds of drones downed

Moscow Mayor Sergei Sobyanin claimed that 650 drones flew toward the Moscow region from the evening of 5 October to the morning of 6 October. Most were downed far from the city, and 105 near Moscow, he claimed, without mentioning any damage. Adding up his later posts, Astra counted at least 718 drones aimed at Moscow. Moscow Oblast Governor Andrei Vorobyov claimed that 185 drones were downed over 16 municipalities. He later called it one of the largest drone attacks and put the toll at two killed and nine injured, with 47 detached houses damaged in seven municipalities.

Explore further

Fifth drone-related NORSI shutdown in under five months leaves all major Lukoil refineries offline

Not the first Transneft site or Moscow fuel target

Ukraine has targeted Russia's pipeline network before. On 2 October, drones set Transneft's Samara station on fire. During Russia's Duma elections on 20 September, a strike reached Moscow's fuel supply. The Moscow refinery fully stopped processing oil after that attack. Days later, Kyiv offered to halt refinery strikes if Russia stopped hitting Ukraine's power grid. Russia has not taken the deal.

Several recent incidents across Europe were conducted by Russia or are likely attributable to Russia, ISW assessed in its 24 September report, though authorities have not officially linked the Polish and German incidents to Moscow.

Russia's full-scale war against Ukraine has expanded into a parallel campaign of provocations against European defense and logistical infrastructure. The Kremlin is using drones, arson, and undersea cable sabotage to degrade Europe's will and ability to support Ukraine, while deliberately intensifying the frequency of airspace violations to erode the boundary between hybrid and kinetic war.

Drones over Moldova and Romania

Four Russian drones flew over Bukovyna and targeted an energy facility and border crossings with Moldova and Romania, Chernivtsi Oblast Military Administration head Ruslan Osypenko reported. Ukrainian forces shot down three. The fourth flew toward Suceava County in northeastern Romania.

A drone crashed in Cernița, Florești district, Moldova—preliminarily identified as a Russian Gerbera type, the first such device found in the country. It carried an onboard camera, hit a tree, and exploded, Moldovan police said. Romania's Defense Ministry reported a second aerial vehicle entered Romanian airspace for four minutes and crashed near Solca in the same border region; geolocated footage confirmed it was also a Gerbera, ISW noted. Poland evacuated the Hrubieszów and Dorohusk border crossings for 30 minutes, Prime Minister Donald Tusk said. Three countries were put on alert by a single night of Russian strikes.

"Intentional and accidental Russian drone incursions into NATO and Moldovan airspaces are likely part of the Kremlin's efforts to normalize airspace violations by intensifying their frequency," ISW assessed.

Sabotage in Poland and Germany

A fire engulfed the power system and backup generator at a Starlink ground station in Wola Krobowska, central Poland, on the evening of 23 September. Deputy Prime Minister Krzysztof Gawkowski confirmed it was sabotage aimed at cutting internet access, including for Ukraine's military. Authorities have not identified who was responsible, but the act aligns with Russia's "new" doctrine of attacks, Gawkowski said. The station is now operating normally.

German authorities suspended operations at Berlin-Brandenburg airport for 45 minutes the same evening after staff reported a drone sighting, Die Zeit reported. Federal police could not confirm it. ISW assessed both incidents fit Russia's wider pattern of sabotage against European defense assets, though neither has been officially attributed to Russia.

Explore further

Russian attack puts three countries on alert as drones enter Moldova and Romania

Western intelligence warnings

A Lithuanian Defense Ministry source reported on 23 September that Russia could launch Gerbera drones from a shipping container in the Mediterranean against Spain, France, and Italy. Danish Defense Intelligence assessed on 24 September that Russia will intensify its hybrid war in coming months, including destructive cyber attacks and sabotage carrying a high risk of casualties, and that there is a low but growing risk of a limited Russian military attack on a NATO border state. It sees no indications of an outright invasion. The CIA reportedly warned Poland that Russia may sabotage underwater cables to disrupt its banking system, according to Newsweek Polska journalists.

NATO tracked and confronted Russian submersibles rehearsing deployment of a new cable-disabling weapon near Svalbard in spring 2026—no cables were damaged, but the operation demonstrated Moscow's intent, Reuters reported. Shadow fleet vessels likely served as drone-launch platforms for incursions into NATO airspace, ISW noted.

"The increasing frequency of such warnings suggests that Western intelligence agencies are picking up indicators that the Kremlin is looking to diversify its platforms and means for conducting attacks against NATO and European states and is considering conducting such attacks," ISW assessed.

ISW said it has not yet seen evidence that Russia has conducted the attacks the warnings describe.

Denmark's assessment—that a limited Russian military strike on a NATO border state could come in the coming months—suggests the boundary between hybrid provocations and military action is narrower than European policy has assumed. ISW's synthesis reframes what governments have treated as separate incidents into one campaign.

"Intentional and accidental Russian drone incursions into NATO and Moldovan airspaces are likely part of the Kremlin's efforts to normalize airspace violations by intensifying their frequency," ISW assessed.

"The increasing frequency of such warnings suggests that Western intelligence agencies are picking up indicators that the Kremlin is looking to diversify its platforms and means for conducting attacks against NATO and European states and is considering conducting such attacks," ISW assessed.

Russia has made Germany a priority espionage target, and the threat from cheap, deniable sabotage carried out by civilians paid for one-off jobs is rising, Germany's Military Counterintelligence Service (MAD) said in its 2025 annual report—the first published under a new law obliging annual disclosure. MAD blamed Germany's geostrategic position in Europe and NATO, the expansion of the Bundeswehr, and the introduction of new weapons systems. Repeated sabotage cases on German soil last year were "with high probability" Russian-run, MAD said.

For two years Berlin has publicly warned about a Kremlin campaign of arson, surveillance, and drone incursions run through cheap local proxies—mostly at press briefings and closed sessions. A January 2026 transparency law now forces that warning onto the statutory public record, sharpening the burden of an operational answer. Germany hosts NATO's logistics spine for arming Ukraine—the very hub Moscow's proxies keep aiming at.

Sabotage on the cheap

"Hybrid attacks have increased in Germany," MAD said.

The threat from "low-level agents"—residents paid small sums to plant fires or photograph military sites—has significantly increased. Recent incidents match the model: a bomb-laden drone found in August beside a Ukrainian cargo aircraft at Leipzig/Halle airport was traced this month to a Russian intelligence operative and a Belarusian petty criminal, and two Bulgarian nationals were arrested over a September suspected arson near defense-electronics firm Rohde & Schwarz in Munich. Russia's Legalresidenturen — intelligence outposts inside embassies, semi-state bodies, and press agencies—remain a central instrument of Moscow's information-gathering.

Explore further

A masked figure got into a Polish drone-parts plant—Poland now suspects a foreign spy service set the fire

Chinese drones over bases, blackmail risk for soldiers

Some drone overflights and unauthorized entries at Bundeswehr sites are attributable to Chinese intelligence, MAD said, which is also drawing on parts of the Chinese diaspora in Germany.

The service flagged travel by German soldiers to Russia and Belarus: personnel with family ties there kept visiting despite the security climate, drawing the attention of Russian and Belarusian intelligence services and creating particular exposure to blackmail and threats.

NATO fighter jets shot down a drone over Lithuania shortly after midnight on 15 September, the first time alliance aircraft have destroyed one over that country, LRT reported. The aircraft crossed in from Belarus and came down near a village in the center of the country, where military police sealed the site. Its type and operator have not been established.

What happened over Lithuania

Lithuania's National Crisis Management Center issued a yellow air alert after midnight, first for the capital and the districts around it, then for the Kaunas region further west. Italian Air Force Eurofighter Typhoons flying NATO's Baltic air policing mission from Šiauliai Air Base destroyed the drone with missile armament, Lithuania's Defense Ministry confirmed, and the army published the first images from the crash site.

The drone was over Lithuanian territory for about half an hour, crisis center head Vilmantas Vitkauskas told LRT radio. He said there is a high probability it carried an explosive charge, though the wreckage does not yet show whether it was a combat drone. Lithuania chose a yellow alert rather than red because red is used when a strike or a fall is unavoidable, he explained, and the drone was destroyed within seconds of the air defense crews reacting, over farmland with no homes nearby.

Military and civilian police are working at the site under the Shield security plan, and the area has been fenced off and guarded. President Gitanas Nausėda thanked the allied personnel for their swift response, saying that with Russia intensifying its aggression against Ukraine such readiness is vital for the region.

Whose drone it was

Nothing has been established beyond the direction it came from. The army has not commented on the drone's possible origin while the wreckage is still being collected, and the launch point also remains unreleased. Vilnius airport suspended operations during the alert, and flights from Türkiye and Iceland were delayed.

The same night as this incursion, Poland scrambled fighter jets and raised air defense readiness over Russian drone strikes on western Ukraine, and Romania did the same, with neither country recording a violation of its airspace. The day before, the Polish military recovered a drone from the Baltic Sea that its defense minister said preliminary inspection indicated was Russian and military.