German industry expects Russian sabotage against the country’s companies to persist and take more forms, the deputy head of the Federation of German Industries (BDI) told Handelsblatt. His warning follows alarms from Germany’s intelligence services, which describe the country as a main target of Russia’s covert campaign in Europe.

Russia keeps striking Ukrainian cities and power plants every day while trying to weaken the European support that keeps Ukraine fighting. Germany is home to arms makers producing with and for Ukraine, so pressure on its companies targets the supply behind Ukraine’s defense.

Industry expects attacks to last and change form

The warning came from Holger Lösch, the BDI’s deputy managing director.

“German industry is preparing for the threat to persist and for attack methods to become more varied,” he told Handelsblatt. “Companies don’t end up in the crosshairs by chance,” he added.

Russian influence and sabotage operations are no longer an abstract scenario, and companies, critical infrastructure, and defense supply chains are already among their targets, Lösch said. Companies now receive more threat warnings, and their cooperation with the authorities has improved significantly, he noted. “What is still missing are joint procedures to quickly derive concrete measures from warnings,” Lösch said, calling the protection of the economy a cornerstone of national security.

German intelligence describes a Russian shadow war

The warning comes a week after a public hearing of the intelligence oversight panel of the Bundestag, Germany’s parliament, on 5 October. There, Martin Jäger, head of Germany’s Federal Intelligence Service (BND), said Russia was waging a shadow war against Germany. “Germany has become a main obstacle to Russian hegemonic power projection in Europe and thus a target of Russian action,” Jäger said. “The danger of attacks against targets in Germany remains real and present,” he warned.

Sinan Selen, head of the Federal Office for the Protection of the Constitution (BfV), Germany’s domestic intelligence agency, told the same hearing that Russia was showing a readiness for sabotage and killings.

German Chancellor Friedrich Merz said on 1 October that Germany was preparing for further hybrid attacks, “including serious ones,” and would respond “quickly and very clearly,” as it did after the drone attack at Leipzig airport.

Drone bombs, arson, and paid saboteurs on German soil

In August, a drone carrying Semtex explosives hit the wing of a Ukrainian An-124 cargo plane at Leipzig/Halle Airport but did not explode. Germany blamed Russia on 1 September, and German Foreign Minister Johann Wadephul said Germany was not at war with Russia but was a “target of war.”

German authorities suspect Russian intelligence of commissioning an arson attack near two Munich defense firms, and a confidential Federal Criminal Police Office (BKA) assessment counted more than 165 suspected sabotage cases in Germany between January and August. The same assessment recorded 747 suspicious drone incidents involving 1,068 drones over critical infrastructure, military sites, and defense companies.

Explore further

The throwaway agents Moscow sent after a Bavarian drone boss arming Ukraine—and how Germany stopped them

Germany’s Military Counterintelligence Service (MAD) warns that the threat from low-level agents, locals paid small sums for one-off jobs such as arson or photographing military sites, has increased significantly. European intelligence agencies also report that Russia is increasingly targeting defense company executives, including at smaller drone makers, and the BfV has advised some German firms to hire close protection.

As long as Germany keeps backing Ukraine, Russian pressure on its companies is unlikely to ease, and the gap between warnings and action that industry flagged leaves smaller firms, with fewer resources for security, the most exposed.

Montenegro has ordered the expulsion of Mikhail Zvynchuk, head of the pro-Kremlin military information network Rybar, and four other Russian citizens over national security concerns following a security operation targeting suspected Russian hybrid influence activities, Vijesti reported on 9 October.

Zvynchuk is the founder and head of Rybar, a prominent Russian military-focused information network known for its Telegram channels covering Russia's war against Ukraine. The network promotes pro-Kremlin narratives and has been associated with Russian propaganda and influence operations.

Montenegrin police announced on 9 October that the five Russians had their residence rights revoked and were ordered to leave the country on national and internal security grounds. 

Montenegro investigates suspected Russian hybrid activity

The operation involved Montenegro's police and National Security Agency (ANB), which seized drones, high-resolution recording equipment, cameras, and several mobile phones for further examination, according to Vijesti.

According to Montenegrin authorities, the five had arrived in the country less than two days before the operation. The investigation is being conducted with support from international partners.

Montenegrin police identified the five Russian citizens as Zvynchuk, his wife Valeria Zvynchuk, Sergei Belous, Pavel Lekatorchuk, and Kira Doroshenko. Authorities said the case had been referred to prosecutors in Podgorica and Kotor.

The European Union has sanctioned Zvynchuk over activities that undermine or threaten Ukraine's territorial integrity, sovereignty, and independence. He has also been sanctioned by the United Kingdom, Switzerland, Australia, and Ukraine, according to Vijesti.

Suspected influence operation targeting EU integration

Vijesti reported, citing security sources, that Montenegrin authorities suspected the group of planning a documentary intended to undermine public support for the country's European integration.

According to the outlet, the planned material would portray Montenegro's expected alignment of its visa policy with EU standards as a politically imposed measure that threatens tourism, economic stability, and national interests.

Security services had monitored the group's arrival before carrying out the operation in Risan, in the Bay of Kotor area, Vijesti reported. The equipment seized from the group will undergo expert analysis to establish its intended purpose and use in Montenegro.

Medvedev threatens imprisoning “European and American idiots” for prisoner exchanges

Former Russian President Dmitry Medvedev responded to the operation by suggesting Moscow might need to expand its pool of prisoners to exchange for Europeans and Americans to secure Zvynchuk's return.

“We will probably have to replenish our pool of prisoners for exchange with European and American idiots,” Medvedev said, according to Vijesti.

Montenegro, a NATO member and EU candidate, has aligned itself with EU sanctions against Russia following Moscow's full-scale invasion of Ukraine in 2022. The expulsion comes amid broader European concerns over Russian intelligence activity, propaganda, and other forms of hybrid interference.