Germany has spent recent days showcasing its new defence capabilities – unveiling a system capable of intercepting ballistic missiles and preparing to open a centre dedicated to countering drone threats. But deterrence must be strengthened on every level, experts warn.
A new joint assessment by the Federal Office for the Protection of the Constitution (BfV) and the Federal Criminal Police Office (BKA) aims to dispel any remaining scepticism among those who still fail to recognise the threat from Russia.
The document, not yet public, is due to be presented at the Conference of Interior Ministers taking place in Bremen from December 3 to 5. The weekly newspaper Spiegel obtained a draft and outlined its main findings. The 30‑page analysis details cases of disinformation, espionage, sabotage, subversion and political influence operations in Germany.
The study covers the period from July 2024 to June 2025, also examining the consequences of earlier incidents. In just the first six months of 2025, 143 suspected acts of sabotage were recorded – an upward trend.
“The central conclusion: Germany is at the heart of hybrid threats. They emanate not only from Russia, but above all from Russia,” Spiegel writes. The aim of hybrid operations is to foster a sense of insecurity and destabilise the state. The analysis suggests that various incidents that have shaken Germany form a chain of hybrid attacks either orchestrated or exploited by Russia.
A recent public hearing with all three German intelligence agencies likewise concluded that Russia is the primary actor behind sabotage and subversive activity in the country.
A textbook case involving Lithuania
Another key finding: in planning acts of sabotage, Russia shows no hesitation in taking lives. One example concerns an attack in the logistics sector with links to Lithuania.
In July 2024, incendiary devices were sent by DHL aircraft from Lithuania to the UK and Germany. A major disaster was narrowly avoided: the parcels did not make it onto the intended aircraft because it was delayed. The devices ignited in DHL’s Leipzig warehouse instead.
Investigators believe so‑called single‑use agents – individuals recruited via channels such as Telegram and given limited information – were used in Lithuania and other countries to carry out such operations.
Low‑level agents, often drawn from the criminal underworld, are suspected in other cases too – including a 2024 attempt to cast a shadow over then Vice‑Chancellor Robert Habeck and his Green Party. Hundreds of exhaust pipes were clogged with expanding foam, and cars were plastered with stickers featuring Mr Habeck’s image. These actions are seen as an attempt to influence the Bundestag election campaign.
Other incidents cited in the report include a May 2025 fire in Rostock port, which caused millions of euros in damage and prompted prosecutors to launch an investigation into anti‑state sabotage. The port is a key hub for Ukrainian grain imports and exports.
Also highlighted are previously uncovered plots targeting Armin Papperger, chief executive of defence manufacturer Rheinmetall, whose expanding operations in Ukraine are believed to have made him a target. In November, Rheinmetall also began building a new 155 mm artillery ammunition plant in Baisogala, Lithuania.
The AfD connection
Alongside kinetic operations, the assessment identifies four other categories of hybrid tools, which often overlap. Some cases predate the study period but were included due to their lasting impact.
These include information operations, such as falsified video footage shared during the Bundestag election campaign, and prank calls by Russian actors impersonating prominent figures to provoke German politicians into inappropriate statements – as happened in 2023, when a Russian satire duo posing as former Ukrainian President Petro Poroshenko called former Chancellor Angela Merkel.
The report also identifies tools of political influence, such as the pro‑Russian platform Voice of Europe, through which pro‑Kremlin members of the European Parliament were allegedly financed. AfD MEP Petr Bystron is among those investigated over suspected payments from the portal.
Security agencies also point to the instrumentalisation of violent attacks on German society for propaganda purposes. After the fatal attack at Magdeburg’s Christmas market last December, Russian channels used the incident to discredit the German government and praise the AfD as a “positive alternative”, fuelling social tension and seeking to shift Germany’s political course.
The report further notes the rise in cyber‑attacks – including DDoS attacks that temporarily disable websites – and the targeted use of migrant flows, such as those channelled from Belarus towards the EU’s eastern border, including Lithuania, with Germany as one destination.
In an interview with Tagesspiegel, political scientist Herfried Münkler stressed that Russia sees Germany as less resilient than the Baltic states:
“The Baltic countries are attacked even more frequently and brutally than we are. Germany has come into Russia’s sights because Moscow has concluded that threats against Germany can yield significant political impact. Remember Dmitry Medvedev, deputy chair of Russia’s Security Council, who repeatedly issues nuclear threats, often aimed specifically at Germany. Moscow is trying to exploit a particular German reaction – fear. And there is a political party in Germany that helps it.”
Not all high‑profile cases included
This is the first nationwide German assessment of hybrid threats. Spiegel notes that some prominent cases are not included, such as the recording of senior Bundeswehr officers discussing Taurus long‑range missiles – intercepted by Russian agents. German authorities do not classify this as a hybrid threat because Russia openly admitted responsibility.
Other cases, including unidentified drone flights over critical infrastructure, remain unresolved. Yet Chancellor Friedrich Merz (CDU) stated in October 2025 that the government suspects Russia is behind most such incidents.
Despite individual uncertainties, the broader picture is clear: since Russia’s 2022 invasion of Ukraine, the risk of hybrid attacks in Germany has increased significantly – and is likely to grow further.
Preparing to counter missiles and drones
Germany is keen to demonstrate progress in its defensive capabilities. On Wednesday, the Air Force unveiled its new Arrow‑3 missile defence system at the Holzdorf air base in Schönewalde, around 80 km south of Berlin.
The Israeli‑made system can detect and intercept incoming ballistic missiles at altitudes above 100 km, neutralising threats in the upper atmosphere and near‑space. It will be deployed at several strategic locations in the coming months and years to ensure optimal coverage, the Defence Ministry said.
At the Interior Ministers’ Conference in Bremen, a new federal police unit specialising in countering unmanned aerial vehicles was also presented. A dedicated drone‑defence centre will open within weeks.
Lieutenant General André Bodemann, of the Bundeswehr, stressed the need to strengthen defence across all fronts:
“We must prepare for attacks by ballistic and cruise missiles and drones targeting transport infrastructure and military bases, as well as our energy networks, drinking water supplies and food provision. Russia will aim to weaken our will to resist – we see this daily in Ukraine. The financial system could also be targeted. People feel unsafe when they suddenly cannot withdraw cash or pay in shops because systems have been paralysed by hackers,” he told Die Zeit.
“We are not at war, but we have long ceased to be at peace. We are already a target of hybrid attacks.”
Newsletter
Every Friday morning.
