Berlin acknowledges that it is a key target of Russian hybrid threats. Sabotage, “disposable” agents, propaganda, missiles, and drones are forcing Germany to thoroughly review its defense.
Summary
A joint assessment by the German domestic security services and federal police paints a clear picture: Germany is at the center of a hybrid war waged primarily by Russia. Between July 2024 and June 2025, the authorities recorded 143 suspected acts of sabotage, a significant increase compared to previous years. These operations are not limited to material destruction. They combine potentially deadly attacks, disinformation operations, exploitation of the AfD, cyberattacks, use of migrants as political leverage, and fear campaigns targeting the population.
At the same time, Berlin is beginning to deploy the Arrow-3 missile defense system and is setting up a federal unit dedicated to countering drones. The challenge goes beyond technology: it is a matter of testing Germany’s ability to withstand repeated hybrid attacks without giving in to panic or political polarization. The question is no longer whether the threat exists, but whether the state and society are strong enough to deal with it in the long term.
Germany’s diagnosis of an acknowledged hybrid war
The joint report by the BfV (Constitutional Protection) and the BKA (Federal Criminal Police) marks a turning point. For the first time, the authorities have painted a comprehensive picture of hybrid threats against German territory over a continuous period from July 2024 to June 2025. The key figure is stark: 143 suspected acts of sabotage recorded in just six months, in the first half of 2025. This volume is higher than in previous years and reflects a clear increase in hostile activities.
The services no longer refer to isolated incidents, but to a structured sequence. The analysis links a series of events—fires in infrastructure, operations against industrial players, subversive actions targeting political figures—to a strategy of hybrid warfare aimed at Germany. The central idea is simple: to generate a permanent feeling of insecurity, undermine confidence in the state, and push part of public opinion towards political forces more favorable to the Russian narrative.
The report echoes the findings expressed during public hearings of the three German intelligence services. They identify Moscow as the main actor in sabotage and influence operations, even if other states or opportunistic groups sometimes take advantage of the situation. Russia appears to be the initiator, or at least the systematic “exploiter,” of numerous internal crises.
This diagnosis comes at a time when Germany is investing heavily in its defense: the budget has been increased to more than 2% of GDP, a special fund of €100 billion has been set up for the Bundeswehr, and major equipment purchases have been made. The contradiction is striking: despite this rearmament, Berlin remains vulnerable to low-cost attacks, often carried out with rudimentary but well-coordinated means. This is the whole logic of hybrid warfare: bypassing conventional forces to target political, economic, and psychological weaknesses.
The Russian method of “disposable” agents and targeted sabotage
The episode of incendiary packages sent from Lithuania illustrates the coldness of the method used. In July 2024, incendiary devices were shipped by DHL from Lithuania to the United Kingdom and Germany. Investigators believe that these devices were to be loaded onto cargo aircraft. A plane delay prevented a catastrophe: the devices caught fire in a warehouse in Leipzig, rather than in flight. The difference between a logistical scare and a massive air accident came down to a simple time difference.
German authorities refer to “single-use agents.” These operatives, often recruited via encrypted channels such as Telegram, receive limited instructions and know only a small part of the operation. Many come from criminal backgrounds, attracted by quick payments, which are sometimes modest considering the risk involved. Their profile allows them to cover their tracks: criminals, local intermediaries, and small-time operators are replacing traditional state agents.
This model can be found in other cases. The fire on a 150-meter grain conveyor at the port of Rostock in May 2025, which caused several million euros in damage, affected a key piece of infrastructure for Ukrainian grain exports. Officially, the investigation remains cautious, but the security services include the case in their overview of hybrid threats. The objective is clear: to target sensitive points in the European economy at limited operational cost.
Rheinmetall CEO Armin Papperger is cited as another potential target. His role in expanding defense industrial capabilities, particularly in favor of Ukraine—a 155 mm ammunition factory in Lithuania, armored vehicle projects on Ukrainian territory—makes him a symbolic target for Moscow. Here again, the likely method is not a spectacular attack claimed by the perpetrators, but the preparation of discreet strikes, possibly delegated to local operatives, which are difficult to link directly to Russia.
This choice of disposable agents is not only a matter of economy of means. It also aims to saturate the German security system. Each case requires months of investigation, mobilizes significant police and judicial resources, and remains legally complex due to the lack of direct evidence against a foreign state.
The hybrid toolbox: disinformation, AfD, and political pressure
Hybrid operations are not limited to arson and improvised explosive devices. The German services identify four additional broad categories: disinformation, political influence, exploitation of violent events, and shaping public debate.
There are many examples in the information sphere. Fake videos and montages circulate during election campaigns, aimed at discrediting certain parties or officials. Prank phone calls from Russian “comedians” impersonate foreign officials in order to provoke German officials into making awkward statements, which are then broadcast on social media. The case of fake calls to Angela Merkel, imitating former Ukrainian President Petro Poroshenko, illustrates this logic of media traps designed to ridicule Berlin.
Political influence also comes through more organized structures, such as the Voice of Europe platform, cited in the analysis as a funding channel for certain pro-Kremlin European politicians. The case of AfD MEP Petr Bystron, suspected of having received funds through this channel, illustrates how Moscow seeks political partners willing to repeat its narratives within Western institutions themselves.
The AfD appears several times in the background. After the deadly attack on the Magdeburg Christmas market in December 2024, Russian channels presented the party as a “positive alternative” to a government deemed incapable of ensuring security. Violent incidents thus become levers to push part of the population towards a party that is openly hostile to support for Ukraine and more accommodating towards Moscow.
This approach is far from innocent. It is part of a clear strategy: to weaken the governing parties, fracture the consensus on military aid to Kyiv, polarize the debate on immigration and security, and, ultimately, bring about the emergence of a coalition more favorable to Russian interests. Russian propaganda does not need to convince the whole country; it only needs to strengthen the political forces already in place to influence Berlin’s strategic choices.
Cyber warfare, migration flows, and fear as a key weapon
The report also highlights the rise in cyberattacks and the strategic use of migration flows. On the digital front, authorities have noted a steady increase in denial-of-service (DDoS) attacks targeting institutional websites, banks, media outlets, and even energy operators. The logic is the same: disrupt services visible to the general public, even briefly, to fuel the idea that the state no longer has full control over its networks.
Some operations target more critical infrastructure: power grids, logistics, municipal systems. Even when they fail, these attempts force the authorities to invest more in cybersecurity, while the costs for the attackers remain modest. A coordinated ransomware campaign can paralyze healthcare facilities or local governments, with a direct impact on the population.
Migration flows are another lever. The use of the Belarusian border as an artificial entry point for migrants, directed towards the eastern border of the European Union, has been documented since 2021. In this configuration, Germany finds itself at the end of the chain, receiving part of these flows. This pressure at the border serves two purposes: to weaken frontline countries such as Lithuania and Poland, and to fuel the internal debate in Germany on asylum, integration, and security.
Political scientist Herfried Münkler sums up this approach bluntly: Moscow considers German society to have a lower tolerance threshold than the Baltic states. Directly threatening Germany—through repeated nuclear threats from officials such as Dmitry Medvedev, incidents of sabotage, and cyberattacks targeting banks or ATMs—is seen as a way to generate fear and influence policy in Berlin.
The purpose of this strategy is not solely military. It is intended to erode the will to support Ukraine, limit the deployment of German military assets on NATO’s eastern flank, and perpetuate the idea that confrontation with Russia would be too dangerous for a country marked by a pacified political culture since 1945.
Germany’s response: Arrow-3, anti-drone defense, and resilience to be built
Faced with this situation, Germany is attempting to fill critical gaps. On the military front, the commissioning of the Arrow-3 missile defense system sends a strong signal. Purchased for around €3.6 billion, this system, developed by Israel and the United States, can intercept ballistic missiles at an altitude of over 100 kilometers. Its range of approximately 2,400 kilometers opens up the possibility of area defense covering not only Germany but also a large part of Central Europe.
The Schönewalde/Holzdorf base, south of Berlin, is becoming an anchor point for this long-range air defense system. Arrow-3 does not protect against all threats—low-altitude cruise missiles, slow drones, and saturation attacks remain difficult to counter—but it fills a strategic gap in the face of ballistic vectors.
At the same time, a federal drone countermeasures center is being set up. The authorities recognize that unidentified drones are increasingly flying over sensitive sites such as military bases, ports, power plants, and rail hubs. These devices can be used for reconnaissance, testing defenses, or even occasional acts of sabotage. Hence the creation of specialized units capable of detecting, jamming, and neutralizing drones, even in dense urban environments.
General André Bodemann emphasizes a key point: protection concerns not only the armed forces, but all critical infrastructure. Transportation networks, energy, drinking water, food chains, and financial systems are all potential targets. A prolonged blockage of electronic payments or ATMs would be enough to cause local panic, even without physical destruction.
The real issue behind radars, interceptors, and jammers is resilience. Germany has long lived with the idea of a secure environment, with a military threat considered remote. The current situation is different: the country is not at war in the traditional sense, but it is already part of the hybrid battlefield. The effort required of citizens—accepting disruptions, alerts, and even repeated incidents without giving in to fear—will be at least as important as investments in weapons systems.
Hybrid attacks as a political test of German resilience
The disposable agents affair, infrastructure fires, disinformation targeting elections, the rise of the AfD after terrorist attacks, cyberattacks, and migratory pressure paint a coherent picture: Moscow is testing Germany’s resilience by every means possible, except direct confrontation.
Technical responses—Arrow-3, anti-drone centers, strengthening cybersecurity—are necessary, but they will not be enough if the country remains vulnerable on the political and social front. The real Russian victory would be to gradually shift German opinion toward strategic withdrawal, reduced support for Ukraine, and a form of opportunistic neutralism.
Germany therefore faces an implicit choice: either treat Russian hybrid threats as an irritant that can be managed with ad hoc measures, or consider them as a comprehensive test of national cohesion. In the first case, each incident will be experienced as an isolated crisis, with the risk of attrition and emotional reaction. In the second, German society will have to admit that security is no longer just a matter of the skies, but also of minds, servers, and ballot boxes.
Sources
– LRT, “Germany’s in the crosshairs of Russian operations – and Moscow shows no hesitation to kill,” December 2025.
– Spiegel, draft BfV/BKA report on hybrid threats, 2025.
– Die Zeit, interview with Herfried Münkler on Germany’s vulnerability to Russia, 2025.
– Federal Ministry of Defense, communications on the acquisition and deployment of the Arrow-3 system, 2023-2025.
– AP News, dispatch on the commissioning of the first Arrow-3 components in Schönewalde/Holzdorf, December 2025.
– Army Recognition and Defense News, technical data on Arrow-3 (range, altitude, cost) and on the ESSI shield project.
– German press articles on the fire at the port of Rostock, investigations into sabotage and threats against Rheinmetall, 2024-2025.
– Analyses by European think tanks on Russian hybrid threats in Germany, 2023-2025.
Live a unique fighter jet experience