EMET NEWS PRESS

Situation Assessment I: 

Documented Threat Picture

The Federal Office for the Protection of the Constitution designates the security and defence sector as a target surface for Russian state entities and for actors operating on their behalf. According to the Office, there is an elevated probability that affected companies will be subjected to espionage or impaired by acts of sabotage. Depending on how the war develops, targeted attacks against individual employees, particularly senior executives, cannot be ruled out.

As an indicator of Russian target prioritisation, the BfV points to a publication by the Russian Ministry of Defence from mid-April 2026. The ministry listed 21 European companies with location details which, according to the Russian account, produce drones and drone components for Ukraine. The list covers production sites in Germany, the United Kingdom, Poland, the Czech Republic, Italy, Spain, Denmark, Lithuania, Latvia, the Netherlands, Turkey and Israel. Moscow described the host states of these companies as the "strategic rear" of Ukraine.

According to research by CORRECTIV, the list includes three German addresses: the two Munich-based drone producers Airlogix and Auterion and the Hanau engine manufacturer 3W-Modellmotoren. The deputy chairman of Russia's Security Council, Dmitry Medvedev, subsequently stated on X that the publication should be understood as a "list of potential targets for the Russian armed forces". The Czech foreign ministry summoned the Russian ambassador. This constitutes a publicly documented Russian targeting statement against European defence production sites that names German businesses.

The Federal Office additionally places Russian phishing activity via the Signal messenger service, suspected agent activity and covert technology procurement within the threat picture. It further cites acts of sabotage against Polish railways as evidence that the military logistics chain supplying Ukraine constitutes a priority target of Russian espionage and sabotage.

Situation Assessment II: Operational Significance

The publication marks a qualitative expansion of German economic-security communication. Earlier BfV advisories addressed sabotage threats to companies, infrastructure and supply chains. The new advisory moves the personal security of exposed employees to the foreground and extends the scope of consideration to their immediate living and movement environment.

A documented precedent exists for this expansion. CNN reported in July 2024 that US intelligence agencies had uncovered Russian plans in early 2024 to assassinate Rheinmetall chief executive Armin Papperger and had informed the German government; German security authorities then disrupted the plan. The Kremlin rejected the account. Papperger has since been under enhanced police protection. According to the sources cited by CNN, this case was part of a series of Russian plans against senior personnel of European defence companies.

The mere reconnaissance of residences, travel movements and security routines generates pressure and creates the preconditions for subsequent influence or intimidation measures. The concrete probability of an attack against any individual company or person remains case-dependent and cannot be quantified from the public warning.

Defence Companies as Operational Target Systems

Russia's interest in European defence companies follows several objectives operating in parallel. Direct intelligence collection focuses on production capacities, delivery schedules and technical performance data. Information on bottlenecks and irreplaceable key components frequently carries higher operational value than individual design documents.

Attacks on a specialised supplier, a logistics company or corporate information technology produce the same delaying effect as access to final assembly and require less effort. Most exposed are structures whose failure cannot be compensated at short notice by alternative providers. Employees with access to sensitive development and procurement data can additionally be worked through digital approaches and elicitation in conversation.

Documented Sabotage Cases in Germany

The Federal Prosecutor General at the Federal Court of Justice announced on 18 April 2024 the arrest of the German-Russian nationals Dieter S. and Alexander J. in Bayreuth and Heinersreuth. According to the authority, Dieter S. had been in contact since October 2023 with a person linked to a Russian intelligence service and declared himself willing to commit explosive and arson attacks on militarily used infrastructure and industrial sites in Germany. The declared objective was to undermine German military assistance to Ukraine.

In preparation, the accused collected information on potential attack targets, including facilities of the US armed forces. The Grafenwöhr training area, where Ukrainian soldiers are also trained, was reconnoitred and photographed on site. According to the prosecution, the surveyed objects further included a railway line used for military transports and a defence company in the Bayreuth area. The case demonstrates that reconnaissance against industrial sites in Germany was already under way in 2023 and 2024.

On 20 July 2024, a parcel containing an incendiary device ignited at the Leipzig air freight hub shortly before it was to be loaded onto a DHL cargo aircraft bound for the United Kingdom. The Federal Prosecutor General took over the investigation on suspicion of attempted aggravated arson. In late August 2024, the BfV and the Federal Criminal Police Office circulated an advisory to aviation and logistics companies stating that the unconventional incendiary devices had been dispatched deliberately in order to damage freight service providers and further logistics infrastructure in Western states; all parcels identified to that point had contained electrical items and containers holding liquids, and the shipping costs stood in regular disproportion to the declared value of the goods. The word Russia did not appear in that notice. In September 2025, Lithuania's prosecutor general's office and criminal police stated that the parcel detonations of 2024 had been organised and coordinated by Russian citizens linked to Russian military intelligence. Four consignments containing thermite devices with timers, concealed in massage cushions and cosmetics tubes, were posted in Vilnius on 19 July 2024; fifteen people were charged.

For the fire at a Berlin facility of the defence company Diehl in May 2024, no official attribution exists to date. The federal government referred to ongoing investigations and commented neither on this case nor on the Leipzig parcel fire. The incident remains unresolved and contributes to the threat assessment only as an open examination case.

Open-Source Information as a Reconnaissance Basis

Company websites, career networks and social media supply a substantial share of the data required for initial target analysis. Functions, responsibilities and project affiliations can be reconstructed from them without covert intelligence means. Trade fair appearances and job postings additionally reveal new production lines and technologies in use.

A detailed movement and relationship picture emerges once official details are combined with private data such as travel announcements or publicly recognisable routines. The BfV warns in particular of access to mobile devices and communications data during foreign travel. A compromised device opens access to corporate contacts, authentication procedures and internal communication structures.

Cyber Operations and Physical Preparation

In May 2025, the Federal Office for the Protection of the Constitution, the Federal Intelligence Service and the Federal Office for Information Security attributed cyber operations against Western logistics and technology companies to the Russian GRU unit 26165 and the associated group APT28. A focus lay on companies involved in aid deliveries for Ukraine.

Information obtained from internal systems on access controls, delivery windows and emergency procedures increases the prospects of success for subsequent physical operations. Conversely, physically placed cameras or manipulated devices supplement digital reconnaissance. Cyber access, espionage and sabotage operate within this targeting process as combinable means.

Proxies and Low-Threshold Recruitment

Since the turn of 2023/2024, the BfV has observed intensified recruitment of so-called low-level agents by Russian intelligence services and other state entities. Recruitment frequently takes place via social media and messenger services; those recruited receive limited assignments and remain outside permanent intelligence structures.

For reconnaissance and property-damage assignments, this model offers the principal rapid replaceability, low training requirements and hindered attribution to a state service. In return, the risk of unprofessional execution and premature detection rises, as the course of the Leipzig parcel case and the subsequent charges demonstrate.

Against the defence industry, such proxies are suited above all to photographic reconnaissance, the observation of access routes and low-threshold disruption. More complex operations require additional technical preparation and more professional direction.

Technology Procurement and Circumvention Networks

Covert procurement of Western military technology remains a core Russian interest alongside espionage and sabotage. Export controls and sanctions raise the effort required but continue to permit the use of intermediaries, front companies and supply routes through third countries.

For German companies this interest operates in two directions. Products and components can reach Russian armament programmes through concealed business relationships; employees with technical expertise are approached where the procurement of complete systems fails. Particularly exposed are goods with dual-use characteristics whose civilian application can be plausibly presented.

Left-Wing Extremist Disruption

Alongside Russian activity, the BfV advisory records a particularly high left-wing extremist mobilisation potential in the field of anti-militarism. The Federal Office assesses further actions against defence companies and military deliveries as possible, in particular with the aim of preventing exports to Israel.

Actor interests, target selection and operational direction differ fundamentally between Russian-directed operations and left-wing extremist actions. Overlaps arise at the level of the companies, sites and transport routes affected. Counter-espionage geared to professional intelligence services does not, on the record, capture spontaneous blockades or politically motivated property damage.

Intelligence Assessment

The security advisory assigns the German defence industry to Ukraine's operational support space. Production sites, supply chains and responsible individuals appear from the Russian perspective as elements of Western military endurance and thus as militarily relevant targets.

With high confidence, Russian services and commissioned actors will continue their reconnaissance against German defence and logistics companies. The Bayreuth case documents object reconnaissance on German territory, the Leipzig parcel case documents an executed sabotage attempt against the logistics chain, and the attribution of May 2025 documents parallel cyber activity against the same target category.

With medium confidence, publicly named companies and exposed executives are subject to elevated individual risk. The Russian site list of April 2026 operates simultaneously as psychological intimidation, propagandistic marking and target development. An imminent intent to attack the German addresses named cannot be derived from it.

The decisive early indicators are intensified digital approaches to employees, repeated reconnaissance in the vicinity of sites and unusual enquiries concerning delivery or production data. Added to these are suspicious travel incidents, manipulation of technical equipment and procurement enquiries through newly founded intermediary companies. The threat will rise further if Germany assumes additional key roles in the production and delivery of long-range weapon systems. A reliable decline would only be readable from demonstrably decreasing Russian activity against European support structures, not from political negotiations or temporary ceasefires.

Glossary

APT28
Russian cyber group attributed by Western security authorities to GRU unit 26165, also known under designations such as Fancy Bear or Forest Blizzard.

Dual-use
Goods, software or technologies capable of both civilian and military application and therefore potentially subject to specific export controls.

GRU
Russian military intelligence service whose units are held responsible for, among other activities, military reconnaissance and cyber operations.

Low-level agents
Persons recruited at short notice, frequently through digital communication channels, who carry out limited reconnaissance, sabotage or propaganda assignments.

Proxy
Person or organisation acting in the interest of a state or non-state principal without formally appearing as its member.

Signal
Encrypted messenger service which, alongside legitimate communication, can be misused as an access channel for targeted deception and phishing attacks.

Strategic rear
Russian formula for states whose territory, by Moscow's reading, is drawn into the war space on account of armament production for Ukraine.

Thermite
Metal powder mixture that burns at very high temperature and is difficult to extinguish, used in the parcel devices of July 2024.

Index of Persons

Dmitry Medvedev
Deputy chairman of the Russian Security Council and former president, who publicly described the defence ministry's site list as a target list of the Russian armed forces.

Armin Papperger
Chief executive of the defence group Rheinmetall, against whom, according to CNN reporting, Russian assassination plans were uncovered in early 2024 and who has since been under enhanced police protection.

References

Bundesamt für Verfassungsschutz
Sicherheitshinweis für die Wirtschaft: Sicherheits- und Verteidigungsbranche als Zielfläche
23 July 2026
verfassungsschutz.de/SharedDocs/kurzmeldungen/DE/2026/2026-07-23-sicherheitshinweis-fuer-die-wirtschaft.html

Bundesamt für Verfassungsschutz
Gemeinsamer Sicherheitshinweis zu Cyberaktivitäten der russischen GRU-Einheit 26165
21 May 2025
verfassungsschutz.de/SharedDocs/pressemitteilungen/DE/2025/pressemitteilung-2025-05-21-jcsa.html

Bundesamt für Verfassungsschutz
Sabotage stoppen – Ihr Hinweis zählt
30 January 2025
verfassungsschutz.de/SharedDocs/kurzmeldungen/DE/2025/2025-01-30-sabotage-stoppen.html

Bundesamt für Verfassungsschutz
Sicherheitshinweis für die Wirtschaft: Schutz vor Sabotage, Nr. 2
26 July 2024
verfassungsschutz.de/SharedDocs/kurzmeldungen/DE/2024/2024-07-26-sicherheitshinweis-schutz-vor-sabotage.html

Bundesamt für Verfassungsschutz
Spionage, Cyberangriffe und sonstige sicherheitsgefährdende oder geheimdienstliche Aktivitäten für eine fremde Macht
Retrieved: 24 July 2026
verfassungsschutz.de/DE/verfassungsschutz/der-bericht/vsb-spionageabwehr/vsb-spionageabwehr-node.html

CORRECTIV
Drohnen-Start-ups in Deutschland im Visier Russlands – Verfassungsschutz warnt
16 April 2026
correctiv.org/hybride-kriegsfuehrung/2026/04/16/drohnen-start-ups-in-deutschland-im-visier-russlands-verfassungsschutz-warnt/

Der Tagesspiegel
Drohnenlieferungen an die Ukraine: Russland veröffentlicht Standorte europäischer Rüstungsfirmen
16 April 2026
tagesspiegel.de/internationales/drohnenlieferungen-an-ukraine-russland-veroffentlicht-standorte-europaischer-rustungsfirmen-15482805.html

CNN
US and Germany foiled Russian plot to assassinate CEO of arms manufacturer sending weapons to Ukraine
11 July 2024
cnn.com/2024/07/11/politics/us-germany-foiled-russian-assassination-plot/index.html

CNN
2024 parcel blasts in Europe organized by Russians with intelligence ties, Lithuania says
17 September 2025
edition.cnn.com/2025/09/17/europe/russia-dhl-bombs-lithuania-latam-intl

ZDF
Russische Sabotage? Warnung vor Brandsätzen in Luftfracht
30 August 2024
zdf.de/nachrichten/politik/ausland/dhl-paket-brand-russland-moegliche-sabotage-100.html

Nürnberger Nachrichten
War Grafenwöhr ein Ziel? Nach Festnahme in Bayreuth: Anklage gegen mutmaßlichen russischen Spion
October 2024
nn.de/region/war-grafenwohr-ein-ziel-nach-festnahme-in-bayreuth-anklage-gegen-mutmasslichen-russischen-spion-1.14466992