In Germany, authorities have registered 165 suspected cases of sabotage since the beginning of 2026. They include tampering with power lines and railway tracks, as well as planned arson attacks. "One-off agents" are often used, but Moscow is suspected of being behind these incidents. This is indicated by research conducted by NDR, WDR and Süddeutsche Zeitung based on an internal analysis by Germany’s Federal Criminal Police Office (BKA), reports UNN.
Details
The confidential report, writes SZ, is 18 pages long; the first page is titled: "Situation Update: Hybrid Threats." Behind this bureaucratically awkward title lies a brief summary of events that currently dominate the news several times a week. It deals with espionage and sabotage, drone flights and cyberattacks—in short, the entire scope of the covert war being waged against Germany. The BKA analysis dates from the end of August.
According to the report, federal and state security authorities have already registered 165 suspected cases of sabotage this year, most of them in Lower Saxony, North Rhine-Westphalia and Bavaria
Germany’s Federal Criminal Police Office (BKA) defines sabotage as the "deliberate disruption of economic, scientific, military, security or political processes." This includes, for example, tampering with power lines and railway tracks, as well as planned arson attacks. According to the BKA, "critical infrastructure facilities generally face an increased risk of becoming targets of state or state-controlled actors." Last year, the authorities of the Federal Republic of Germany reportedly recorded more than 320 such cases.
Attempts at attacks and acts of sabotage have increased sharply in the country recently. According to media reports, since the beginning of the week alone, Germany has been investigating at least the fourth suspected act of sabotage.
As Der Spiegel noted on September 3, following an arson attack at a construction site in Munich, the Bavarian State Criminal Police Office (LKA) suspects an attempted attack on a defense company. Several incendiary devices were thrown onto the construction site at night. Police later arrested two people at a gas station. Whether they are connected to the attack is currently being investigated. An LKA spokesperson said they were investigating a possible political motive. The spokesperson did not specify which company was involved.
According to DW on September 4, after a suspicious object was discovered at a substation in Dormagen, located between the major German cities of Cologne and Düsseldorf, authorities are also investigating the incident as sabotage. A letter claiming responsibility was received; it also mentioned other suspicious cases—already known to the public—in the German states of North Rhine-Westphalia and Brandenburg, a spokesperson for the Cologne police said.
Moscow suspected
German security authorities assume that Russia is behind many of these events. According to the Federal Office for the Protection of the Constitution (BfV), Moscow primarily targets military facilities and critical infrastructure such as energy supplies and transport systems
For this purpose, "so-called ‘one-off agents’ are repeatedly used," the publication writes. These are people who are contacted, for example, via the Internet to spy on military transport, monitor arms industry managers or operate drones in exchange for payment. They may often not even know who is manipulating them. Some, however, act out of conviction.
Espionage
The new BKA analysis also includes 24 espionage investigations launched this year by the Office of the Federal Public Prosecutor and specialized state prosecutors’ offices—12 of them concern cyberespionage. In addition, 40 investigations are ongoing "in relevant areas of crime." Since the beginning of the year, federal and state police authorities have detected a total of 112 espionage-related offenses: more than 60 of them involved so-called security-threatening imagery, that is, the unauthorized photographing or filming of military facilities or weapons. In another 26 cases, investigators suspect espionage for the purpose of sabotage.
According to the analysis, espionage was particularly widespread in Brandenburg, where authorities recorded 23 such offenses, followed by North Rhine-Westphalia and Schleswig-Holstein with 21 offenses each, and Lower Saxony with 15.
The number of suspicious drone sightings is high
The fact that security authorities are now also investigating acts of "subversion" seems like something from the Cold War era, the publication notes. This includes actions that lead to a "reduction in Germany’s defense capabilities," as stated by the Federal Criminal Police Office (BKA). According to the analysis, Germany’s Military Counterintelligence Service (MAD), which is responsible for protecting the German armed forces, observed 19 security incidents in the armed forces this year, including acts of "demotivation," "acts of violence," and "damage to military equipment."
The number of suspicious drone sightings also remains high: from January through the end of August, 747 incidents were registered across Germany. A total of 1,068 drones were spotted over critical infrastructure facilities, military installations, and defense companies.
Approximately 1,300 drone-related incidents were recorded throughout 2025.
Only rarely were investigators able to identify the drone pilots or those behind them. However, in July, a Moldovan citizen was arrested in Bavaria for allegedly spying on the arms company KNDS with the help of a drone. Investigators believe that he was acting on behalf of Russian state agencies.
A particularly serious incident occurred in early August in Lower Saxony: drones were spotted at night over a natural gas processing plant in the Oldenburg area, the publication writes. A security guard attempted to confront the pilots. According to a police report, he spotted two people dressed in dark clothing and approached them. The suspects then slammed the guard’s head against the hood of a car, knocked him to the ground, and fled. Both were wearing balaclavas and gloves—and escaped.
Addendum
Europe notes that Russia is intensifying its so-called "gray-zone" operations against European countries supporting Ukraine. These include sabotage, arson, cyberattacks, espionage, violations of airspace by drones, and the recruitment of operatives through social media.
Among other things, as reported in Western media, Russia has launched a new wave of attacks on European arms manufacturing plants.
The Czech counterintelligence service, in particular, warned about Russia’s "one-time agents," who may attack facilities involved in aid to Ukraine.