Two people suspected of preparing an act of sabotage in Germany on behalf of Russian intelligence were detained in Serbia as they attempted to cross the border into Hungary, according to a report by BILD. The German newspaper referred to the detainees as “disposable agents” who were used for individual assignments in exchange for small payments.
An explosive device was reportedly found in their possession. Authorities suspect that its intended target was a defense site in Germany linked to the country’s support for Ukraine. However, the specific facility was not publicly identified.
The arrests in Serbia took place in early June after a tip from German intelligence services and other agencies. Last week, Germany’s Federal Office for the Protection of the Constitution, the country’s domestic intelligence agency, informed other security bodies about the arrests. According to BILD, state-level interior ministries in Germany have described the matter as an “unfinished intelligence procedure.”
While presenting a report on the country’s counterintelligence work of the past year, German Interior Minister Alexander Dobrindt spoke of a foiled explosives attack targeting defense facilities. The report also noted that Germany is regularly targeted by hybrid attacks from Russia, which is attempting to “destabilize German society, undermine democratic institutions, and weaken support for Ukraine.”
BILD wrote that the foiled attack was one of the first results of the work of Germany’s new Center for Countering Hybrid Threats. The center opened in Berlin in June and is tasked with combating espionage, sabotage, disinformation, transnational repression, and state terrorism.
In October 2025, the Munich Higher Regional Court sentenced a German citizen, Dieter S., to six years in prison. He was also accused of scouting potential targets for Russian intelligence services.
This past March, a trial began in Stuttgart of three Ukrainians from Russian-occupied Mariupol. Federal prosecutors say they studied routes for sending parcels containing explosive devices on behalf of Russian intelligence.
In April, a Kazakh citizen identified as “Sergei K.” was detained in Berlin on suspicion of passing information about possible sabotage targets to Russian intelligence.
In July, the independent Russian-language outlet Vot Tak published an investigation into Telegram recruiters searching for people to carry out acts of sabotage in European Union countries. Journalists from the outlet posed as job seekers and contacted several of these recruiters. They were offered money for arson attacks and intelligence-gathering in Lithuania, Poland, Latvia, and the Czech Republic.
In one case, a recruiter offered $1,500 to set fire to a NATO military vehicle in Lithuania. Another offered $3,000 for an attack on a Ukrainian-linked facility in Poland and the same amount to burn down the office of a Ukrainian organization in Latvia. Vot Tak reported that potential recruits are sought in Telegram job chats under the guise of “easy part-time work” or “simple technical work,” before being offered illegal assignments via private messages. Those who agree are asked to provide video reports as confirmation that the tasks were carried out.
