In September, German investigators concluded that Russian military intelligence orchestrated an arson attack at a Munich construction site near defense and tech firms Rohde & Schwarz and Helsing, utilizing two Bulgarian citizens recruited via Telegram to disrupt military supply routes to Ukraine.
The Munich Arson Attempt and the Shadow of Russian Intelligence
The incident unfolded on the night of September 3 in the eastern district of Munich. Two incendiary devices were thrown from an automobile into a construction site situated near the headquarters of technology and defense companies, including drone manufacturer Helsing, which supplies equipment to the Armed Forces of Ukraine. According to findings published by the Frankfurter Allgemeine Zeitung (FAZ), security authorities determined that the operation was masterminded by Russia’s military intelligence agency, the GRU.
Quick reactions from emergency responders ensured the resulting fire was extinguished swiftly, while the second incendiary device was successfully neutralized. German authorities detained a man and a woman, both Bulgarian nationals, on suspicion of executing the attack. Security sources cited by FAZ indicate that the suspects belong to a GRU group operating out of Slovakia.
How the GRU Rebuilt Its European Network Through Telegram
When Russia launched its full-scale invasion of Ukraine, European Union member states expelled hundreds of Russian intelligence officers operating under diplomatic cover. Direct operations by career GRU personnel became complex or excessively risky, prompting the agency to recruit people through digital channels like Telegram.
Recruits often lack special training and are typically paid sums in cryptocurrency. The network relies on a mix of pro-Russian sympathizers, petty criminals, former members of Russian mercenary groups, and individuals seeking fast cash. Investigators note that the organizer behind the Munich attempt is believed to be the same as that of earlier sabotage operations, including a drone attack targeting the Leipzig airport in August.
| Target / Event | Date / Period | Method Used | Attributed Intelligence Source |
|---|---|---|---|
| Leipzig Airport Drone Attack | August | Drones | Russian GRU |
| Munich Construction Site Arson | September 3 | Incendiary Devices | Russian GRU via Telegram-recruited operatives |
| Wider European Supply Routes | Ongoing | Explosives, Arson, Weapons | Coordinated GRU proxy network |
Berlin Responds with Consular Closures and New Sanctions
In response to the Leipzig airport attack and subsequent infrastructure threats, the German government ordered the closure of the Russian consulate in Bonn. Berlin is actively spearheading efforts within the European Union to broaden sanctions against Moscow.
German Interior Minister Alexander Dobrindt announced that Germany has formally decided to terminate the agreement regarding the “Russian House” in Berlin, introduce entry controls for Russian nationals, and increase pressure on the shadow fleet. He added that this is a Russian hybrid operation in Europe, behind which stand state structures.
German Foreign Minister Johann Wadephulis characterized these incidents as part of aggressive hybrid actions against Europe. He emphasized that these actions fit into a long sequence of destabilization, disinformation, threats, sabotage, and aggression attempts against Europe.
Stiffening the Resilience of European Defense Supply Chains
The primary objective behind the GRU’s cell network is to disrupt military supply lines feeding Ukraine and coerce Germany and other European nations into reducing or stopping their military support for Kyiv.
In the wake of these security breaches, Berlin is moving to expand its watchlists of individuals linked to hybrid threats and will propose new EU-wide sanctions targeting Russian citizens implicated in hybrid attacks.
What steps should European capitals take next to safeguard critical defense infrastructure without compromising open democratic societies? Let us know your thoughts below.
