European Intelligence Reports on Russian Assassination and Sabotage Plots
European Intelligence Reports on Russian Assassination and Sabotage Plots
For months, European intelligence agencies have been sounding the alarm about a resurgence of Russian state-sponsored assassination plots, sabotage, and hybrid warfare operations across the continent. Germany has emerged as the primary focal point of these covert activities. From hidden weapons caches in Berlin forests to explosive drones targeting airports, the evidence points to a systematic campaign aimed at destabilizing European allies and undermining support for Ukraine. This blog presents the verified facts currently available from official sources.
In October 2025, German security services made a chilling discovery in a forest on the outskirts of Berlin. Hidden among the trees was a weapons cache containing two handguns and ammunition. German intelligence officials have since assessed that these weapons were intended for carrying out assassinations on behalf of Russian intelligence services. The cache was placed under surveillance after the weapons were disabled, but no one was seen approaching the site.
Authorities later arrested a suspect in Romania in connection with the weapons. German Interior Minister Alexander Dobrindt described the individual as a “low-level agent” who had no knowledge of the broader chain of command. The same suspect is also being held in connection with planned parcel bomb attacks in Romania. Reports indicate that potential targets included executives of defense industry companies, exiled Russian opposition activists, and prominent supporters of Ukraine.
On the night of August 4–5, 2026, an explosive-laden drone was discovered near a Ukrainian cargo plane at Leipzig/Halle Airport. A second drone with explosives was later found on a nearby field. The incident prompted an immediate security lockdown and a high-level investigation. Germany’s federal government officially blamed Russia for the attack, describing it as a “dangerous” attempt to “cause great damage” to German infrastructure and its support for Ukraine. Investigators traced the attack to so-called “disposable agents” (Wegwerfagenten) operating under the direction of a Russian intelligence service.
In 2024, a CNN report revealed that U.S. intelligence had successfully foiled a Russian plot to assassinate Armin Papperger, the CEO of Germany’s largest arms company, Rheinmetall. Rheinmetall is a key supplier of military equipment to Ukraine, including artillery shells, tanks, and armored vehicles. The plot was part of a broader campaign by Russia to target defense industry executives across Europe who were facilitating military aid to Kyiv. The foiling of this plot underscored the high stakes and the direct threat posed to individuals supporting Ukraine’s war effort.
Top German officials have been explicit in their warnings. Sinan Selen, President of the Federal Office for the Protection of the Constitution (BfV), warned that Russia could carry out attacks on defense industry executives, opposition figures in exile, and supporters of Ukraine. Martin Jäger, President of the Federal Intelligence Service (BND), told lawmakers in October that Russia is prepared to test European borders and could escalate tensions into a “hot confrontation” at any time.
German MP Roderich Kiesewetter, a former Bundeswehr colonel, warned the public: “We will probably see announcements about the killings of high representatives of our armaments industry. We will experience an increase of state terrorism on German soil.” His sentiments were echoed by former British Defence Minister Tobias Ellwood, who warned that a new “Novichok-style” poisoning or assassination attempt in the West is “only a matter of time.”
European security officials describe a deliberate pattern of Russian “hybrid warfare”—hostile acts that fall short of direct military confrontation but are designed to destabilize and intimidate. Suspected Russian sabotage has targeted energy infrastructure, airports, defense facilities, and government IT systems across Germany and other European nations. A senior NATO official told the BBC that Russia is “engaging in aggressive covert operations across Europe—involving sabotage, arson and assassination plots—aimed at weakening public support for Ukraine.”
According to intelligence reports, the GRU (Russian military intelligence) is actively recruiting disposable operatives, often referred to as “mules,” through Telegram channels. These operatives are paid in cryptocurrency to carry out low-level logistical tasks—such as hiding weapons, transporting materials, or scouting locations—while maintaining plausible deniability for the Russian state. This decentralized recruitment model makes it increasingly difficult for European law enforcement to trace operations back to their originators.
— Roderich Kiesewetter, German MP and former Bundeswehr colonel.
Key Facts Summary
| Category | Details |
|---|---|
| Weapons Cache | Two handguns and ammunition found in Berlin woods (October 2025); linked to Russian intelligence. |
| Suspect Arrested | Arrested in Romania; described as a “low-level agent” with no knowledge of the command chain; also linked to parcel bomb plots in Romania. |
| Drone Attack | Explosive-laden drones at Leipzig/Halle airport near a Ukrainian cargo plane (August 2026); Germany officially blames Russia. |
| Assassination Plot (2024) | U.S. intelligence foiled a Russian plot to kill Rheinmetall CEO Armin Papperger. |
| Intelligence Warnings | BfV President Sinan Selen and BND President Martin Jäger warn of Russian assassination plans in Germany. |
| Primary Targets | Defense executives, exiled Russian opposition activists, and Ukrainian supporters. |
| Tactics | “Disposable agents” recruited via Telegram; paid in cryptocurrency; use of covert sabotage and arson. |
| Political Warnings | German MP Kiesewetter warns of “state terrorism” on German soil; UK’s Ellwood warns of “Novichok-style” attacks. |
