Two men, a 43-year-old Ukrainian and 45-year-old Latvian, were arrested near Neuendettelsau, Bavaria on April 12, 2026, for suspected Russian espionage involving spy equipment; a Lithuanian in Detmold is also investigated for surveillance of military transports.

On April 12, 2026, German police conducted a vehicle check near Neuendettelsau, Bavaria, of a car with Latvian plates, discovering spy tools including forged IDs, a drone, GPS tracker, radios, cameras, cash, multiple phones, and SIM cards. The two men inside—a 43-year-old Ukrainian and a 45-year-old Latvian without permanent residence in Germany—were unknown to security agencies and detained on suspicion of espionage. Their phones revealed Russian-language Telegram chats, cryptocurrency payments, and surveillance reports, indicating possible reconnaissance and sabotage preparation in various European countries. These individuals are likely 'Low-Level Agents,' untrained amateurs typically recruited via messenger apps, often from Russian-speaking minorities in the EU, paid mostly in cryptocurrency. Their tasks range from propaganda to sabotage, including a Polish railway bombing in November 2025 attributed to such agents. In a related case, a Lithuanian truck driver in Detmold is under investigation for placing a covert camera at Minden station to monitor German military transports to Ukraine; surveillance and phone tapping were employed. Russian intelligence is suspected behind these operations. Separately, Sergej K., a Kazakh arrested in Berlin, allegedly provided Russian intelligence with German arms industry information and recruitment of agents. These cases highlight Moscow's shift from formal agents with diplomatic cover to low-level operatives to maintain covert espionage and sabotage capabilities post-EU expulsions of Russian spies.