In early January 2026, multiple sabotage and espionage attempts targeting German critical infrastructure and military assets were reported, including break-ins, sabotage on rail infrastructure, and thefts linked by authorities to Russian intelligence operations.

Military & Paramilitary OperationsUnconventional / ParamilitaryUse of 'little green men' (unmarked soldiers)

AggressorDefense

Summary

Between 7 and 13 January 2026, Germany experienced a series of sabotage and espionage incidents targeting critical infrastructure and military-related assets. On 7 January, unknown perpetrators broke into a substation in Wuppertal, leaving behind tools and causing damage without theft. A similar attempt was reported on 8 January at a wind energy installation in Starnberg. Two radios enabling monitoring of rail freight communications disappeared from a DB Cargo building in Oberhausen on 9 January. A freight train carrying hazardous chemicals derailed near Essen on 12 January after metal clamps had been placed on the tracks; a military supply train on the same route was diverted. German authorities maintain that most incidents are linked to Russian intelligence services employing so-called 'throwaway agents' who are recruited online for espionage and sabotage tasks, targeting military and critical infrastructure such as energy, transport, and communication systems. German federal police observed drone overflights indicative of reconnaissance near Fehmarn on 11 January, coinciding with Russian tanker movements. Security agencies have recently arrested suspected saboteurs at Hamburg's Blohm + Voss shipyard following damage attempts on the corvette Emden and other naval vessels. The German Federal Criminal Police (BKA) logged 321 sabotage cases in 2025 across various federal states, with the majority concentrated in Nordrhein-Westfalen, Niedersachsen, and Bayern. An information center 'Zeitenwende' is tasked with systematically recording these threats. A new federal counter-hybrid threat center is to be established within the domestic intelligence service to enhance response capabilities. Despite ongoing investigations, some recent sabotage attacks on naval assets remain unresolved. Official prosecutorial action exemplifies heightened vigilance and the challenge posed by covert aggressor activities within Germany.

Classification

Confidence: High

The event describes multiple hostile sabotage and espionage operations targeting German military and critical infrastructure attributed to Russian intelligence services, alongside German law enforcement and intelligence agencies’ defensive responses and establishment of counter-hybrid threat capabilities.

Source URL

https://archive.ph/lAajy

Open source

Provenance

Publisher: extension
Submitted: Feb 14, 2026, 12:22 UTC
Last updated: Nov 4, 2026, 08:35 UTC
Event time: Jan 7, 2026, 00:00 UTC

Published as a Defense Preparations signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "c3bfe9e3-2d5d-4a1d-a5df-472d194ce09e",
  "url": "https://archive.ph/lAajy",
  "source": "extension",
  "status": "approved",
  "category": "Military & Paramilitary Operations",
  "subcategory": "Unconventional / Paramilitary",
  "incident_type": "Use of 'little green men' (unmarked soldiers)",
  "country": "Germany",
  "source_reliability": "B",
  "info_credibility": "3",
  "tags": [
    "sabotage",
    "espionage",
    "russian intelligence operations",
    "critical infrastructure",
    "military",
    "Germany",
    "drone reconnaissance",
    "hybrid warfare",
    "rail transport",
    "shipyard sabotage",
    "counter-hybrid defense",
    "BKA",
    "BfV",
    "Zeitenwende"
  ],
  "nodes": [
    "Node 1: Borders",
    "Node 2: 5th Column"
  ],
  "countries": [],
  "where_text": "Land",
  "headline": null,
  "description": "Starting in early January 2026, multiple sabotage attempts and espionage actions occurred in Germany, including the break-in at a Wuppertal substation on 7 January where a door was broken and tools were left behind. The following day, a wind turbine at Starnberg was targeted by an attempted intrusion. On 9 January, two radios used for monitoring rail freight communication were stolen from DB Cargo in Oberhausen. A derailment on 12 January near Essen involved a chemical-laden freight train after metal clamps were placed on the rails; a military supplies train on the same track was rerouted. German security agencies suspect most incidents are linked to Russian intelligence using recruited 'throwaway agents' for espionage and sabotage. Drone overflights suspected as reconnaissance were observed over Fehmarn on 11 January. Recently, two suspected saboteurs employed at Hamburg’s Blohm + Voss shipyard were arrested for damaging naval ships, including the corvette Emden. The Federal Criminal Police Office reported 321 such sabotage incidents in 2025, predominantly in Nordrhein-Westfalen, Niedersachsen, and Bayern. The newly formed 'Zeitenwende' information center collects data on these hybrid threats, and a federal center against hybrid threats is planned to improve detection and response. Some sabotage incidents, such as attacks on naval ships involving cut cables and contamination of drinking water, remain unsolved. Authorities continue investigations, highlighting ongoing Russian hybrid warfare targeting German military and critical infrastructure.",
  "summary_short": "In early January 2026, multiple sabotage and espionage attempts targeting German critical infrastructure and military assets were reported, including break-ins, sabotage on rail infrastructure, and thefts linked by authorities to Russian intelligence operations.",
  "summary_extended": "Between 7 and 13 January 2026, Germany experienced a series of sabotage and espionage incidents targeting critical infrastructure and military-related assets. On 7 January, unknown perpetrators broke into a substation in Wuppertal, leaving behind tools and causing damage without theft. A similar attempt was reported on 8 January at a wind energy installation in Starnberg. Two radios enabling monitoring of rail freight communications disappeared from a DB Cargo building in Oberhausen on 9 January. A freight train carrying hazardous chemicals derailed near Essen on 12 January after metal clamps had been placed on the tracks; a military supply train on the same route was diverted. German authorities maintain that most incidents are linked to Russian intelligence services employing so-called 'throwaway agents' who are recruited online for espionage and sabotage tasks, targeting military and critical infrastructure such as energy, transport, and communication systems. German federal police observed drone overflights indicative of reconnaissance near Fehmarn on 11 January, coinciding with Russian tanker movements. Security agencies have recently arrested suspected saboteurs at Hamburg's Blohm + Voss shipyard following damage attempts on the corvette Emden and other naval vessels. The German Federal Criminal Police (BKA) logged 321 sabotage cases in 2025 across various federal states, with the majority concentrated in Nordrhein-Westfalen, Niedersachsen, and Bayern. An information center 'Zeitenwende' is tasked with systematically recording these threats. A new federal counter-hybrid threat center is to be established within the domestic intelligence service to enhance response capabilities. Despite ongoing investigations, some recent sabotage attacks on naval assets remain unresolved. Official prosecutorial action exemplifies heightened vigilance and the challenge posed by covert aggressor activities within Germany.",
  "actor_primary": "Russian intelligence services",
  "target_primary": null,
  "location_text": "Wuppertal, Starnberg, Oberhausen, Essen, Hamburg, Cologne",
  "location_region": null,
  "location_coordinates_lat": null,
  "location_coordinates_lon": null,
  "location_precision": "Approximate",
  "is_aggressor_signal": true,
  "signal_type": "DEFENSE_PREP_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The event describes multiple hostile sabotage and espionage operations targeting German military and critical infrastructure attributed to Russian intelligence services, alongside German law enforcement and intelligence agencies’ defensive responses and establishment of counter-hybrid threat capabilities.",
  "event_time_utc": "2026-01-07T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "pm24h",
  "created_at": "2026-02-14T12:22:54.391Z",
  "updated_at": "2026-11-04T08:35:32.139Z",
  "reliability_band": "strong",
  "location_precision_band": "approximate",
  "time_precision_band": "within_24h",
  "severity_band": "moderate",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}

Public assessmentReliability: StrongSeverity: ModerateAttribution: HighSingle sourceTime: Same dayLocation: Approximate

Source reliability

Info credibility

Event time

Jan 7, 2026, 00:00 UTC

Event time confidence

pm24h

Location

Wuppertal, Starnberg, Oberhausen, Essen, Hamburg, Cologne

Primary actor

Russian intelligence services

Country

Germany

Tags

sabotage, espionage, russian intelligence operations, critical infrastructure, military, Germany, drone reconnaissance, hybrid warfare, rail transport, shipyard sabotage, counter-hybrid defense, BKA, BfV, Zeitenwende

Nodes

Node 1: Borders, Node 2: 5th Column

Loading signal...

{ "id": "c3bfe9e3-2d5d-4a1d-a5df-472d194ce09e", "url": "https://archive.ph/lAajy", "source": "extension", "status": "approved", "category": "Military & Paramilitary Operations", "subcategory": "Unconventional / Paramilitary", "incident_type": "Use of 'little green men' (unmarked soldiers)", "country": "Germany", "source_reliability": "B", "info_credibility": "3", "tags": [ "sabotage", "espionage", "russian intelligence operations", "critical infrastructure", "military", "Germany", "drone reconnaissance", "hybrid warfare", "rail transport", "shipyard sabotage", "counter-hybrid defense", "BKA", "BfV", "Zeitenwende" ], "nodes": [ "Node 1: Borders", "Node 2: 5th Column" ], "countries": [], "where_text": "Land", "headline": null, "description": "Starting in early January 2026, multiple sabotage attempts and espionage actions occurred in Germany, including the break-in at a Wuppertal substation on 7 January where a door was broken and tools were left behind. The following day, a wind turbine at Starnberg was targeted by an attempted intrusion. On 9 January, two radios used for monitoring rail freight communication were stolen from DB Cargo in Oberhausen. A derailment on 12 January near Essen involved a chemical-laden freight train after metal clamps were placed on the rails; a military supplies train on the same track was rerouted. German security agencies suspect most incidents are linked to Russian intelligence using recruited 'throwaway agents' for espionage and sabotage. Drone overflights suspected as reconnaissance were observed over Fehmarn on 11 January. Recently, two suspected saboteurs employed at Hamburg’s Blohm + Voss shipyard were arrested for damaging naval ships, including the corvette Emden. The Federal Criminal Police Office reported 321 such sabotage incidents in 2025, predominantly in Nordrhein-Westfalen, Niedersachsen, and Bayern. The newly formed 'Zeitenwende' information center collects data on these hybrid threats, and a federal center against hybrid threats is planned to improve detection and response. Some sabotage incidents, such as attacks on naval ships involving cut cables and contamination of drinking water, remain unsolved. Authorities continue investigations, highlighting ongoing Russian hybrid warfare targeting German military and critical infrastructure.", "summary_short": "In early January 2026, multiple sabotage and espionage attempts targeting German critical infrastructure and military assets were reported, including break-ins, sabotage on rail infrastructure, and thefts linked by authorities to Russian intelligence operations.", "summary_extended": "Between 7 and 13 January 2026, Germany experienced a series of sabotage and espionage incidents targeting critical infrastructure and military-related assets. On 7 January, unknown perpetrators broke into a substation in Wuppertal, leaving behind tools and causing damage without theft. A similar attempt was reported on 8 January at a wind energy installation in Starnberg. Two radios enabling monitoring of rail freight communications disappeared from a DB Cargo building in Oberhausen on 9 January. A freight train carrying hazardous chemicals derailed near Essen on 12 January after metal clamps had been placed on the tracks; a military supply train on the same route was diverted. German authorities maintain that most incidents are linked to Russian intelligence services employing so-called 'throwaway agents' who are recruited online for espionage and sabotage tasks, targeting military and critical infrastructure such as energy, transport, and communication systems. German federal police observed drone overflights indicative of reconnaissance near Fehmarn on 11 January, coinciding with Russian tanker movements. Security agencies have recently arrested suspected saboteurs at Hamburg's Blohm + Voss shipyard following damage attempts on the corvette Emden and other naval vessels. The German Federal Criminal Police (BKA) logged 321 sabotage cases in 2025 across various federal states, with the majority concentrated in Nordrhein-Westfalen, Niedersachsen, and Bayern. An information center 'Zeitenwende' is tasked with systematically recording these threats. A new federal counter-hybrid threat center is to be established within the domestic intelligence service to enhance response capabilities. Despite ongoing investigations, some recent sabotage attacks on naval assets remain unresolved. Official prosecutorial action exemplifies heightened vigilance and the challenge posed by covert aggressor activities within Germany.", "actor_primary": "Russian intelligence services", "target_primary": null, "location_text": "Wuppertal, Starnberg, Oberhausen, Essen, Hamburg, Cologne", "location_region": null, "location_coordinates_lat": null, "location_coordinates_lon": null, "location_precision": "Approximate", "is_aggressor_signal": true, "signal_type": "DEFENSE_PREP_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The event describes multiple hostile sabotage and espionage operations targeting German military and critical infrastructure attributed to Russian intelligence services, alongside German law enforcement and intelligence agencies’ defensive responses and establishment of counter-hybrid threat capabilities.", "event_time_utc": "2026-01-07T00:00:00.000Z", "end_time_utc": null, "event_time_confidence": "pm24h", "created_at": "2026-02-14T12:22:54.391Z", "updated_at": "2026-11-04T08:35:32.139Z", "reliability_band": "strong", "location_precision_band": "approximate", "time_precision_band": "within_24h", "severity_band": "moderate", "attribution_confidence_band": "high", "attribution_basis": "single_source" }