Germany: The Enemy in Your Own Country

Russia can't bomb the factories arming Ukraine, so it goes after the will behind them: a 50,000-account bot network, Kremlin money inside the AfD, and Germans recruited by phone to spy and set fires.

What happened

German officers stopped two men near the Serbian-Hungarian border in early July, carrying an explosive device and, according to t-online, headed for a German arms plant that supplies Ukraine. Interior Minister Alexander Dobrindt described the file as attack planning "in the area of an explosives attack" with a "target location Germany." Neither suspect was a career intelligence officer. German security services have a word for the type, "Wegwerf-Agenten", throwaway agents, people recruited online for a few hundred euros and dropped after a single job.

That arrest sits at one end of a campaign that runs at once through Germany's social-media feeds, one of its political parties, and its own citizens. Moscow cannot reach the factories arming Ukraine with missiles, so it works the one target still inside its range, German willingness to keep paying for the war. The most effective parts of the effort rely on Germans rather than Russians, from party figures who took Kremlin-linked money to citizens hired through messaging apps to photograph military sites and start fires.

The 50,000 accounts that clock off on Russian holidays

In a six-week window from mid-December 2023 to late January 2024, analysts working for Germany's Federal Foreign Office identified more than 50,000 fake accounts on X posting over 1.8 million automated German-language messages, the ministry said in a later technical report. The first disclosure, reported by Der Spiegel, put it at more than 50,000 accounts and over a million German tweets in the month to January 20. At peak the network pushed more than 100,000 posts a day, better than one per second, a volume the ministry attributed to heavy automation.

In the earlier data, the accounts posted hundreds of times each weekday and fell silent on weekends and on Russian public holidays, among them February 23 and May 9, the Foreign Office found. The network kept the Russian state calendar, not the German one.

Meta first tied the campaign, known as Doppelgänger, to two Russian firms, the Social Design Agency and Structura. The European Union sanctioned both in July 2023, and the US Treasury followed in March 2024, concluding the pair acted "on behalf of the Russian Presidential Administration." The German output cloned nine real outlets, among them Spiegel, Süddeutsche Zeitung and Bild, on lookalike domains, and pushed one message above the rest, that Berlin cares more for Ukraine than for its own people. One of the most-repeated lines, per the ministry's analysis, read: "I find it disappointing that the government does more for other countries than for its own citizens."

Before the February 2025 federal election, the Foreign Office counted more than 100 sleeper pseudo-news sites built to sit dormant until activated, its analyst Ralf Beste told ARD. A second operation, Storm-1516, exposed by the newsroom Correctiv, seeded AI-generated fakes through German-language sites run by a fugitive former Florida sheriff's deputy, John Mark Dougan, with financing that Correctiv linked to Russian military intelligence. One fake was a deepfake video accusing Green chancellor candidate Robert Habeck of abuse. In a physical spin-off in December 2024, four men vandalized more than 270 cars across four German states with stickers carrying Habeck's face, a false-flag paid at 100 euros per car, prosecutors said. Correctiv reported that the sites survive because spreading foreign-state disinformation is, by itself, not a crime under German law.

In the first week of July 2026, researchers at the collective Antibot4Navalny counted at least 49 fake videos and 12 forged newspaper front pages impersonating Spiegel TV, Bild and T-Online, part of a wave that Euronews and German outlets attribute to the Kremlin-linked Matryoshka network, aimed at the East-West divide before two eastern state elections in September.

Voice of Europe and the money that reached the AfD

Internal Social Design Agency documents, analyzed by the German monitoring group CeMAS, listed the campaign's German objectives as strengthening the far-right Alternative für Deutschland, promoting "fears of the future," and weakening support for Ukraine.

A joint Czech-German investigation in 2024 exposed the Prague portal Voice of Europe, financed within the network of pro-Russian Ukrainian oligarch Viktor Medvedchuk, as a Russian influence vehicle that, Transparency International Germany said, paid politicians across six countries several hundred thousand euros to erode European support for Ukraine. The German thread ran through the AfD's two lead candidates for the 2024 European elections. Petr Bystron is alleged, on the basis of a Czech intelligence wiretap reported by Der Spiegel, to have taken 20,000 euros in cash at a Prague meeting; Transparency International puts the suspected total at "at least 34,000 euros in cash and cryptocurrency." Maximilian Krah gave the portal interviews defending Moscow. Both had their immunity lifted, both remain under investigation, and neither has been convicted. Bystron denies the allegations and calls the evidence "a work of Western intelligence services," the same phrase the bots push.

Der Spiegel wrote during the campaign that the Russian disinformation effort targeted every German party except two, the AfD and the left-nationalist BSW. In October 2025 Thuringia's interior minister Georg Maier accused the AfD of using its parliamentary right of inquiry as, in his words, a "task list of the Kremlin," pointing to 47 questions in a year that mapped transport, water, energy, police IT, counter-drone systems and Bundeswehr activity. The party rejects the charge, and its Thuringia leader Björn Höcke threatened Maier with a defamation suit.

On May 2, 2025, the Federal Office for the Protection of the Constitution classified the whole AfD as a confirmed right-wing extremist organization, citing a report of roughly 1,100 pages. The party sued, the agency suspended the label, and in February 2026 the Cologne Administrative Court barred it from using that designation until the main case is decided. The AfD's federal status is now a suspected extremist case, a rank the Federal Administrative Court upheld in 2025, while three eastern chapters, in Thuringia, Saxony and Saxony-Anhalt, are already classified as proven right-wing extremist. The intelligence services trace the finding to the völkisch wing around Höcke.

Grafenwöhr and a six-year sentence

The espionage has now produced a conviction, and the spy was not an AfD member. On October 30, 2025, the Munich Higher Regional Court sentenced a German-Russian man identified as Dieter S. to six years for scouting American military sites and preparing sabotage for a Russian handler. He had fought with a Donetsk militia from 2014, reconnected in 2023 with its commander, a man the court said works for the GRU, and passed information on rail infrastructure, a Bavarian refinery, and the US Army training area at Grafenwöhr, where Ukrainian soldiers learn to run Western tanks, Stars and Stripes reported. The aim, prosecutors said, was to disrupt German military support for Ukraine. The court rejected his account that the talk had been "joking and ironic." The Berlin daily taz called him, in its headline, a Wegwerfagent.

A study by the International Centre for Counter-Terrorism of 172 people involved in Russian hybrid operations across Europe found that about 95 percent were ordinary citizens with no formal tie to Russian intelligence, and that support for Ukraine was the strongest predictor of which targets Russia chose. Recruiters screen social media, especially Telegram, approach candidates, pay a few hundred euros for a first task and more for the next, usually in cryptocurrency, then move on, the domestic intelligence service and Euronews reported. In September 2025 Germany ran a public campaign warning citizens against becoming disposable agents.

The Federal Criminal Police recorded 321 suspected cases of infrastructure sabotage in 2025, its president Holger Münch said, tying the surge to Germany's role as a Ukraine supplier. Investigators have logged around a dozen suspected attacks on Bundeswehr warships since the start of 2025, several on corvettes, according to Correctiv and a police paper cited by Welt. Internal records counted 1,955 unidentified drones over or near German military sites in 2025, with counterintelligence assessing that some of the surveillance focused on the training of Ukrainian troops. The Soufan Center logged 57 Russia-linked hybrid incidents in Germany between 2022 and 2025, more than in any other country it studied. On December 12, 2025, Berlin summoned the Russian ambassador and blamed the GRU for a 2024 cyberattack on German air-traffic control.

Why Germany, counted in euros

American military aid to Ukraine fell roughly 99 percent in 2025 while European aid rose about 67 percent, and Germany became Kyiv's second-largest arms supplier after the United States and the largest in Europe, the Kiel Institute's tracker shows. In March and April 2026 alone Germany allocated 4.2 billion euros, most of it for air defense and drones. Münch said the country "is increasingly becoming the focus of Russian sabotage and espionage" as a leading Ukraine backer, and the domestic intelligence chief Sinan Selen told parliament that Moscow treats Germany as an opponent, "sometimes as enemy number one."

Russia has no way to strike a Rheinmetall production line or the ranges at Grafenwöhr from the air. The parcel firebomb, the drone over a fence, and the cloned news site reach the same supply chain by cheaper means, and each targets the political will to keep the weapons moving.

The security firm Sekoia found the Doppelgänger flood generated almost no authentic engagement, its numbers inflated by accounts amplifying one another, and academic work on the 2025 election concluded that Russian disinformation had a limited short-term effect. The Foreign Office concedes the effect of any single post is hard to measure, and describes the logic as quantity over quality, each message reaching a small audience but multiplied across sometimes more than 100,000 a day.

What to watch

Saxony-Anhalt and Mecklenburg-Vorpommern vote in September, and the AfD leads polls in both, hoping to clear 40 percent as the Matryoshka wave runs against its rivals. Germany opened a Joint Center for Countering Hybrid Threats in June 2026, drawing in more than 40 agencies, though clandestine foreign-state disinformation remains no crime under German law, which is why the servers stay online. Dieter S. can still appeal his six-year sentence, and the investigations into Bystron and Krah have yet to reach trial. By March 2026 the federal prosecutor's office was running 20 proceedings against 23 defendants in Russia-linked espionage and sabotage, four of the investigations opened in 2025.