Arson attack in Munich: Strong indications of a hybrid background
As of: September 3, 2026 • 7:46 PM
According to information from the ARD Berlin studio, there are strong indications that the arson attack near a defense company in Munich may also have been carried out on behalf of a Russian intelligence service.
Police responded quickly: the two suspects - a 38-year-old man and a 28-year-old woman, both Bulgarian nationals - were arrested at a gas station shortly after the incident. A witness had seen incendiary devices being thrown from a passing car onto the construction site and alerted the police. Officers were able to extinguish the fire quickly, and a specialist unit defused one incendiary device that had failed to ignite. The two suspects have remained in police custody since then. Several defense companies have their headquarters or branch offices in the immediate vicinity of the construction site.
According to information from the ARD Berlin studio, security authorities have strong indications that this could once again be an attack carried out by so-called "low-level-" or "throwaway-agents". This term refers to individuals hired by proxies of Russian intelligence services to carry out assignments in exchange for payment. These tasks can range from taking pictures of a defense company to the execution of sabotage operations.
Rising number of sabotage incidents since Russia’s attack on Ukraine
The German government believes that the attempted attack at Leipzig/Halle Airport, believed to have been targeted at Ukrainian Antonov cargo aircraft, was also carried out by such "low-level" or "throwaway agents". Explosive-laden drones were used in that incident. Since Russia invaded Ukraine and Germany began providing military support for Ukraine’s defense, there has been a series of sabotage incidents suspected to be the work of Russian intelligence agencies.
The arson attack in Munich does not appear to have come as a complete surprise to the police. According to information from the ARD Berlin studio, there is a link to the arrest of a 33-year-old Ukrainian national in Thuringia in early August by officers from the Thuringian and Bavarian State Offices of Criminal Investigation. As the Munich Public Prosecutor's Office announced a few days later, the man is accused of taking photographs of the premises of a defense company in Bavaria in June and forwarding them to the person who commissioned him. This is alleged to have been in preparation for a sabotage operation. The man has been in pre-trial detention since his arrest. He may well have been carrying out a similar assignment.
Several Arrests on Suspicion of Espionage
Defense industry companies are considered particularly vulnerable, especially when involved in providing military support to Ukraine. In March, the Federal Public Prosecutor ordered the arrest of two individuals: a Romanian national in Rheine, North Rhine-Westphalia, and a 43-year-old Ukrainian man in Spain who has since been extradited to Germany. Both are accused of conducting surveillance on the Bavarian drone manufacturer "Donaustahl" and the private residence of its CEO. German security authorities believe the alleged aim was to prepare for the man's assassination.
In early July, it was revealed that two individuals had been arrested at the Hungarian-Serbian border, also suspected of having been hired by a Russian intelligence service. They were reportedly en route to Germany with explosives and a drone. In this case, too, security authorities are investigating the suspicion that a German defense company in Bavaria could have been the target.
When presenting the domestic intelligence report in Berlin [novaB: a regularly published report from Germany's domestic intelligence / counter-intelligence agency called "Verfassungsschutz"], Federal Interior Minister Alexander Dobrindt (CSU) spoke of "plans for an attack involving explosives" targeting Germany, without specifying the details. Later the newspaper "Bild" broke the news of the arrests in Serbia.
Investigations following sabotage at substations
However, the background behind the two attacks on substations in Jänschwalde (in the state Brandenburg) and Bergheim (in the state North Rhine-Westphalia) remains unclear. In both instances, the apparent aim was to disrupt the power supply by causing a short circuit [novaB: in the high-voltage lines]. There are similarities in the way the acts were committed - a modus operandi that in this form has not been seen previously.
A left-wing extremist background is still considered a possibility. However, security circles note that the modus operandi is unusual for left-wing extremists, as it was too unprofessional. In fact, the attack was unsuccessful in both instances. The possibility that this attack could be the work of "throwaway agents" too is also being considered, though there appear to be no indications of this so far.
Russia hits Ukraine’s security service headquarters in Kyiv, Zelenskyy says
