When German authorities disrupted an alleged Russian intelligence operation targeting Stefan Thumann, founder of Bavarian drone manufacturer Donaustahl, the immediate story appeared to concern one company and one suspected plot. According to a Die Zeit investigation, investigators believe the operation progressed beyond routine intelligence gathering and was intended to culminate in Thumann’s assassination after months of surveillance conducted by two suspected operatives. Prosecutors ultimately charged the suspects with acting on behalf of a foreign intelligence service, while the alleged murder plot itself has not been included in the current arrest warrants because investigators say the available evidence did not yet satisfy the legal threshold for that charge.
The Battlefield Behind the Front Line
According to ZEIT, the operation began to unravel after a partner intelligence service warned German authorities in December 2025 that Thumann had become the target of a Russian operation. Bavarian investigators arrested one suspect, identified as Serhii N., confiscated several mobile phones and later concluded – after analysing their contents – that he had allegedly maintained contact with Russian intelligence. By then, however, he and his family had already fled to Spain. German investigators subsequently concluded that another suspect, Romanian national Alla S., had continued surveillance of Thumann before authorities coordinated arrests in Germany and Spain during March 2026.
For Berlin, the significance of the case extends well beyond one entrepreneur. ZEIT reports that the investigation was discussed repeatedly during weekly intelligence briefings inside the Federal Chancellery, where senior security officials increasingly concluded that Russia no longer views Germany merely as a political adversary but as an operational theatre for hybrid activity. The investigation also reveals that German authorities are examining a second, highly classified case involving another defense company whose chief executive may likewise have become a target of Russian intelligence.
The Donaustahl case follows the previously disclosed plot against Rheinmetall chief executive Armin Papperger, which U.S. and German officials said was disrupted in 2024. According to Reuters, Western intelligence agencies concluded that Russia had planned to assassinate Papperger because Rheinmetall had become one of Ukraine’s most important suppliers of artillery ammunition and armored vehicles. Together, the Papperger and Thumann cases suggest an important shift: senior figures inside Europe’s defense industry are increasingly being treated as operational targets rather than merely subjects of intelligence collection.
Why Russia Isn’t Attacking NATO Directly
One of the defining features of Russia’s campaign against Western support for Ukraine is what it largely avoids doing. Moscow has repeatedly condemned NATO arms deliveries and warned that Western military assistance makes Alliance members participants in the conflict. Yet direct attacks against NATO military infrastructure inside member states remain exceptionally rare because they would risk triggering a much broader confrontation with the Alliance.
Hybrid operations offer a different strategic calculus. Surveillance, sabotage, cyber intrusions, proxy recruitment and intimidation allow Russia to impose costs while remaining below the threshold likely to provoke a collective military response. Attribution often takes months, legal proceedings move slowly and governments retain significant political flexibility in deciding how to respond. Strategic ambiguity is therefore not a side effect of these operations – it is one of their principal advantages.
The Donaustahl investigation illustrates this logic. According to the ZEIT investigation, the alleged surveillance was carried out not by Russian intelligence officers operating under diplomatic cover but by individuals with no obvious connection to professional espionage. Even if such operatives are arrested, proving the chain of command leading back to Moscow remains considerably more difficult than attributing the actions of accredited intelligence officers. This creates precisely the ambiguity that hybrid warfare seeks to exploit.
This does not necessarily mean every suspected incident forms part of a centrally directed campaign. Public evidence still varies considerably from case to case. But the cumulative pattern indicates that Russian intelligence services increasingly regard Europe’s defense-industrial base as a legitimate arena for competition below the threshold of open interstate conflict. Rather than confronting NATO directly, Moscow appears willing to exploit the political and legal grey zone that separates peace from war.
Disposable Operatives, Sustainable Pressure
Perhaps the most important revelation in the ZEIT investigation is not the alleged assassination plot itself but the operational model behind it. German investigators believe Russian intelligence increasingly relies on what they describe as “disposable agents” – individuals recruited online from economically vulnerable backgrounds or minor criminal networks and paid to conduct surveillance, sabotage or other preparatory tasks. Unlike professional intelligence officers, these recruits require little training, ask few questions and can easily be replaced if arrested.
From Moscow’s perspective, this approach offers several advantages. Third-country recruits generate less diplomatic fallout than intelligence officers operating under official cover, while complicating criminal investigations because prosecutors must establish not only what the operatives did but who ultimately directed them. The operatives themselves may possess only fragmentary knowledge of the broader operation, making attribution even more difficult.
The ZEIT investigation suggests investigators believe these individuals are rarely intended to carry out the final act themselves. Instead, they conduct reconnaissance, identify routines, collect imagery and map vulnerabilities before other operatives become involved. If correct, this division of labour represents an evolution in Russian tradecraft: reconnaissance becomes inexpensive and disposable, while more sensitive tasks remain compartmentalised.
Why Bavaria’s Drone Cluster Matters
The alleged targeting of Donaustahl is significant not simply because it manufactures drones, but because of where it sits within Germany’s rapidly evolving defense ecosystem. Over the past three years, Bavaria has emerged as one of Europe’s principal hubs for defense innovation, hosting companies that have fundamentally reshaped Ukraine’s battlefield capabilities. Alongside Donaustahl, firms such as Quantum Systems and Helsing have become central suppliers of reconnaissance drones, artificial intelligence software and autonomous military technologies. According to the Die Zeit investigation, German investigators are now examining another highly classified case involving a second defense company, while a separate Serbian investigation uncovered a truck allegedly carrying concealed explosives destined for Bavaria, with investigators finding evidence of contacts with Russian intelligence on the suspects’ mobile phones.
This reflects a broader transformation in how military capability is generated. During the Cold War, strategic production centred on shipyards, aircraft factories and armored vehicle plants protected by layers of state security. Those facilities remain important, but Ukraine’s war has demonstrated that battlefield innovation increasingly comes from comparatively small technology companies capable of iterating software, electronics and unmanned systems within weeks rather than years. Competitive advantage no longer depends solely on industrial scale; it increasingly depends on engineering agility.
That shift has changed the strategic value of firms like Donaustahl. A company employing dozens rather than thousands of people can nevertheless influence battlefield outcomes through rapid adaptation, close cooperation with military units and continuous product development. Such companies derive their importance less from production volume than from their ability to solve operational problems faster than conventional procurement systems can respond. In a war increasingly defined by drones, autonomy and electronic warfare, disrupting innovation may prove as valuable as disrupting production.
At the same time, these businesses often retain the security culture of civilian technology firms rather than established defense contractors. Their executives are public-facing entrepreneurs, their facilities are comparatively accessible and their organizations emphasize openness, rapid collaboration and commercial flexibility. Those characteristics, which have contributed to their success, also create vulnerabilities that hostile intelligence services may seek to exploit.
Hybrid Warfare as Industrial Attrition
Hybrid warfare has traditionally been associated with cyber attacks, disinformation campaigns, political interference and espionage. The emerging pattern inside Europe suggests another dimension: industrial attrition. Rather than attempting to destroy factories outright, hostile actors can seek to impose friction across the defense-industrial network through surveillance, sabotage, intimidation and disruption. Each individual incident may appear limited, but together they can increase the cost of sustaining military production.
The objective is therefore not necessarily immediate physical destruction. Executive protection, enhanced cybersecurity, additional compliance requirements, higher insurance premiums, disrupted investment decisions and delays in production all consume resources that would otherwise contribute directly to military capability. In this sense, the target is not simply an individual executive or a single company but the resilience of the wider ecosystem supporting Ukraine.
The alleged use of disposable agents fits this logic. Their value lies not only in plausible deniability but also in scalability. If reconnaissance can be outsourced to inexpensive intermediaries while more sensitive operations remain compartmentalized, intelligence services can sustain pressure across multiple targets simultaneously at relatively low cost. The result is a campaign measured less by spectacular attacks than by accumulated friction imposed on an industrial network.
Importantly, caution remains warranted. The public evidence does not demonstrate that every suspected sabotage incident or espionage investigation across Europe forms part of one centrally directed Russian campaign. Individual cases differ significantly in their evidentiary basis and operational characteristics. Yet the recurrence of investigations involving companies supporting Ukraine, combined with repeated warnings from European security services about Russian hybrid activity, points toward an increasingly contested industrial environment rather than isolated episodes.
Europe’s Next Security Challenge
The implications extend beyond one investigation in Bavaria. European governments have invested heavily in expanding ammunition production, increasing defense spending and reinforcing NATO’s eastern flank. Protecting the companies responsible for delivering those capabilities has received comparatively less attention, even as intelligence services increasingly warn that the industrial base itself has become an object of hostile interest.
Many of the firms driving Europe’s defense innovation remain privately owned, geographically dispersed and only recently integrated into military supply chains. Their greatest strengths – speed, flexibility and entrepreneurial culture – are also characteristics that make them more difficult to protect than traditional defense primes operating within long-established security frameworks. As governments encourage closer cooperation with commercial technology companies, industrial security becomes inseparable from national security.
The Donaustahl investigation illustrates this emerging challenge. Whether or not prosecutors ultimately prove every element of the alleged assassination plot, the investigation demonstrates that European security services are increasingly concerned not simply with espionage but with protecting the people and companies responsible for sustaining Ukraine’s military adaptation. The question is no longer only how quickly Europe can expand defense production. It is whether Europe can protect the innovation networks making that expansion possible.
During the Cold War, Europe largely assumed its factories would prepare for a future conflict. The evidence emerging from investigations such as Donaustahl suggests that parts of its defense-industrial base are already operating on the front line of the current one – not through conventional combat, but through a prolonged contest over innovation, disruption and resilience. If that assessment proves correct, safeguarding Europe’s defense ecosystem will become as strategically important as expanding it.
