---
title: "“Shadow War” Against NATO: Germany at the Epicenter of Sabotage as the GRU Recruits “Mules” via Telegram"
description: "Western experts warn of an escalation in Russia's “shadow war” against NATO: drone attacks on Leipzig airport and a blackout in Berlin have been recorded in Germany, while the GRU recruits operatives via Telegram."
date: 2026-09-05T19:50:01.000Z
lang: en
url: https://xab.info/en/posts/shadow-war-russia-nato-sabotage-germany-gru-telegram
tags: [russia-nato, sabotage-europe, germany-security, gru, drone-attacks, leipzig, berlin-blackout, defense-industry]
publisher: "XAB.info"
---

# “Shadow War” Against NATO: Germany at the Epicenter of Sabotage as the GRU Recruits “Mules” via Telegram

![Vladimir Putin seated at a desk in an office with the Russian flag in the background — context of the GRU 'shadow war' against NATO and sabotage in Germany](https://xab.info/media/2026/09/05/tenevaya-voyna-rf-protiv-nato-diversii-v-germanii/tenevaya-voyna-rf-protiv-nato-diversii-v-germanii-1.webp)

## 🎯 Key Points

- Germany has become the main target of sabotage: attacks on energy infrastructure, airports, defense enterprises, and IT systems.
- Drones carrying explosives were found near Leipzig/Halle airport, and in Berlin more than 25,000 households were left without power following a sabotage act.
- The GRU recruits disposable “mules” via Telegram with payment in cryptocurrency, evading NATO's Article 5.
- Assessments diverge: Berlin speaks of state terrorism, while Trump claims Russia is not seeking a direct attack on the Alliance.

Western intelligence services and national security experts are warning of a sharp escalation in Russia's so-called “shadow war” against NATO countries. According to their assessments, the Kremlin is systematically probing the limits of what is acceptable in its confrontation with the Alliance, ramping up a wave of targeted acts of sabotage and laying the groundwork for deliberate killings on European territory. Germany has become the main target of this pressure, where, according to intelligence and media reports, numerous attacks have been recorded against energy infrastructure, airports, defense enterprises, and government IT systems.

### Drones Over Leipzig and a Blackout in Berlin

Among the most high-profile incidents are episodes near Leipzig/Halle airport, where drones carrying explosives were discovered. Reports indicate that one of the devices attacked a cargo plane, forcing it to change course, while another was found attached to a tree with a detonator installed. Meanwhile, in Berlin, more than 25,000 households were left without electricity following a sabotage act, which, according to observers, signals a shift from isolated acts to strikes on a metropolis's critical infrastructure.

### The “Gray Zone” and the Recruitment of Disposable Operatives

According to intelligence data, the GRU is actively recruiting disposable operatives — so-called “mules” — through the Telegram messenger, paying them in cryptocurrency. Such agents carry out arson, railway sabotage, and the collection of data on military bases. This model allows Moscow to formally avoid direct responsibility and to evade triggering Article 5 of the NATO Charter, preserving “deniability” for each individual act.

### Contradictory Assessments

Expert and official assessments diverge significantly on the scale and nature of the threat. Bundestag member Roderich Kiesewetter stated that Germany faces the threat of direct state terrorism and that “all the trails will lead to Moscow,” while former Defense Minister Tobias Ellwood warned that new chemical attacks or assassinations in the vein of the “Novichok” case are “only a matter of time.” At the same time, the tone in Washington is noticeably softer: U.S. President Donald Trump, reacting to the events in Leipzig, stated that Putin is not actually seeking a direct military attack on the Alliance. Thus, one side speaks of a brewing wave of killings and state terrorism, while the other speaks of de-escalation and the absence of intent for open conflict.

### Brussels's Position and Mirror Strikes

Against this backdrop, European officials note that Moscow is already “reaping the consequences of its own actions.” In particular, a European Commissioner emphasized that the Russian leader himself has brought the war onto Russian territory, escalating the conflict and suffering retaliatory mirror strikes from Ukraine. Meanwhile, according to The Telegraph, Russia has intensified attacks on weapons manufacturing plants across Europe, using, among others, criminal groups, which heightens concerns about the resilience of the European defense-industrial complex.

## 🔍 Fact-Check Verification

- [Putin Preparing a Wave of Sabotage and Assassinations in NATO Countries, Media Report](https://www.rbc.ua/ukr/news/putin-gotue-hvilyu-diversiy-ta-zamahiv-krayinah-1788637072.html) - Подтверждает нарратив о подготовке волны диверсий и покушений в странах НАТО по данным СМИ.
- [More Than 25,000 Households in Berlin Left Without Power After Sabotage Act](https://www.rfi.fr/ru/%D0%B5%D0%B2%D1%80%D0%BE%D0%BF%D0%B0/20260106-%D0%B1%D0%BE%D0%BB%D0%B5%D0%B5-25-%D1%82%D1%8B%D1%81%D1%8F%D1%87-%D0%BA%D0%B2%D0%B0%D1%80%D1%82%D0%B8%D1%80-%D0%B2-%D0%B1%D0%B5%D1%80%D0%BB%D0%B8%D0%BD%D0%B5-%D0%BE%D1%81%D1%82%D0%B0%D1%8E%D1%82%D1%81%D1%8F-%D0%B1%D0%B5%D0%B7-%D1%81%D0%B2%D0%B5%D1%82%D0%B0-%D0%BF%D0%BE%D1%81%D0%BB%D0%B5-%D0%B4%D0%B8%D0%B2%D0%B5%D1%80%D1%81%D0%B8%D0%B8) - Подтверждает блэкаут в Берлине после диверсии (более 25 тыс. домохозяйств).
- [Russia Launches New Wave of Attacks on Weapons Manufacturing Plants Across Europe — The Telegraph](https://nv.ua/world/geopolitics/ataki-na-oboronnuyu-promyshlennost-evropy-rossiya-aktivizirovala-sabotazh-cherez-ugolovnye-gruppirovki-50635083.html) - Подтверждает новую волну атак на оборонные предприятия Европы с привлечением уголовных группировок (The Telegraph).
- [Putin Sets Europe Ablaze: Why Russia Has Intensified Attacks on the European Defense-Industrial Complex and What the Response Will Be](https://www.obozrevatel.com/novosti-mir/putin-podzhigaet-evropu-neskolko-prichin-po-kotoryim-rossiya-aktivizirovala-ataki-na-evropejskij-voenno-promyishlennyij-kompleks-svyazannyij-s-ukrainoj-kakim-budet-otvet-evropyi.htm) - Даёт контекст активизации атак на европейский ВПК и возможных ответов Европы.

## ❓ FAQ

### Q: What incidents have been recorded in Germany?
**A:** Drones carrying explosives were found near Leipzig/Halle airport, one device attacked a cargo plane, and in Berlin more than 25,000 households were left without power following a sabotage act.

### Q: How does the GRU operate, according to intelligence?
**A:** The GRU recruits disposable operatives via Telegram and pays them in cryptocurrency; such agents carry out arson, railway sabotage, and the collection of data on military bases, allowing Moscow to avoid direct responsibility and the triggering of NATO's Article 5.

### Q: Do expert assessments diverge?
**A:** Yes: Bundestag member Roderich Kiesewetter and former Defense Minister Tobias Ellwood warn of state terrorism and possible chemical attacks, while Donald Trump claims that Russia is not seeking a direct military attack on the Alliance.