An investigation by RTL/stern has provided a rare opportunity to see the Russian intelligence model in Germany from the inside. Journalists spent almost a year working undercover and receiving assignments via Telegram from individuals linked to the Russian side. Payment was offered in Bitcoin (rtl.de).

Journalist Angelique Geray created the cover identity of a pro-Russian blogger named “Katya.” After entering the pro-Russian environment, the assignments quickly went beyond information activities: collecting data on a human rights organization, a CDU employee, an attempt to infiltrate a political party environment, and gathering information on defense companies.

At the ILA air show, agents were instructed to photograph drones and missile systems and establish the names and addresses of employees of German defense companies (rtl.de).

This is no longer propaganda. It is target development: the initial compilation of dossiers on potential targets.

The German government has officially confirmed a sharp increase in russia’s use of so-called Low-Level-Agenten or Wegwerf-Agenten. Recruitment is carried out through social networks and intermediaries, often among people with financial problems or criminal backgrounds. The operatives may know neither the real client nor the ultimate purpose of the operation (Deutscher Bundestag).

The most interesting case is Stefan Thumann and Donaustahl.

The 39-year-old Thumann heads the Bavarian defense-tech startup Donaustahl, which shifted toward offensive technologies after 2023. The company produces FPV and loitering systems MAUS, Ratte and Stryga, is working on electronic-warfare-resistant control channels, and supplied MAUS to the Ukrainian KRAKEN unit (Donaustahl GmbH).

According to German investigators, surveillance of Thumann began at least in December 2025.

Ukrainian citizen Sergey N. collected information about the entrepreneur and filmed his working environment. After Sergey left for Spain, the surveillance was continued by Romanian citizen Alla S., who documented the target’s home address. Both were arrested in March 2026 (LinkedIn).

RTL reports another detail: a machete was found when one of the suspects was detained (rtl.de).

According to German security services, collecting addresses, workplaces and routes may have been a preparatory stage for an assassination attempt.

The most high-profile version involves Novichok.

Thumann himself said he had been warned about the possible use of a nerve agent. As a result, he avoids even touching door handles, lives in a safe house, uses secure devices, constantly changes locations and is under protection. He has already prepared a will and medical directives (RONZHEIMER).

An important clarification: the use of Novichok has not been officially confirmed by prosecutors. This information comes from Thumann himself and sources linked to the German security community. Therefore, it should be described as one of the possible scenarios for an attempted assassination, rather than an established method of attack.

But the context makes the possibility dangerously plausible.

In 2024, US intelligence uncovered a Russian plan to assassinate Rheinmetall CEO Armin Papperger. According to CNN, this was not an isolated plot but part of a series of plans targeting the heads of European defense companies working for Ukraine (CNN Transcripts).

At the same time, Russian low-level agents have been used for acts of sabotage.

On July 20, 2024, a parcel containing an incendiary device caught fire at the DHL hub in Leipzig/Halle. Investigators linked it to a series of similar shipments in Poland and the United Kingdom. According to WDR/NDR/SZ, the operation was organized by the GRU, which used Ukrainian and Lithuanian operatives. One received the packages, another activated the timers, and a third sent them under a false name (tagesschau.de).

In 2025, three more Ukrainians were charged in Germany with preparing test shipments containing GPS trackers. According to investigators, the operation was directed via Telegram from occupied Mariupol (tagesschau.de).

This is where the new Russian model becomes visible.

Not a classic intelligence network, but a chain of disposable operatives:

one photographs the target;

another purchases SIM cards;

a third checks the route;

a fourth forwards the package;

a fifth may carry out the act of sabotage itself.

The compromise of one element does not expose the entire structure.

German-language OSINT communities discussing the Thumann case have raised another possibility: the objective may not have been only his physical elimination, but also intimidation of a new generation of European defense-tech entrepreneurs, particularly small companies that can rapidly transfer technologies to Ukraine without lengthy corporate procedures. There is no direct evidence of this, but the logic is consistent with the earlier Papperger case (Reddit).

There is another important debate. German users and experts have drawn attention to the relatively low level of liability faced by recruited “disposable agents.” In August 2026, one of the defendants in the case involving preparations for parcel sabotage received only one year and three months in prison, while two others were acquitted. Professional and OSINT communities are already describing this as a factor that lowers the cost of recruiting new operatives (Reddit).

After RTL’s operation was exposed, another characteristic signal emerged. Angelique Geray received a fresh photograph of herself, meaning that someone had already been monitoring the journalists. Then came a voice threat: if she tried to escape, she would “get a bullet” (rtl.de).

This is perhaps the most important detail in the entire investigation.

The journalists were trying to penetrate an intelligence network.

At some point, the network began operating against them.

This is what Russian “sabotage outsourcing” in Europe looks like today: Telegram, cryptocurrency, people without intelligence training, compartmentalized tasks and a handler who remains far from the site of the operation.

From photographing a military facility to a package containing an incendiary device or preparations for an assassination, there may be only a few sequential assignments.