Adversary Intelligence — 2026-09-26

German Investigators Link Munich Arson and Leipzig Airport Attack to GRU Special Activities Service Network

BLUFGerman investigators' convergence on a single GRU logistics network behind the Munich, Leipzig, and Skyeton plots is unlikely to yield formal federal attribution by late December, leaving NATO responses anchored to circumstantial evidence.

German investigators believe the GRU's Special Activities Service organized a September 3 arson attack near the Munich headquarters of Rohde & Schwarz and Helsing, according to Frankfurter Allgemeine Zeitung reporting cited by The Insider and Meduza 12. Two Bulgarian nationals detained the night of the attack, a 28-year-old woman and a 38-year-old man, are suspected recruits of a GRU-linked cell operating out of Slovakia. They threw incendiary devices from a moving car at a Berg am Laim construction site, igniting one device before police defused the second 13. The same network allegedly planned a disrupted arson attack on a Skyeton drone facility near Prešov, leading to the August 25 arrest of a Ukrainian and one Latvian in Slovakia and a second Latvian detained separately in Hamburg 12. Investigators have also tied the Munich case to the August 4 drone incident at Leipzig/Halle airport, reportedly directed by GRU officer Denis Smolyaninov, who has been under EU sanctions since October 2024 for allegedly recruiting saboteurs across Europe and has expertise in aircraft-communications interception 1. Munich's Generalstaatsanwaltschaft declined to confirm the Russian connection, citing the ongoing investigation 3. German security officials separately attribute a broader pattern of sabotage across Germany, Poland, and the Baltic states to the same GRU unit 4.

Analysis
Federal confirmation of GRU/Special Activities Service direction is unlikely within the next 90 days, since Munich prosecutors have declined to endorse the attribution and the network's disposable-operative recruitment model is designed to insulate handlers from evidentiary linkage; a charge sheet naming GRU tasking would mark a rare breakthrough against this network's structure. Moderate confidence rests on consistent cross-outlet convergence, though all four outlets trace to the same FAZ security-source account rather than independent reporting, and no forensic or judicial confirmation has followed. Investigators now extend the alleged network beyond Munich and Leipzig to a disrupted Skyeton plot in Slovakia and a broader Germany-Poland-Baltic sabotage pattern. The detained Bulgarians' amateurish tradecraft is also consistent with freelance criminals recruited for pay absent any verified GRU chain. Formal attribution would justify expanded expulsions and hardened site protection; continued non-confirmation leaves Rohde & Schwarz, Helsing, and similar suppliers reliant on ad hoc security.

5 sources

Bulgarians detained over Munich arson were part of GRU-linked group operating from Slovakia - The Insider
German investigators suspect Russian military intelligence organized an arson attack near defense firms in Munich - Meduza
Brandanschlag in München: Führt die Spur nach Moskau? - Abendzeitung München
München: Ermittler sehen GRU hinter Brandanschlag vom 3. September - ad-hoc-news.de (dts Nachrichtenagentur)
Report citing German security circles: GRU behind Munich arson attack near Rohde & Schwarz/Helsing (exact FAZ headline and article URL not independently retrievable; site is paywalled and not indexed by search) - Frankfurter Allgemeine Zeitung (F.A.Z.)