Low-level agents in Germany: Russia’s covert shadow force

Moscow is stepping up hybrid attacks on Germany, from espionage and disinformation to drone strikes.

German Chancellor Friedrich Merz said that although the country is not at war, it is no longer completely at peace.

In recent weeks, a series of drone attacks targeting military, critical and even civilian facilities have created unrest in the country. Munich Airport. Both the Chancellor and Defense Minister Boris Pistorius blamed Russia for at least some of the events.

It’s still unclear exactly who is behind the drone flights, as investigators must first identify their operators. However, it is reported that not a single drone has been captured so far.

What is clear, however, is that there appear to be two types of drone flights: professional operations using larger drones and amateur flights with off-the-shelf consumer models.

Authorities suspect that some of these latest attacks may have been carried out by so-called “low-level agents” working on the fringes of Russian intelligence networks.

Short missions, high risk

Recently, Germany’s domestic intelligence service (BfV), Federal Intelligence Service (BND), Federal Criminal Police Office (BKA) and Military Counterintelligence Service (MAD) published a publication. warning We urge people not to allow themselves to be used as “low-level agents” by foreign actors.

These individuals, often reached through social media, are paid relatively small amounts to perform “minor” and low-risk tasks such as vandalism, surveillance or arson.

Disinformation expert and director of the Cyber ​​Intelligence Institute Dr. “Low-level agents are often assigned to concrete actions,” Christopher Nehiring said in an interview with Euronews.

However, he cautioned that although these agents do intelligence-related work, they should not be classified as spies because espionage involves the secret collection of information. “They are generally not tasked with gathering intelligence,” Nehiring added.

Instead, their jobs may involve lighting fires, sticking propaganda stickers on walls, spraying graffiti, or causing other types of damage.

Relating to

Is ideology all that is needed to become a low-level perpetrator?

Terrorism expert and head of the Countering Extremism Project, Dr. Hans Jakob Schindler told Euronews that these “agents” were hired for a single purpose, which meant that they had little knowledge of the structures of Russian intelligence in Germany or across Europe. They operate not only in Germany but all over the continent.

Its main advantage for foreign actors, including Russia, is anonymity. Most of them are identified through Russia-friendly Telegram channels, where they express their pro-Russian views. According to Schindler, these representatives, who are usually male and have lower levels of formal education, are then contacted and recruited.

“It’s really about finding someone who is either ideologically willing to help or financially incentivized—ideally both,” Schindler said. Purely ideological motives are rare, he added, because money often plays a role. “Insecure economic conditions plus ideological alignment is basically the ideal package,” the terrorism expert explained.

Schindler defined the concept quite simply: The goal is to perform as many small-scale actions as possible. Low-cost operations that can be effective overall also keep the risk extremely low for the Russian side.

Nehiring agreed, noting that agents’ duties are generally “not particularly complex.” When it comes to sabotage, he said, these are usually small actions that cause limited damage, but when added together, create a sense of insecurity. “Hybrid warfare is not about directly defeating Germany or NATO,” Nehiring explained. “This is about politically weakening the will to defend by creating a widespread sense of uncertainty.”

Although most of their actions seem harmless at first glance, they are considered a harbinger of further escalation.

What do ‘low-level middleman’ operations look like?

Earlier this year, during the election campaign in Germany, more than 270 cars in various German states were sabotaged with expanding foam and decorated with stickers featuring the face of Green Party chancellor candidate Robert Habeck and the slogan “”.Be Greener“.

Initially, suspicion fell on climate activists. But Spiegel’s research suggested that this may have been a Russian sabotage operation aimed at increasing public sentiment against the Greens and their candidates.

Germany’s military support for Ukraine is another focus: recent reports indicate that Russian spy planes are monitoring arms shipments to Kiev. Low-level agents may also be used in such operations, including Dieter S. and Alexander J., who are currently on trial at the Munich Higher Regional Court.

Dieter S. is accused of promising a contact to carry out explosive and incendiary attacks on military infrastructure and industrial sites in Germany. Alexander J. had been helping her since at least March 2024, according to investigators. He is said to have scouted potential targets and forwarded photos and videos (of military transports, for example) to his contacts.

According to the indictment, the aim of the plans was to disrupt Germany’s support for Ukraine. One of the possible targets mentioned was a railway line used for arms shipments.

The anonymity of the Internet allows foreign actors to cover their tracks and remain “untraceable” in such operations. If a recruited agent is caught committing sabotage or espionage, as in the case of Dieter S., they alone are held responsible for the action.

Relating to

How are ‘low-level agents’ treated by their handlers?

According to intelligence services, Russia is increasingly relying on inexperienced agents. Here’s why: since the start of the Ukrainian invasion, it has become much more difficult for Russian intelligence to deploy its own agents in Germany.

Although exact figures are unknown, various reports indicate that at least 60 Russian diplomats have been expelled from Germany since the beginning of the full-scale occupation. Not every Russian diplomat is automatically a spy, but many Western intelligence agencies assume that some are engaged in espionage because diplomats have immunity and are officially accredited for political, economic or cultural missions.

Because of these limitations, the use of “low-level agents” has been referred to as an “act of desperation” in security circles.

“Low-level agents are ‘thrown aside’ in every sense,” Schindler said, adding that the Russian side takes no responsibility for short-term agents. “Their only purpose is to create uncertainty and gather information.”

Penalties for such actions range from “unconstitutional sabotage,” which carries a prison sentence of up to five years, to “espionage-related activities,” which can lead to a prison sentence of up to ten years in particularly serious cases.

So far, investigators have generally only been able to catch alleged low-level agents themselves, not the people who hired them.

According to the ZDF Frontal investigation, this remains a constant dilemma for Germany’s domestic intelligence agency: Even after a thorough investigation, the responsible parties often cannot be identified with certainty.

How to recruit low-level agents? Find out tomorrow on euronews.com