Is Russia recruiting migrants to carry out attacks on European soil? Germany may have uncovered a ‘smoking gun'

Yahoo

08-04-2025

In May last year, a 25-year-old Afghan asylum seeker called Sulaiman Ataee walked onto a German market square, drew a hunting knife, and plunged it into the far-Right activist Michael Stürzenberger.
In the 25 seconds of mayhem that followed in Mannheim, one policeman was fatally stabbed in the neck and six people who tried to intervene suffered knife wounds. Mr Stürzenberger survived – just.
Ataee was shot, arrested and charged with murder. His trial began in February.
Ataee, investigators later concluded, had become interested in the Taliban and been influenced by 'radical influencers and pseudo-Islamic scholars' on the Telegram messaging app.
Now, new evidence suggests his attack may not only have been an act of Islamist terror – but part of a Russian subversion operation designed to sow chaos on Europe's streets in order to destabilise the West and undermine its support for Ukraine.
It is a campaign that spans the vandalising of French Holocaust memorials and using foam to block exhaust pipes of cars in Germany, to the petrol bombing of a Latvian museum and arson in east London.
Russian subversion, sabotage and assassination programs long predate the February 2022 invasion of Ukraine. But the war has seen a surge in suspected attacks, especially since last summer. And while, previously, Russian agencies have focused on disrupting military supplies or gathering intelligence, many more recent operations seem designed to stoke social and political tensions, undermine public trust and boost far-Right parties opposed to sending aid to Kyiv.
That in turn raises questions about a string of similar attacks that followed Mannheim.
ZDF (Zweites Deutsches Fernsehen), a German broadcaster, has found that the phrases 'Michael Stürzenberger stabbed' and 'Michael Stürzenberger attack' were used in internet searches in Russia before the attack took place.
There is also evidence of Russian internet users trying to access a webcam feed of Mannheim's town square, the scene of the attack, shortly before it occurred.
The revelations could confirm suspicions that have long been circulating in the German intelligence community.
Earlier this year, a senior German intelligence official told the Russian investigative journalists Andrei Soldatov and Irina Borogan that German agencies believed Russia had instigated a string of attacks by asylum seekers to inflate support for the pro-Kremlin Alternative for Germany (AfD) party, which opposes support for Ukraine, ahead of this year's election.
To Soldatov, the latest revelations about the attack in Mannheim amount to something of a smoking gun and strengthen the theory espoused by the intelligence official.
The new evidence 'fits a pattern that we see and hear from many corners,' he says. 'Sabotage tactics are not only about blowing stuff up – it is about raising the costs of providing support to Ukraine, including political costs. You don't need to have a sophisticated group of agents on the ground but if you can get someone to write something on a wall inciting hatred or blaming the Ukrainians, you can create costs.'
The stabbing in Mannheim was the first of five knife attacks committed by immigrants ahead of the vote in February.
In August 2024, a 26-year-old Syrian refugee killed three people and wounded eight more in a knife rampage through the city of Solingen.
On Dec 22, a 50-year-old Saudi-born doctor drove a car into Magdeburg Christmas Market, killing six.
A month later, a 28-year-old man from Afghanistan was arrested following the murders of a two-year-old boy and a 41-year-old man in the Bavarian city of Aschaffenburg.
Then, on Feb 13, just 10 days before the election, a 24-year-old Afghan asylum seeker injured at least 30 people when he drove a car into crowds in Munich.
All those attacks were carried out by foreign nationals. With the exception of the Magdeburg attack, the perpetrators were all under 30.
The last four attacks have not, to date, been publicly linked to Russia except by the German official who spoke to Soldatov and Borogan.
Ataee's links to Russian intelligence have not yet been established. Statements by investigators to the German press suggest he believed he was speaking to Islamists on Telegram, but have made no mention of Russia.
Nor is the significance of the strange Russian internet activity obvious. Internet searches are not of themselves proof of conspiracy. Even assuming Russian complicity, there are multiple possible explanations.
Could a low-level Russian intelligence officer have been googling to see whether a mission had been carried out? Was Ataee being handled by an agent, or agents, who failed to cover their tracks? Or did they want to be caught?
A few weeks before the attack on Stürzenberger, a Berlin metal factory belonging to defence manufacturer Diehl went up in flames.
It was, police said, an accident. Later, an (unnamed) allied country's intelligence service handed Germany's federal intelligence service, BND, a dossier showing it was arson and that Russia was behind it.
And last month The Telegraph revealed that German security services had found what appeared to be a calling card: internet users in Russia had run searches in the weeks before and after the incident on what fire engines and fire safety protocols were in place at the factory.
The sloppiness of the job was, a European security source suspected, deliberate.
'Russians are not as stupid as to leave that breadcrumb trail, sometimes they simply want us to find out they have flexed their muscles. It's part of the hybrid warfare,' the source, who had knowledge of the investigation into the incident, told The Telegraph in March.
Calling card or incompetence, the pattern is clear, say European security experts. Russia has stepped up a campaign of sabotage across Europe in the wake of its attack on its neighbour.
Russia and its ally Belarus have been blamed by Western officials for at least 59 incidents including cyberattacks, assassination plots and vandalism since the full scale invasion began, according to an investigation by the Associated Press, published in March.
James Appathurai, the Nato deputy assistant secretary general for innovation, hybrid and cyber, this year called for the alliance to move to a 'war footing' to deal with the wave of train derailments, graffiti stunts, arson attacks and assassination plots linked to Moscow of late.
Those operations are characterised by the 'Uberization' or 'gig economy' of sabotage – in which agents recruit third or fourth parties to carry out jobs on the cheap.
'It is extremely cheap. People who do it are not always in the know about what they are doing. And it is very difficult to counter,' says Soldatov.
The perpetrators are seldom, if ever, actual Russian intelligence officers. They may even have no idea who they are working for.
'We've seen they're mostly financially vulnerable, often coming from former Soviet states in Europe,' says Maxime Lebrun, deputy director of research and analysis at Hybrid CoE, The European Centre of Excellence for Countering Hybrid Threats.
'They're mostly contacted through Telegram by an intermediary and offered money and given quite precise instructions for their deeds. The Telegram accounts disappear shortly after.'
It is not only Germany that has been affected.
In May 2024, red hands were spray painted on the Paris Holocaust memorial. A month later, coffins draped with the French flag and bearing the words: 'French soldiers of Ukraine' were left at the Eiffel Tower. Russia has been suspected in both incidents.
'The caskets at the Eiffel Tower were brought by a team of Bulgarian individuals who had also committed the red hands operations on the Shoah memorial in Paris,' says Lebrun.
The attempts to sow discord ahead of the Paris Olympics are seen by some as the starting pistol of the current wave of subversion in Western Europe.
But the tactics on display in Germany and France have already been tested further east.
A remarkable look at the mechanics of the recruitment process came in 2023, when one would-be saboteur wrote down the disappearing Telegram messages so he could remember the instructions for his next job.
He mistakenly dropped the folded sheet marked 'Mission, Lielvārde Military Airfield' while on the job – which led Latvian investigators and news outlet Re:Baltica to one Sergejs Hodonovič, a 21-year-old from Riga who had been recruited while trying to buy cannabis on a Telegram group.
Hodonovic had carried out several 'jobs', including having graffitied the Nato Cooperative Cyber Defence Center of Excellence in Estonia.
The investigative site Re:Baltica revealed this year that Hodonovic was the last in a chain of at least four intermediaries, all operating on social media, that authorities believed led back to the GRU, Russia's military intelligence outfit. Each were in their twenties, and were being paid a few hundred Euros for every job completed.
The case cast light on the kind of people who tend to get recruited for such operations.
'They are not the smartest people. They usually have a kind of criminal background. It's a gig economy: it's about money – fast money. Some of them really don't know who they are working for,' says Inga Springe, a reporter at Re:Baltica who has covered this and other Telegram-sabotage cases.
Telegram recruitment was once the GRU's speciality. But since the war in Ukraine disrupted their networks, the SVR (foreign intelligence) and FSB (federal security) have also got in on the act. That, says Soldatov, makes attributing such operations to a single agency increasingly difficult.
All these operations are aimed at raising the literal and figurative costs of supporting Ukraine. There are also second and third objectives: to lay the blame on Ukraine – and to intimidate.
'There was an open manifestation of these tactics a month ago when the SVR, Russia's foreign intelligence service, announced they were expecting attacks on Russian emigres in Europe by the Ukrainians,' Soldatov says.
'We know what that means: it is intimidation against people like us, Russian political emigres. And it simultaneously lays the blame on Ukraine if anything happens.'
But that does not mean such operations will stop with a ceasefire, argues Soldatov.
Russia's intelligence community operates on the deeply held conviction that the collective West is a threat, a view that it held long before the current war.
The risks of the kind of operations seen across Europe in recent months and years are so low, and the potential benefits so large, that Moscow will have little reason to give them up, even in peace time.
That is in the absence of a concerted European response, at least.
Broaden your horizons with award-winning British journalism. Try The Telegraph free for 1 month with unlimited access to our award-winning website, exclusive app, money-saving offers and more.