Latest news with #MichaelStürzenberger
Yahoo
08-04-2025
- Politics
- Yahoo
Is Russia recruiting migrants to carry out attacks on European soil? Germany may have uncovered a ‘smoking gun'
In May last year, a 25-year-old Afghan asylum seeker called Sulaiman Ataee walked onto a German market square, drew a hunting knife, and plunged it into the far-Right activist Michael Stürzenberger. In the 25 seconds of mayhem that followed in Mannheim, one policeman was fatally stabbed in the neck and six people who tried to intervene suffered knife wounds. Mr Stürzenberger survived – just. Ataee was shot, arrested and charged with murder. His trial began in February. Ataee, investigators later concluded, had become interested in the Taliban and been influenced by 'radical influencers and pseudo-Islamic scholars' on the Telegram messaging app. Now, new evidence suggests his attack may not only have been an act of Islamist terror – but part of a Russian subversion operation designed to sow chaos on Europe's streets in order to destabilise the West and undermine its support for Ukraine. It is a campaign that spans the vandalising of French Holocaust memorials and using foam to block exhaust pipes of cars in Germany, to the petrol bombing of a Latvian museum and arson in east London. Russian subversion, sabotage and assassination programs long predate the February 2022 invasion of Ukraine. But the war has seen a surge in suspected attacks, especially since last summer. And while, previously, Russian agencies have focused on disrupting military supplies or gathering intelligence, many more recent operations seem designed to stoke social and political tensions, undermine public trust and boost far-Right parties opposed to sending aid to Kyiv. That in turn raises questions about a string of similar attacks that followed Mannheim. ZDF (Zweites Deutsches Fernsehen), a German broadcaster, has found that the phrases 'Michael Stürzenberger stabbed' and 'Michael Stürzenberger attack' were used in internet searches in Russia before the attack took place. There is also evidence of Russian internet users trying to access a webcam feed of Mannheim's town square, the scene of the attack, shortly before it occurred. The revelations could confirm suspicions that have long been circulating in the German intelligence community. Earlier this year, a senior German intelligence official told the Russian investigative journalists Andrei Soldatov and Irina Borogan that German agencies believed Russia had instigated a string of attacks by asylum seekers to inflate support for the pro-Kremlin Alternative for Germany (AfD) party, which opposes support for Ukraine, ahead of this year's election. To Soldatov, the latest revelations about the attack in Mannheim amount to something of a smoking gun and strengthen the theory espoused by the intelligence official. The new evidence 'fits a pattern that we see and hear from many corners,' he says. 'Sabotage tactics are not only about blowing stuff up – it is about raising the costs of providing support to Ukraine, including political costs. You don't need to have a sophisticated group of agents on the ground but if you can get someone to write something on a wall inciting hatred or blaming the Ukrainians, you can create costs.' The stabbing in Mannheim was the first of five knife attacks committed by immigrants ahead of the vote in February. In August 2024, a 26-year-old Syrian refugee killed three people and wounded eight more in a knife rampage through the city of Solingen. On Dec 22, a 50-year-old Saudi-born doctor drove a car into Magdeburg Christmas Market, killing six. A month later, a 28-year-old man from Afghanistan was arrested following the murders of a two-year-old boy and a 41-year-old man in the Bavarian city of Aschaffenburg. Then, on Feb 13, just 10 days before the election, a 24-year-old Afghan asylum seeker injured at least 30 people when he drove a car into crowds in Munich. All those attacks were carried out by foreign nationals. With the exception of the Magdeburg attack, the perpetrators were all under 30. The last four attacks have not, to date, been publicly linked to Russia except by the German official who spoke to Soldatov and Borogan. Ataee's links to Russian intelligence have not yet been established. Statements by investigators to the German press suggest he believed he was speaking to Islamists on Telegram, but have made no mention of Russia. Nor is the significance of the strange Russian internet activity obvious. Internet searches are not of themselves proof of conspiracy. Even assuming Russian complicity, there are multiple possible explanations. Could a low-level Russian intelligence officer have been googling to see whether a mission had been carried out? Was Ataee being handled by an agent, or agents, who failed to cover their tracks? Or did they want to be caught? A few weeks before the attack on Stürzenberger, a Berlin metal factory belonging to defence manufacturer Diehl went up in flames. It was, police said, an accident. Later, an (unnamed) allied country's intelligence service handed Germany's federal intelligence service, BND, a dossier showing it was arson and that Russia was behind it. And last month The Telegraph revealed that German security services had found what appeared to be a calling card: internet users in Russia had run searches in the weeks before and after the incident on what fire engines and fire safety protocols were in place at the factory. The sloppiness of the job was, a European security source suspected, deliberate. 'Russians are not as stupid as to leave that breadcrumb trail, sometimes they simply want us to find out they have flexed their muscles. It's part of the hybrid warfare,' the source, who had knowledge of the investigation into the incident, told The Telegraph in March. Calling card or incompetence, the pattern is clear, say European security experts. Russia has stepped up a campaign of sabotage across Europe in the wake of its attack on its neighbour. Russia and its ally Belarus have been blamed by Western officials for at least 59 incidents including cyberattacks, assassination plots and vandalism since the full scale invasion began, according to an investigation by the Associated Press, published in March. James Appathurai, the Nato deputy assistant secretary general for innovation, hybrid and cyber, this year called for the alliance to move to a 'war footing' to deal with the wave of train derailments, graffiti stunts, arson attacks and assassination plots linked to Moscow of late. Those operations are characterised by the 'Uberization' or 'gig economy' of sabotage – in which agents recruit third or fourth parties to carry out jobs on the cheap. 'It is extremely cheap. People who do it are not always in the know about what they are doing. And it is very difficult to counter,' says Soldatov. The perpetrators are seldom, if ever, actual Russian intelligence officers. They may even have no idea who they are working for. 'We've seen they're mostly financially vulnerable, often coming from former Soviet states in Europe,' says Maxime Lebrun, deputy director of research and analysis at Hybrid CoE, The European Centre of Excellence for Countering Hybrid Threats. 'They're mostly contacted through Telegram by an intermediary and offered money and given quite precise instructions for their deeds. The Telegram accounts disappear shortly after.' It is not only Germany that has been affected. In May 2024, red hands were spray painted on the Paris Holocaust memorial. A month later, coffins draped with the French flag and bearing the words: 'French soldiers of Ukraine' were left at the Eiffel Tower. Russia has been suspected in both incidents. 'The caskets at the Eiffel Tower were brought by a team of Bulgarian individuals who had also committed the red hands operations on the Shoah memorial in Paris,' says Lebrun. The attempts to sow discord ahead of the Paris Olympics are seen by some as the starting pistol of the current wave of subversion in Western Europe. But the tactics on display in Germany and France have already been tested further east. A remarkable look at the mechanics of the recruitment process came in 2023, when one would-be saboteur wrote down the disappearing Telegram messages so he could remember the instructions for his next job. He mistakenly dropped the folded sheet marked 'Mission, Lielvārde Military Airfield' while on the job – which led Latvian investigators and news outlet Re:Baltica to one Sergejs Hodonovič, a 21-year-old from Riga who had been recruited while trying to buy cannabis on a Telegram group. Hodonovic had carried out several 'jobs', including having graffitied the Nato Cooperative Cyber Defence Center of Excellence in Estonia. The investigative site Re:Baltica revealed this year that Hodonovic was the last in a chain of at least four intermediaries, all operating on social media, that authorities believed led back to the GRU, Russia's military intelligence outfit. Each were in their twenties, and were being paid a few hundred Euros for every job completed. The case cast light on the kind of people who tend to get recruited for such operations. 'They are not the smartest people. They usually have a kind of criminal background. It's a gig economy: it's about money – fast money. Some of them really don't know who they are working for,' says Inga Springe, a reporter at Re:Baltica who has covered this and other Telegram-sabotage cases. Telegram recruitment was once the GRU's speciality. But since the war in Ukraine disrupted their networks, the SVR (foreign intelligence) and FSB (federal security) have also got in on the act. That, says Soldatov, makes attributing such operations to a single agency increasingly difficult. All these operations are aimed at raising the literal and figurative costs of supporting Ukraine. There are also second and third objectives: to lay the blame on Ukraine – and to intimidate. 'There was an open manifestation of these tactics a month ago when the SVR, Russia's foreign intelligence service, announced they were expecting attacks on Russian emigres in Europe by the Ukrainians,' Soldatov says. 'We know what that means: it is intimidation against people like us, Russian political emigres. And it simultaneously lays the blame on Ukraine if anything happens.' But that does not mean such operations will stop with a ceasefire, argues Soldatov. Russia's intelligence community operates on the deeply held conviction that the collective West is a threat, a view that it held long before the current war. The risks of the kind of operations seen across Europe in recent months and years are so low, and the potential benefits so large, that Moscow will have little reason to give them up, even in peace time. That is in the absence of a concerted European response, at least. Broaden your horizons with award-winning British journalism. Try The Telegraph free for 1 month with unlimited access to our award-winning website, exclusive app, money-saving offers and more.
Telegraph
08-04-2025
- Politics
- Telegraph
Is Russia recruiting migrants to carry out attacks on European soil? Germany may have uncovered a ‘smoking gun'
In May last year, a 25-year-old Afghan asylum seeker called Sulaiman Ataee walked onto a German market square, drew a hunting knife, and plunged it into the far-Right activist Michael Stürzenberger. In the 25 seconds of mayhem that followed in Mannheim, one policeman was fatally stabbed in the neck and six people who tried to intervene suffered knife wounds. Mr Stürzenberger survived – just. Ataee was shot, arrested and charged with murder. His trial began in February. Ataee, investigators later concluded, had become interested in the Taliban and been influenced by 'radical influencers and pseudo-Islamic scholars' on the Telegram messaging app. Now, new evidence suggests his attack may not only have been an act of Islamist terror – but part of a Russian subversion operation designed to sow chaos on Europe's streets in order to destabilise the West and undermine its support for Ukraine. It is a campaign that spans the vandalising of French Holocaust memorials and using foam to block exhaust pipes of cars in Germany, to the petrol bombing of a Latvian museum and arson in east London. Deadly attacks on German soil Russian subversion, sabotage and assassination programs long predate the February 2022 invasion of Ukraine. But the war has seen a surge in suspected attacks, especially since last summer. And while, previously, Russian agencies have focused on disrupting military supplies or gathering intelligence, many more recent operations seem designed to stoke social and political tensions, undermine public trust and boost far-Right parties opposed to sending aid to Kyiv. That in turn raises questions about a string of similar attacks that followed Mannheim. ZDF (Zweites Deutsches Fernsehen), a German broadcaster, has found that the phrases 'Michael Stürzenberger stabbed' and 'Michael Stürzenberger attack' were used in internet searches in Russia before the attack took place. There is also evidence of Russian internet users trying to access a webcam feed of Mannheim's town square, the scene of the attack, shortly before it occurred. The revelations could confirm suspicions that have long been circulating in the German intelligence community. Earlier this year, a senior German intelligence official told the Russian investigative journalists Andrei Soldatov and Irina Borogan that German agencies believed Russia had instigated a string of attacks by asylum seekers to inflate support for the pro-Kremlin Alternative for Germany (AfD) party, which opposes support for Ukraine, ahead of this year's election. To Soldatov, the latest revelations about the attack in Mannheim amount to something of a smoking gun and strengthen the theory espoused by the intelligence official. The new evidence 'fits a pattern that we see and hear from many corners,' he says. 'Sabotage tactics are not only about blowing stuff up – it is about raising the costs of providing support to Ukraine, including political costs. You don't need to have a sophisticated group of agents on the ground but if you can get someone to write something on a wall inciting hatred or blaming the Ukrainians, you can create costs.' The stabbing in Mannheim was the first of five knife attacks committed by immigrants ahead of the vote in February. In August 2024, a 26-year-old Syrian refugee killed three people and wounded eight more in a knife rampage through the city of Solingen. On Dec 22, a 50-year-old Saudi-born doctor drove a car into Magdeburg Christmas Market, killing six. A month later, a 28-year-old man from Afghanistan was arrested following the murders of a two-year-old boy and a 41-year-old man in the Bavarian city of Aschaffenburg. Then, on Feb 13, just 10 days before the election, a 24-year-old Afghan asylum seeker injured at least 30 people when he drove a car into crowds in Munich. All those attacks were carried out by foreign nationals. With the exception of the Magdeburg attack, the perpetrators were all under 30. The last four attacks have not, to date, been publicly linked to Russia except by the German official who spoke to Soldatov and Borogan. Ataee's links to Russian intelligence have not yet been established. Statements by investigators to the German press suggest he believed he was speaking to Islamists on Telegram, but have made no mention of Russia. Nor is the significance of the strange Russian internet activity obvious. Internet searches are not of themselves proof of conspiracy. Even assuming Russian complicity, there are multiple possible explanations. Could a low-level Russian intelligence officer have been googling to see whether a mission had been carried out? Was Ataee being handled by an agent, or agents, who failed to cover their tracks? Or did they want to be caught? The calling card A few weeks before the attack on Stürzenberger, a Berlin metal factory belonging to defence manufacturer Diehl went up in flames. It was, police said, an accident. Later, an (unnamed) allied country's intelligence service handed Germany's federal intelligence service, BND, a dossier showing it was arson and that Russia was behind it. And last month The Telegraph revealed that German security services had found what appeared to be a calling card: internet users in Russia had run searches in the weeks before and after the incident on what fire engines and fire safety protocols were in place at the factory. The sloppiness of the job was, a European security source suspected, deliberate. 'Russians are not as stupid as to leave that breadcrumb trail, sometimes they simply want us to find out they have flexed their muscles. It's part of the hybrid warfare,' the source, who had knowledge of the investigation into the incident, told The Telegraph in March. Calling card or incompetence, the pattern is clear, say European security experts. Russia has stepped up a campaign of sabotage across Europe in the wake of its attack on its neighbour. Russia and its ally Belarus have been blamed by Western officials for at least 59 incidents including cyberattacks, assassination plots and vandalism since the full scale invasion began, according to an investigation by the Associated Press, published in March. James Appathurai, the Nato deputy assistant secretary general for innovation, hybrid and cyber, this year called for the alliance to move to a 'war footing' to deal with the wave of train derailments, graffiti stunts, arson attacks and assassination plots linked to Moscow of late. Those operations are characterised by the 'Uberization' or 'gig economy' of sabotage – in which agents recruit third or fourth parties to carry out jobs on the cheap. 'It is extremely cheap. People who do it are not always in the know about what they are doing. And it is very difficult to counter,' says Soldatov. The perpetrators are seldom, if ever, actual Russian intelligence officers. They may even have no idea who they are working for. 'We've seen they're mostly financially vulnerable, often coming from former Soviet states in Europe,' says Maxime Lebrun, deputy director of research and analysis at Hybrid CoE, The European Centre of Excellence for Countering Hybrid Threats. 'They're mostly contacted through Telegram by an intermediary and offered money and given quite precise instructions for their deeds. The Telegram accounts disappear shortly after.' It is not only Germany that has been affected. In May 2024, red hands were spray painted on the Paris Holocaust memorial. A month later, coffins draped with the French flag and bearing the words: 'French soldiers of Ukraine' were left at the Eiffel Tower. Russia has been suspected in both incidents. 'The caskets at the Eiffel Tower were brought by a team of Bulgarian individuals who had also committed the red hands operations on the Shoah memorial in Paris,' says Lebrun. Operations in the East The attempts to sow discord ahead of the Paris Olympics are seen by some as the starting pistol of the current wave of subversion in Western Europe. But the tactics on display in Germany and France have already been tested further east. A remarkable look at the mechanics of the recruitment process came in 2023, when one would-be saboteur wrote down the disappearing Telegram messages so he could remember the instructions for his next job. He mistakenly dropped the folded sheet marked 'Mission, Lielvārde Military Airfield' while on the job – which led Latvian investigators and news outlet Re:Baltica to one Sergejs Hodonovič, a 21-year-old from Riga who had been recruited while trying to buy cannabis on a Telegram group. Hodonovic had carried out several 'jobs', including having graffitied the Nato Cooperative Cyber Defence Center of Excellence in Estonia. The investigative site Re:Baltica revealed this year that Hodonovic was the last in a chain of at least four intermediaries, all operating on social media, that authorities believed led back to the GRU, Russia's military intelligence outfit. Each were in their twenties, and were being paid a few hundred Euros for every job completed. The case cast light on the kind of people who tend to get recruited for such operations. 'They are not the smartest people. They usually have a kind of criminal background. It's a gig economy: it's about money – fast money. Some of them really don't know who they are working for,' says Inga Springe, a reporter at Re:Baltica who has covered this and other Telegram-sabotage cases. Telegram recruitment was once the GRU's speciality. But since the war in Ukraine disrupted their networks, the SVR (foreign intelligence) and FSB (federal security) have also got in on the act. That, says Soldatov, makes attributing such operations to a single agency increasingly difficult. All these operations are aimed at raising the literal and figurative costs of supporting Ukraine. There are also second and third objectives: to lay the blame on Ukraine – and to intimidate. 'There was an open manifestation of these tactics a month ago when the SVR, Russia's foreign intelligence service, announced they were expecting attacks on Russian emigres in Europe by the Ukrainians,' Soldatov says. 'We know what that means: it is intimidation against people like us, Russian political emigres. And it simultaneously lays the blame on Ukraine if anything happens.' But that does not mean such operations will stop with a ceasefire, argues Soldatov. Russia's intelligence community operates on the deeply held conviction that the collective West is a threat, a view that it held long before the current war. The risks of the kind of operations seen across Europe in recent months and years are so low, and the potential benefits so large, that Moscow will have little reason to give them up, even in peace time. That is in the absence of a concerted European response, at least.
BBC News
08-04-2025
- Politics
- BBC News
Germany wary of claims Russian influence behind spate of attacks
German security officials say they are carefully examining possible indications of foreign finance or influence in a series of attacks in German cities in the past they have reacted coolly to a German TV report suggesting suspicious internet searches were carried out in Russia before a deadly attack in Mannheim last year.A 26-year-old Afghan man has admitted a knife attack that targeted anti-Islam activist Michael Stürzenberger and killed a police officer in May last year, days before European elections.A ZDF TV report has now suggested that Russian Google searches days earlier had included "terror attack in Mannheim" and "Michael Stürzenberger stabbed". Digital intelligence analyst Steven Broschart told the public broadcaster ZDF's Terra X History programme that the searches were highly unusual: "it's pretty unlikely that we're talking about a coincidence here".He spoke of Russian internet searches for webcams in Mannheim's market square before the 31 May attack took broadcaster also highlighted fires inside parcels at a DHL cargo hub in Leipzig which Western security officials blamed on Russia's GRU military intelligence attack in August 2024 preceded regional elections in Saxony, and the head of domestic intelligence Stephan Joachim Kramer in neighbouring Thuringia told ZDF that "those who deal with this know we've actually been at war for a long time, even if it's not been declared".Police officer killed in Mannheim attackRussian 'test runs' targeted cargo flights to USThe trial of the man accused of carrying out the Mannheim attack, Sulaiman A, has heard how he became fascinated by jihadist group Islamic State and how he had ordered a knife online German cities have since been hit by attacks, including this year in Aschaffenburg and Munich, ahead of federal elections. The killings coincided with a spike in support for the far-right anti-immigration party, Alternative for ministry officials have not commented on ZDF's report on Russian internet searches four days before the Mannheim attack, other than to say the issue of "possible indications of targeted influence from abroad" was being taken were "no clear indications" so far, the spokesman told AFP news a spokesman for Germany's BND intelligence service voiced scepticism over the analysis of internet searches before last year's Mannheim attack."The results from Google Trends are unsuitable for presented analysis and evaluation methods and cannot be used with validity either," the spokesman told spokesman suggested that the the results were based on samples and searches that were too small, and that VPNs (Virtual Private Networks) that disguised the location of a search would not have been taken into the wariness of the intelligence response, former BND employee Gerhard Conrad warned that it would be "naive" not to pursue these violent crimes would certainly fit the "toolbox of what we now called hybrid measures, hybrid warfare", he domestic intelligence service warned only last week that Russian spies were using "espionage, sabotage and exertion of influence, including disinformation" to target Germany and the rest of Europe.
Local Germany
07-04-2025
- Politics
- Local Germany
Germany probing possible foreign influence in spate of attacks
The spate of attacks blamed on asylum seekers over the past 12 months, including stabbings and car-rammings, led to a bitter debate on migration ahead of EU elections last year and in the run-up to Germany's general election in February. In one case, an Afghan man is on trial over a stabbing spree at an anti-Islam rally in the city of Mannheim last May that killed a police officer and wounded several other people. Public broadcaster ZDF on Sunday reported that Russian online accounts had carried out searches about the Mannheim attack before it actually happened. An interior ministry spokesman on Monday did not want to comment on the ZDF report but said the government was investigating "possible indications of targeted influence from abroad" in relation to the attacks and that the matter was "being taken seriously". READ ALSO: What we know so far about the fatal car-ramming incident in Mannheim German security authorities are carrying out "ongoing checks", he said, although there were "no clear indications" of foreign influence so far. According to the ZDF report, Russian accounts carried out searches for "terrorist attack in Mannheim" four days before the stabbing. A memorial for victims of the car-ramming attack in Mannheim. Photo: picture alliance/dpa | Uwe Anspach Other search queries from Russia ahead of the incident reportedly included "attack in Germany" and "Michael Stürzenberger" -- the name of a prominent Islam critic who was wounded in Mannheim. The report also said suspicious online activity had been identified in the run-up to a fire caused by an exploding DHL parcel at Leipzig airport in July. Anonymous security sources told the Funke media group on Monday that "due to the algorithms, no reliable statements can be made about when exactly the search queries about the attack in Mannheim were made". Advertisement However, Greens MP and security expert Konstantin von Notz told ZDF that "it's quite obvious that... the evaluation and analysis of this digital evidence can be an important building block in getting closer to the truth". Dirk Wiese, a politician with Chancellor Olaf Scholz's Social Democrats (SPD), said the spate of similar attacks in the run-up to the February election was "very conspicuous". "Russia's involvement is anything but ruled out here," he said.
