Lyce · Hybrid Watch

hw_6977e4d4bf309903

Germany: arrests over suspected surveillance of Donaustahl chief

View this signal on the map

German prosecutors announced two arrests on 24 March 2026 over suspected surveillance of a Germany-based supplier of drones and components to Ukraine. The arrest warrants allege work for a Russian intelligence service beginning in December 2025. The Insider, citing Die Zeit, identifies the target as Donaustahl founder Stefan Thumann and reports an alleged assassination plan, while noting that the arrest warrant cites espionage, not a murder-plot theory. These are allegations, not a conviction. The date shown is the arrests, not the beginning of surveillance.

Occurrence
Publication
First observed
Review status
Reviewed
Countries
Germany
Updated

Attribution

Not specified

Facts

Established

  • German prosecutors announced the arrests of Sergey N. in Spain and Alla S. in Germany on 24 March 2026.
  • The Insider's account of Die Zeit states that the arrest warrant cites suspected espionage and does not include the murder-plot theory.

Alleged

  • According to the prosecutors, Sergey N. began surveillance in December 2025 and Alla S. took over no later than March 2026.
  • Die Zeit's investigation, relayed by The Insider, reports an alleged planned assassination of Stefan Thumann.
  • The Insider, citing Die Zeit, identifies Donaustahl founder Stefan Thumann as the target of the surveillance.
  • The arrest warrants allege that the surveillance was carried out on behalf of a Russian intelligence service.
  • The arrest warrants allege that the suspects gathered information online and filmed the drone supplier's workplace.
  • The press investigation attributes the suspected operation to Russian intelligence services.
  • The report describes surveillance of Thumann's home in Strasskirchen and says he is under heightened protection.

Unknown

  • The press account does not establish a final judicial finding of Russian state responsibility or identify the service in the arrest warrant.
  • This report does not establish Russian state responsibility through a judicial verdict.

Sources

  1. Role
    Primary evidence
    Publication

    The Insider, citing Die Zeit, identifies Stefan Thumann of Donaustahl as the surveillance target and reports an alleged assassination plan. Its account states that the arrest warrant cites suspected espionage and does not include the murder-plot theory.

  2. Role
    Corroborating evidence
    Publication

    German prosecutors said that Sergey N. and Alla S. were arrested on suspicion of spying on a Germany-based supplier of drones and components to Ukraine. The arrest warrants allege surveillance for a Russian intelligence service, beginning in December 2025.

  3. Role
    Discovery lead
    Publication

    German federal prosecutors announced the arrest of two individuals suspected of acting on behalf of Russian intelligence to gather information on a person supplying drones and related components to Ukraine. According to the investigation, the suspects conducted surveillance and collected intelligence on the target, including documenting movements and activities connected to defence-related production and logistics. Prosecutors indicated that the intelligence-gathering was not an isolated act but part of preparations for a potential sabotage operation against a defence-linked individual or supply chain. One suspect was arrested in Germany and another in Spain, demonstrating the cross-border nature of the operation and coordination between European security services. The case highlights how Russian-linked activities increasingly target European defence-industrial networks that support Ukraine, rather than only military installations themselves. The focus on drone supply chains is particularly significant, as unmanned systems are a critical component of Ukraine’s battlefield capabilities. German authorities treated the case as a serious national security issue, reflecting concerns about escalation from espionage into physical sabotage or targeted attacks. While no attack was ultimately carried out, the preparatory nature of the activity fits the pattern of hybrid operations designed to create vulnerability and uncertainty. The use of proxy individuals rather than direct Russian operatives aligns with broader hybrid tactics aimed at maintaining deniability while conducting hostile actions. The incident demonstrates how intelligence-gathering itself can function as a precursor to sabotage, especially when directed at strategic sectors such as defence manufacturing and logistics.