German federal prosecutors arrested Vadym Y, a Ukrainian national, in Brandenburg on Thursday on suspicion of spying for Russia's secret service since at least July 2025. The suspect allegedly gathered military intelligence on armoured vehicle production, ammunition and explosives manufacturing, military personnel, and NATO eastern-flank defence installations. An intermediary facilitated the connection to Russian intelligence. The arrest lands in a rapidly escalating threat environment. Germany's armed forces on Wednesday raised the Russian sabotage threat level to "significant" — their second-highest internal rating — for the first time. The trigger: a drone laden with high explosives discovered crashed near the Wunstorf airbase in Lower Saxony in mid-September, bearing resemblance to another explosive-carrying drone used in a failed attack at Leipzig/Halle airport in August. The two drone incidents differ in targeting profile. The Leipzig drone reportedly targeted civilian cargo aircraft. Investigators believe the Wunstorf drone targeted military aircraft — a direct escalation from economic disruption to military attack capability. Both incidents remain under investigation, with German media reporting from internal military documents. Beyond drones, German authorities have documented a pattern of suspected Russian reconnaissance: drones flown over a missile defence site in Saxony-Anhalt and a camouflaged camera found filming a strategically important railway station in Minden, North Rhine-Westphalia. The infrastructure being surveilled is not random — it maps NATO logistics and air defence architecture. BND chief Martin Jaeger told the Bundestag's intelligence oversight committee this month that Russia's undeclared shadow war has "taken on a new, more dangerous character" and warned that "Germany is at risk of being drawn into a violent conflict with Russia." Chancellor Friedrich Merz, speaking from the EU-Western Balkans Summit in Montenegro, said he was "not surprised" by the espionage arrest. Moscow denied involvement, maintaining its standard position that it conducts no sabotage or hybrid attacks on European nations. The denial sits against a growing forensic record: explosive drones, reconnaissance operations, and now an intelligence asset inside Germany feeding NATO facility data to Russian handlers. The structural picture is a Russian hybrid campaign operating across multiple domains simultaneously — human intelligence, armed drone strikes, surveillance of critical infrastructure — inside the territory of NATO's largest European member. Germany's response so far has been defensive: raising threat levels, investigating incidents, making arrests. The question is whether this posture holds as the campaign's character shifts from espionage to kinetic operations.
