Russia recruits sympathizers online for sabotage in Europe, officials say

The suspect, a German citizen born in Russia, was discussing over an encrypted messaging app potential targets in Germany — including on the U.S. facility in the town of Grafenwoehr — with an individual with ties to Russia’s military intelligence service, according to six Western security officials.

Dieter Schmidt, 39, and an alleged co-conspirator were charged with espionage in April, the first arrests in Germany of alleged saboteurs working for Moscow. Europe has in the months since been grappling with a rapid increase in Moscow-led sabotage attacks or plots as Russia turns its focus to increasing the cost of Western support for Ukraine.

“Russia is fighting the West in the West, on Western territory,” said a senior NATO official who, like others, spoke on the condition of anonymity to discuss sensitive material. “Our focus is really sharpening on this.”

Secretary of State Antony Blinken said “virtually every ally” at a NATO meeting in Prague last month raised the issue of “the Kremlin … intensifying its hybrid attacks against front-line states, NATO members, setting fire and sabotaging supply warehouses, disregarding sea borders and demarcations in the Baltics, mounting more and more cyberattacks, continuing to spread disinformation.”

The question of how far Moscow will escalate its efforts and how the West should respond will consume part of this week’s NATO summit in Washington. Western officials say the Russian operations they detected seem designed to stay below the threshold of an open armed attack while stirring public unease, and their numbers are growing.

In Britain, four men were charged in April with carrying out an arson attack on a London warehouse containing aid for Ukraine; authorities said the attack was paid for by Russian intelligence. At the beginning of May, a fire broke out at the Diehl weapons factory just outside Berlin — and investigators said they are examining a possible link to Russian intelligence. In Poland, also in May, an arson attack burned down a mall outside Warsaw and soon after Polish police arrested nine men, alleging they were part of a Russian ring involved in “beatings, arson and attempted arson,” including an arson attack at a paint factory in Wroclaw and at an Ikea store in Lithuania.

In June, French police arrested a Russian-Ukrainian dual national for allegedly planning a violent act after materials intended to build explosive devices were found at his hotel room outside Paris following an apparently accidental explosion in his room. The Czech Prime Minister Petr Fiala said a Latin American man accused of an attempted arson attack on a bus depot in Prague last month was “probably” financed and hired by Russian operatives.

A trove of Kremlin documents obtained by a European intelligence service and reviewed by The Washington Post illustrate the breadth of Russia’s efforts to identify potential recruits.

The documents show that in July 2023, Kremlin political strategists studied the Facebook profiles of more than 1,200 people they believed were workers at two major German plants — Aurubis and BASF in Ludwigshafen — to identify employees who could be manipulated into stirring unrest.

The strategists drew up excel spreadsheets analyzing the profiles of every worker, highlighting posts that demonstrated the employees’ anti-government, anti-immigration or anti-Ukrainian views.

At the BASF chemical plant, special attention was paid to the workers’ attitudes toward the closure of several facilities at the plant in spring 2023 because of soaring production costs, including natural gas price hikes, which led to the loss of 2,600 jobs. At the Aurubis metals plant, the strategists noted anti-immigrant views in the posts of some of the workers, one of the documents shows.

“We can concentrate on inciting ethnic hatred,” one of the strategists wrote. “Or on organizing strikes over social benefits.”

German officials said they were unaware of any incidents at BASF or Aurubis that could be tied to Russia, but added they took the Kremlin activities very seriously and believe they illustrate how Moscow is using social media to recruit operatives.

Daniela Rechenberger, a spokesperson for BASF, declined to discuss any workers but said the company is “constantly strengthening its capabilities to prevent, detect and respond to security risks.”

Christoph Tesch, a spokesperson for Aurubis said, “We have no evidence of this — nor are we aware of any social unrest in the company.”

Kremlin spokesman Dmitry Peskov told The Post that the allegations of Russian sabotage activity were “no more than a stoking of Russophobic hysteria.”

“All these suppositions and allegations are not based on anything,” he said, adding that the authenticity of what was claimed was “more than doubtful.”

The expulsion of hundreds of suspected Russian intelligence officers serving under official cover as diplomats immediately after Russia’s invasion of Ukraine was aimed at curbing Moscow’s ability to conduct covert operations. But increasingly, officials said, Moscow is working through proxies including those it recruits online.

“The way that we tried to react was the way that we would have acted during the Cold War. But it is not the way that Russia operates right now,” said Gabrielius Landsbergis, Lithuania’s foreign minister, in an interview. “Social media alone provides a lot of opportunities to find people who would assist them in their activities. So you might not need to even have a handler in NATO countries if you can do it online.”

While operating through social media presents a greater risk of detection, Moscow seems willing to cast an indiscriminate net in its search for allies. Communications through encrypted apps and a seemingly random target set add to the challenges in uncovering Russian operations, officials said.

“It is extremely decentralized,” said Landsbergis. “It could be refugees, people who are down on their luck. It could be criminals, basically, anybody who thinks that earning a couple thousand euros [committing sabotage for Russia] is a good idea and maybe the risk is not too high.”

Russia may also believe outsourcing such operations offers it a degree of deniability while still maximizing the potential for creating chaos, officials said. “They do what is possible,” one senior European security official said.

One Russian academic with close ties to senior Russian diplomats insisted it was not possible to connect Moscow to all of the incidents cited by Western security officials. “But if this conflict continues, then each side will turn more and more to such distorted methods of battle,” he added.

Schmidt, the man arrested for casing the U.S. military facility in Germany, had posted on Facebook about his exploits fighting with Russia-backed separatists in eastern Ukraine between 2014 and 2016. His deployment appears to be a successful case of identifying potential ideological allies, German security officials said. Law enforcement officials said they are still investigating whether Schmidt received any financial compensation for his efforts.

Schmidt, who has both German and Russian citizenship and moved to Germany as a teenager, was also tasked with finding others within the German-Russian community in Bayreuth, his hometown in Bavaria, who could assist with the sabotage mission, investigators said.

One such recruit was Alexander Jungblut, another Russian-born German, who was arrested in April alongside Schmidt and also charged with espionage.

“Jungblut mainly did internet research and supported Schmidt,” a German security official said, including gathering information on an American company with branches in Bavaria.

Attorneys for Schmidt and Jungblut did not respond to requests for comment.

NATO Secretary General Jens Stoltenberg said in June that alliance defense ministers had agreed to increased intelligence exchange, enhanced protection of critical infrastructure and further restrictions on Russian intelligence operatives to curb Moscow’s operations.

But Lithuania’s Landsbergis said a much greater effort was required. “It doesn’t look from our perspective that Russia is specifically avoiding casualties,” Landsbergis said. “It is just a coincidence there haven’t been any yet. We will need to have a reaction … When Russia is escalating into our territory, the best way to react is to allow Ukraine to escalate back.”

Belton reported from London and Rauhala from Brussels. Cate Brown in Washington and Ellen Francis in Brussels contributed to this report.