According to the German newspaper Frankfurter Allgemeine Zeitung, the Bulgarian nationals detained in connection with the Munich arson attack were working for Russia’s Main Intelligence Directorate (GRU). The incident is part of an escalating pattern in recent months of the Kremlin targeting Europe through hybrid warfare. Bulgarian nationals are suspected of involvement in the Munich arson attack; explosives used in the attempted attack at Leipzig Airport reportedly passed through Bulgaria; and in 2025, six Bulgarian citizens were convicted in the United Kingdom of spying for Russia. The role of Bulgarian nationals in the Kremlin’s hybrid war against the West is growing alongside the intensity of these attacks, yet the issue is being completely ignored by politicians in Sofia.
On 3 September 2026, two incendiary devices were thrown from a car at a construction site in Munich. One of the devices caused a small fire, which was quickly extinguished by responding police officers, while the other failed to ignite. The offices of Rohde & Schwarz and Helsing are located in the immediate vicinity of the construction site.
Rohde & Schwarz specialises in communications and defence technologies, while Helsing develops AI-operated systems and drones used by Ukraine on the battlefield.
The authorities believe that the incident was carried out by “low-level agents”, judging by the amateur methods employed. Shortly afterwards, two Bulgarian nationals were arrested: 28-year-old Gabriela M. and 38-year-old Dimitar T. They were charged with attempted arson and criminal damage and remanded in custody pending trial. Three apartments were searched and numerous items were seized. According to local media, Dimitar and Gabriela were already known to the German authorities in connection with espionage and politically motivated offences.
On 25 September 2026, the German newspaper Frankfurter Allgemeine Zeitung (FAZ) reported that the authorities had established a link between the two suspects and Russia’s Main Intelligence Directorate (GRU). According to the newspaper, Gabriela and Dimitar are members of a group operating from Slovakia.
Investigators blame the GRU for the attempted arson and claim that it was also behind the attack at Leipzig Airport, where, on 4 August 2026, a drone carrying explosives was found near a Ukrainian Antonov cargo aircraft. A Bulgarian connection was also identified in that case: investigators allege that the explosives carried by the drone had been transported through Bulgarian territory.
In recent months, we have witnessed an escalation in the Kremlin’s hybrid attacks against Europe. According to experts, Putin is attempting to test how far he can go without triggering Article 5 of the North Atlantic Treaty – the principle of collective defence at the heart of NATO, under which “an attack on one is an attack on all”. Through its hybrid attacks, the Kremlin also seeks to destabilise Western countries and sow division among their populations.
In the United Kingdom, Joshua Cammidge has been accused of spying on drone manufacturers in the Swindon area and passing information to Aiden Minns, who works with the GRU’s Volunteer Corps. According to the charges, Cammidge offered to help Minns sabotage the factories.
In August 2026, a Ukrainian national was arrested in Thuringia, Germany, on suspicion of spying for Russia on arms manufacturers in Bavaria.
In Bulgaria, warehouses connected to the arms manufacturer EMCO caught fire twice in the space of just a few months. Following the first incident, Interior Minister Demerdzhiev rushed to conclude that there had been no external interference before the investigation had even begun. After the second, he blamed the warehouse’s security personnel for negligence.
In May 2025, six Bulgarian nationals were convicted in the United Kingdom of spying for Russia, and some of them had been released by July 2026.
Sources:
Der Spiegel
The Insider
Frankfurter Allgemeine Zeitung (FAZ)
BBC
The Kyiv Independent
Leave a Reply