Prosecutors allege a Russian intelligence service used a messaging-app handler and a bait offer to put cheap collectors outside a manufacturer supplying Ukraine.
Intelligence Lead
Danish prosecutors have charged two young Ukrainian men with espionage after they allegedly photographed the premises of MyDefence, a counter-drone manufacturer, and passed the images to a Telegram user. Prosecutors told the court they believe a Russian intelligence service was involved, without naming which. The case, if the allegations hold, is a live example of the low-cost, deniable collection model that Danish authorities have warned about for weeks.
Situation Report
Police in North Jutland detained two Ukrainian men, aged 18 and 21, on 19 October at or near MyDefence's site in Nørresundby, near Aalborg. They appeared before the court in Aalborg on 20 October, where they were charged with espionage; Brussels Signal reports the charge falls under section 108 of the Danish criminal code. The hearing was held behind closed doors at the prosecution's request. According to reporting based on Danish broadcaster DR, the court found no grounds to remand the men but allowed police to hold them for a further three days. Both deny the charges, through defence lawyer Rasmus Amandusson, who represents the 21-year-old.
Prosecutors allege the men photographed the company's premises and sent the images to a Telegram user. DR, as relayed by Daily Northern, reports the charges describe that user as ultimately linked to a Russian intelligence service. Brussels Signal reports prosecutors told the court they believed a Russian service was involved. Police said the case is being handled in cooperation with the intelligence services. PET and North Jutland Police declined to comment on DR's information because the investigation is ongoing. DR also reports a third suspect may be at large; Brussels Signal refers to unidentified accomplices.
DR reports that a post circulated from 16 October in a Danish-Ukrainian Telegram group of more than 5,000 members, offering a free television and microwave from a closing Aalborg office. The post gave no address and asked respondents to make contact directly. A woman told DR her 18-year-old son and an acquaintance went to collect the items on 19 October and she could not reach him the next morning. DR says it does not know what occurred after the men answered the post, or what led to the photographs. A separate 19 October post seeking photographs of architecture in Aalborg has not been linked to the case. The accounts of the giveaway rest on one broadcaster and remain unverified.
Background & Context
MyDefence is described by Brussels Signal as a counter-drone manufacturer that has supplied equipment to Ukrainian forces for several years. Its chief executive, Dan Hermansen, said last year that the company had been the target of a Russian cyberattack. The company declined to comment on this case. Another outlet, JFeed, describes customers including NATO forces and the US and Australian armies; that claim is unsourced and is treated here as unconfirmed.
The arrests follow a pattern Danish officials have been publicising. According to Brussels Signal, PET stated in September that Russian services were actively preparing sabotage against Danish defence companies and recruiting ordinary Danes through social media. Justice Minister Nicolai Wammen urged people offered 5,000 kroner to photograph the local defence industry to refuse. PET has warned that even a simple photography task can help prepare sabotage. Drone incursions forced several Danish airports to close in September 2025, an incident Copenhagen attributed to a professional actor.
The use of recruited intermediaries rather than staff officers is established Russian practice across Europe, where services have drawn on paid, expendable agents found online to reduce the exposure of their own personnel after waves of diplomatic expulsions.
Analysis & Assessment
The reported facts fit the gig-agent model closely: an anonymous handler, an inducement posted to a large community group, a task that looks harmless, and collectors with little training. Photographing a site perimeter is typical pre-operational surveillance, whether for later sabotage, targeting or simply mapping security routines. Which of those purposes applied here is not established and nothing in the public record points to a specific follow-on plan.
Two cautions apply. First, the Russian link is a prosecution assertion made in a closed hearing and relayed through media; no court has tested it, and the defendants dispute the charges. The giveaway narrative, if accurate, would also raise the possibility that at least one man was an unwitting participant, which is a question for the court, not for this brief. Second, differing reports on how long the men have lived in Denmark, from a few months to under a year, are unresolved.
The strategic signal is the target choice. A firm that builds counter-drone systems sits at the intersection of Ukraine support and NATO force protection, so interest from Russian services is unsurprising. Expect further disclosures from PET if the third suspect is found, and expect the Danish Telegram communities to face scrutiny. A reasonable working assumption is that similar recruitment offers are circulating against defence suppliers elsewhere in the Alliance.