Two European counterintelligence actions in 48 hours point to Russian collection against NATO's defence supply chain through both agents and diplomatic cover.
Intelligence Lead
Germany arrested a Ukrainian national on 22 October on suspicion of gathering information on armoured-vehicle, ammunition and explosives production for a Russian intelligence service, and Austria ordered four Russian diplomats out the next day. Together the cases indicate Moscow is working the same target set, European defence production feeding NATO's eastern flank, through deniable intermediaries and through embassy and OSCE-mission cover. Both actions rest on prosecutor and ministry statements that have not been tested in court.
Situation Report
According to AFP, German police arrested a man identified only as Vadym Y. on Thursday in the Oder-Spree district of Brandenburg, east of Berlin. The Federal Criminal Police Office made the arrest on information from the domestic security service, the BfV. Federal prosecutors allege that at least since July 2025 he was in contact with a Russian intelligence service through an intermediary, and that he gathered militarily relevant information from Germany, including details on the production of armoured vehicles, ammunition and explosives, and on personnel and facilities at locations meant to secure NATO's eastern flank. Prosecutors say he collected open-source material but also specifically targeted individuals in the European defence industry. UNITED24 Media, citing Tagesschau, reports the suspect is 53, from Russian-occupied Luhansk, and was due before an investigating judge at the Federal Court of Justice on 23 October; the outcome is not confirmed. No firm or site has been named, and the Russian service involved has not been identified.
On 23 October Austria declared four Russian diplomats persona non grata. Reporting based on Profil and Heute indicates three worked at the Russian embassy in Vienna and one at Russia's mission to the OSCE, reportedly in military security and arms control. The foreign ministry said they had engaged in activities incompatible with their diplomatic status. The names and the alleged activities were not disclosed. Euromaidan Press, citing TASS and AP, reports Russian Deputy Foreign Minister Dmitry Lyubinsky called a Russian response unavoidable; that attribution has not been independently verified here.
Background & Context
The Vienna action follows the May 2026 expulsion of three Russian embassy staff over suspected interception equipment, and Reuters, cited by Euromaidan Press, counts 18 Russian diplomats expelled by Austria since 2020. An analysis of Russian mission staffing by RuPEP, reported by The Insider, found at least 20 of 117 officially listed employees with likely SVR, GRU or FSB ties. Vienna has long been described as a major hub for Russian intelligence activity in Europe, with the OSCE and UN presence providing accreditation and targets.
The German arrest sits within a rising caseload. BND president Martin Jaeger told the parliamentary oversight committee this month that Russia's shadow war against Germany has taken on a new, more dangerous character. German investigators attributed an explosive-laden drone operation at Leipzig/Halle airport in September to Russia's GRU, according to UNITED24. Denmark arrested two men on 21 October for allegedly photographing an anti-drone firm after a Telegram offer of payment. The Hanning case, the alleged sale of some 2,000 BND documents, remains under investigation.
Analysis & Assessment
The cases are assessed as two layers of one collection effort. The reported Brandenburg suspect fits the pattern of recruited, expendable intermediaries who reduce exposure for Russian officers after successive diplomatic expulsions. Diplomatic-cover officers in Vienna remain the supervisory and analytic layer, with access to arms-control and military-security forums. Whether the two are connected is unknown, and nothing published links them.
The target choice is the consistent signal. Armoured vehicles, ammunition and explosives are the Ukraine-support and eastern-flank reinforcement pipeline, so mapping people and plants is consistent with targeting, recruitment or sabotage preparation. Prosecutors have not stated which purpose applied, and the allegation remains untested.
Expect Moscow to retaliate against Austria in kind, and expect more arrests of low-level collectors across Germany, the Nordics and Poland. Allegations that depend on single-source press accounts, including the Lyubinsky reaction and the suspect's profile, should be treated as provisional until prosecutors or the court confirm them.