German military intelligence names Russia the priority spy target

Germany's Military Counterintelligence Service, the Militarischer Abschirmdienst or MAD, said in its annual report released on 14 September that Germany is a prioritised target of Russian espionage activities. The service pointed to Germany's place in Europe and NATO, the expansion of the Bundeswehr, and the arrival of new weapons systems. The hybrid threat situation in Germany has continued to deteriorate, the report said.

MAD listed cyberattacks, drone flights, political influence work, and disruptive attacks on transport, energy and telecommunications. It said the threat of sabotage by recruited low-level agents, contract operators used for single tasks, has risen. The report gives no year-on-year counts. The service said comparative figures could help adversaries.

Russian services still use legal residencies, intelligence officers working under embassy or quasi-official cover. News organisations were named among the platforms of concern. MAD also warned that Bundeswehr personnel who travel to Russia or Belarus to visit family are targets for coercion. Relatives and travel records give those services a lever that does not require a classic walk-in recruitment.

China appears in a separate but related file. MAD said some secret reconnaissance of German military infrastructure, including drone flights and entries onto Bundeswehr sites, can be traced at least in part to Chinese intelligence. That sentence is carefully cut. It does not claim that every drone over a barracks is Chinese. It does say that a share of the pattern has a Chinese service behind it.

The report lands while German companies are doing the opposite of decoupling from China in their capital budgets. The German Economic Institute, using Bundesbank data, said German direct investment in China rose by about 5.6 billion euros in the first half of 2026, a third higher than a year earlier, while investment in the United States fell 65 percent. Espionage warnings and investment flows now run on parallel tracks. Boards are still writing cheques. MAD is still writing threat assessments.

Hybrid operations against Germany have a recent operational history that the report is folding into a trend. Attacks on rail, GPS interference, and unidentified drones over bases have already forced the armed forces and interior ministries to treat the home front as a contested space. Low-level agents are cheap. They do not need diplomatic immunity. They need a payment, a target and a way out. MAD's warning is that this method is being used more often because it is hard to attribute in time to stop the next job.

The Bundeswehr build-up is itself a reason for the attention. New air defence, long-range strike and ammunition plants are exactly the kind of programmes foreign services want to map. Personnel growth means more people with clearances and more family links that can be worked. MAD's job is to watch those people. The report is also a message to them: travel to Russia or Belarus is now treated as a vulnerability, not a private trip.

Attribution will stay messy. Drone sightings rarely produce a passport. Cyber intrusions can be routed through cut-outs. The service's decision to name Russia as the priority target and China as a source of some military reconnaissance is therefore a policy statement as much as a finding. It tells ministries where to put money and tells allies what Berlin is prepared to say in public.

What the report does not do is quantify success. There are no tables of disrupted cases, expelled officers or prosecuted agents. Readers are asked to accept a directional claim: worse hybrid conditions, more contract sabotage, more interest in German weapons and bases. For a country that is rearming while remaining an export economy tied to China, that combination is the strategic fact of 2026. The MAD report puts it on the record. The investment figures published the same week show how little the record has yet changed corporate behaviour.