Germany Expelled Russia’s Diplomat-Spies. Now Moscow Rely on Cyber, Sabotage and Proxies

The change is more consequential than the headline number suggests. What is disappearing is not simply a Russian diplomatic presence. Germany is dismantling an entire model of espionage built around embassy personnel, diplomatic immunity and long-term access.

In its place is emerging a more fragmented and unpredictable form of confrontation.

From diplomatic cover to counterintelligence containment

The decisive break came after the discovery of the atrocities in Bucha in April 2022. Germany declared 40 Russian diplomats personae non gratae, the first major expulsion since the invasion. Most of those removed were intelligence officers operating under diplomatic cover at the Russian Embassy on Unter den Linden in Berlin.

A second major wave followed in April 2023. Russia responded by imposing strict limits on the number of German diplomatic, consular and cultural personnel allowed to remain on its territory. The consequences reached far beyond traditional diplomacy: hundreds of German public servants, educators and cultural workers were forced to leave Russia.

Berlin then moved to reduce Russia's diplomatic footprint further, closing four of the five Russian consulates general in Germany. German consulates in Kaliningrad, Yekaterinburg and Novosibirsk were also closed.

The result is a diplomatic relationship reduced to a narrow administrative core. The Russian Embassy in Berlin and its Consulate in Bonn remain, but the extensive network that once provided Moscow with both political reach and intelligence infrastructure has been severely curtailed.

That matters because diplomatic missions are not merely buildings. For intelligence services, they provide secure communications, logistical support, official identities and a relatively protected environment in which handlers can recruit and direct agents.

Germany has taken away much of that infrastructure.

It has not, however, taken away Moscow's incentive to collect intelligence.

The Berlin embassy connection

The case of Ilona W. illustrates why the expulsion of the Russian Deputy Military Attaché in January 2026 was more than another diplomatic tit-for-tat.

German federal prosecutors arrested the dual German-Ukrainian citizen on January 21, accusing her of spying for Russia's military intelligence service, the GRU. Investigators said she had worked for the organisation since November 2023, collecting information on Germany's defence industry, drone testing and high-level political events connected with the war in Ukraine.

She also helped her Russian handler obtain unauthorised access to restricted events by using false identities.

That handler was identified as the Deputy Military Attaché at the Russian Embassy in Berlin. On January 22, the German Foreign Office declared him persona non grata.

The episode exposes the practical value of diplomatic cover. The intelligence operation did not depend solely on a Russian official gathering information himself. The official presence created the relationship, managed the source and provided the institutional infrastructure behind the operation.

Once that officer was expelled, the formal diplomatic mechanism was broken.

Russia responded in familiar fashion. Its Foreign Ministry summoned the German ambassador, issued a protest and on February 5 declared a German Embassy employee in Moscow persona non grata.

Such retaliation is now almost routine. The more important question is what happens after the diplomatic exchange has ended.

The disposable-agent problem

The answer is increasingly visible in German security cases.

Russian intelligence services have adapted by relying more heavily on civilian proxies recruited through digital platforms such as Telegram. Some are third-country nationals. Others are dual nationals. Their value lies precisely in their distance from the diplomatic infrastructure that Germany has been dismantling.

These agents are cheaper, more difficult to connect directly to the Russian state and easier to abandon if an operation fails.

They are also considerably less reliable.

That trade-off is central to the new intelligence environment. Embassy-based networks offered Moscow continuity: handlers could cultivate sources over time, coordinate operations and operate from a stable institutional base. Disposable agents offer something different - speed, deniability and access to people or locations that might otherwise be difficult to reach.

The Bayreuth case showed how this model can move from intelligence gathering to physical disruption. In April 2024, German-Russian dual nationals Dieter S. and Alexander J. were arrested in Bavaria over an alleged plot involving explosives and arson against military and transport infrastructure, including the US military base at Grafenwöhr, where Ukrainian troops train.

Other cases have pointed towards the same evolution.

A former senior officer in Germany's Federal Intelligence Service, Carsten L., was arrested after allegedly passing classified information to Russia's FSB through an intermediary, including coordinates connected with HIMARS and air-defence systems in Ukraine. The case demonstrated that the vulnerability does not disappear simply because foreign intelligence officers lose diplomatic cover: Russia can also seek access from inside Western institutions.

Meanwhile, German counterintelligence and international partners warned in September 2024 about cyberespionage and destructive activity associated with GRU Unit 29155 against NATO and EU infrastructure.

The battlefield for Russian intelligence is therefore becoming less identifiable as an embassy operation and more embedded in Germany's wider security and industrial landscape.

Germany's defence industry is now part of the target

This is particularly significant because Germany occupies a central position in military support for Ukraine.

Its territory hosts major defence manufacturing clusters and facilities supporting NATO and Ukrainian military logistics. Bavaria and Thuringia have become relevant not only as industrial centres but as potential intelligence targets.

In spring 2026, Romanian national Alla S. and Ukrainian national Serhiy N. were arrested in Germany and Spain over allegations that they conducted GRU-directed surveillance of a Bavarian defence executive whose company manufactures military drones for Ukraine. Investigators linked the surveillance to preparations for a possible assassination or sabotage operation.

In August, a 33-year-old man was arrested in Thuringia on suspicion of scouting premises belonging to Bavarian defence enterprises for potential sabotage.

The pattern is revealing. Moscow's intelligence problem has changed, but its targets have not.

The objective remains access to information and disruption of European support for Ukraine. What has changed is the route.

An embassy officer with diplomatic immunity is comparatively easy for a counterintelligence service to identify and expel. A civilian recruited online, a compromised insider or an individual conducting physical surveillance presents a different challenge. There may be no embassy connection to expose, no diplomatic status to revoke and no obvious institutional structure to dismantle.

For German security services, this means the job has shifted from monitoring foreign diplomatic activity towards preventing operations that may begin almost anywhere in society.

The price of closing the old system

Germany has gained considerably from reducing the number of Russian intelligence officers operating under official cover. The BfV, BND and Federal Prosecutor's Office now face a smaller pool of foreign operatives with diplomatic protection, while cooperation with Western allies has strengthened.

But Berlin has also paid a diplomatic price.

Russia's reciprocal restrictions have forced German institutions to retreat from parts of the country where they had maintained a presence for decades. The limits imposed on German diplomatic, consular and cultural personnel have affected organisations such as the Goethe-Institut as well as German consular networks.

This is one of the less visible consequences of the counterintelligence confrontation. Cutting Russian diplomatic infrastructure in Germany has made Germany safer in one respect while shrinking its own institutional reach inside Russia.

That asymmetry matters because the post-Cold War assumption of extensive bilateral engagement has effectively collapsed.

The old architecture was built around the idea that diplomacy, trade, culture and intelligence could coexist within the same relationship, even when relations were difficult. Germany now operates on a fundamentally different premise: some elements of that relationship have become security liabilities.

The harder problem is what comes next

Expelling diplomats is an unusually visible form of counterintelligence. It produces a clear result: an identified foreign intelligence officer leaves the country.

Proxy warfare is less accommodating.

Germany can expel a diplomat. It cannot expel every individual who might be recruited through Telegram. It can dismantle a consulate. It cannot dismantle every potential route into a defence company, transport network or critical infrastructure facility.

That is the strategic tension created by the collapse of Russia's traditional intelligence presence.

Moscow has lost the secure, institutionalised operating environment that diplomatic cover provided. But the loss of that environment has pushed Russian intelligence towards methods that are more decentralised and potentially more disruptive. The Kremlin now has to trade the continuity and protection of embassy networks for agents who may be inexperienced, exposed and disposable.

For Germany, the challenge is no longer simply to keep Russian spies out of diplomatic buildings.

It is to ensure that the disappearance of those spies does not create the illusion that the intelligence war has disappeared with them.