Targeting Defence Chiefs: How Russia’s Shadow War Hit Germany

A Duel in the Shadows

For Stefan Thumann, managing director of the Bavarian defence startup Donaustahl, this shadow war turned personal without warning. Federal security agents pulled him aside to deliver a grim briefing: foreign intelligence services were actively tracking him. The intelligence pointed to a coordinated plot involving disposable local recruits, physical surveillance around his home, and intercepted communications discussing Novichok nerve agents.

Within days, Thumann’s routine evaporated. He signed organ donor consent forms, updated his will, and went into hiding under round-the-clock armed guard. He now lives out of suitcases, constantly shifting locations while managing a company that builds specialized kamikaze drones for Ukrainian forces. Thumann describes the situation plainly as a direct duel for survival with foreign military intelligence—one he refuses to walk away from.

His experience is not an isolated crisis. Western intelligence agencies recently disrupted a plot to assassinate Armin Papperger, chief executive of Rheinmetall, Germany’s primary arms contractor supplying heavy artillery shells to Kyiv. Coupled with the Leipzig airport incident, where technicians intercepted drones near Ukrainian cargo aircraft and commercial DHL routes, a pattern becomes obvious. Foreign state operatives are no longer restricting themselves to digital espionage; they are targeting physical infrastructure and human targets across Europe.

Running a defence firm now means living under constant threat management. Executive calendars are built around counter-surveillance sweeps, bodyguards, and emergency protocols. The strategy behind these attacks is cold but logical: intimidate corporate leadership, disrupt decision-making, and slow down arms production by exploiting the openness of democratic societies.

The Human Cost of the Shadow Front

Living under constant threat takes a heavy psychological toll that boardrooms were never built to handle. Corporate discussions that once focused on supply chains, quarterly margins, and tax policy now revolve around tactical evacuation routes, counter-surveillance, and armored transport. Executives are dropping out of public life, skipping trade shows, and scrubbing personal details online to keep their families off intelligence radar screens.

That pressure spreads down the ladder. Senior engineers, software developers, and plant managers know they are also targets. Hostile intelligence services realize that modern defence manufacturing depends on specialized technical talent that takes years to replace. Sowing fear among key personnel is an effective way to trigger operational delays. To keep staff from walking away, companies are pouring money into psychological support, counter-intelligence training, and strict internal security checks.

The Breakdown of Peacetime Protections

The traditional boundary between private corporate management and state defense has dissolved. Business leaders who spent their careers managing commercial risk and supply schedules now find themselves navigating direct physical threats from foreign intelligence services.

Guarding these companies requires resources far beyond standard private security. Startups and major prime contractors alike are taking on massive security overhead, spending heavily on physical site hardening, perimeter monitoring, and round-the-clock security teams—costs that private balance sheets were never designed to absorb indefinitely.

The physical threat environment has forced an abrupt political shift in Berlin. German leadership has abandoned its usual measured rhetoric, warning publicly that foreign state actors are operating with total disregard for civilian lives and critical infrastructure.

While law enforcement works to finalize formal attribution for the Leipzig incidents, government officials have made clear that foreign state involvement is the primary line of investigation. Berlin insists these attacks will not alter its broader strategy: Germany intends to remain Kyiv’s primary European military backer, arguing that steady support is the only way to eventually bring Moscow to negotiations from a position of strength.

To match its warnings, Berlin is expanding its domestic security posture. Germany has established a national counter-drone technology centre while updating legal frameworks to give security agencies offensive options. Under the new rules, authorities have authorization to strike back against hostile digital networks, including hacking foreign servers used to plan or execute sabotage on German soil.

Other European capitals are following suit. In London, officials held emergency security briefings with defence contractors, warning arms manufacturers and drone suppliers that their staff and facilities are active targets for foreign intelligence operations.

Re-evaluating Grey-Zone Deterrence

For decades, European defence doctrine assumed that grey-zone threats—covert actions falling just short of open military conflict—could be managed through diplomatic channels, shared intelligence, and economic sanctions. That playbook is proving useless against direct physical attacks on domestic infrastructure and corporate executives.

When state actors use deniable proxies, criminal networks, and sabotage, traditional diplomatic warnings carry little weight. Intelligence agencies across Europe are coming to terms with a harder reality: deterrence in the grey zone requires tangible, high-cost responses. The shift has triggered fierce debates in European parliaments over how far states can legally go when responding to covert attacks, turning once-theoretical policy discussions into urgent legislative decisions.

The Structural Shift in Western Defence

The campaign against defence executives and logistics networks points to a permanent shift in European security. NATO countries are no longer merely managing military aid shipments overseas; they are actively defending their domestic industrial base against covert warfare.

This environment is pushing European defence in three distinct directions:

Executives managing critical supply lines are now treated as strategic national assets who require direct state protection. Civilian transport hubs like Leipzig Airport, which handle a mix of commercial cargo and military shipments, are integrating military-grade air defense protocols and counter-drone systems to secure low-altitude airspace.

At the same time, allies are transferring technical data directly into Ukraine to cut out vulnerable transit corridors. Approving the transfer of cruise missile blueprints and intelligence data directly to Kyiv allows Ukraine to produce precision weapons locally, reducing reliance on long European supply chains that remain vulnerable to disruption.

Integrating Private Industry into Public Defence

This shift is rewriting the relationship between private industry and state intelligence. Historically, defence contractors kept their distance from state security organs, interacting mainly through procurement contracts and routine regulations. That distance has closed out of necessity.

State security agencies now place liaison officers directly inside major defence firms to share threat intelligence in real time. Reports of suspicious surveillance, digital probes, or unusual personnel inquiries are passed along in hours rather than weeks. Police forces and private security details now operate joint protection plans for targeted executives, creating a unified defense posture where the line between private manufacturing and national security no longer exists.

The Economic and Operational Reality

While companies building counter-drone systems, cyber defenses, and executive security networks are seeing record demand, the wider economy is absorbing real friction. Commercial logistics firms and regional airports operating near military supply corridors face rising insurance premiums, security costs, and constant operational delays.

The old European assumption that grey-zone conflicts could be kept safely outside NATO territory has fallen apart. Keeping proxy warfare at arm's length is impossible when military explosives turn up at commercial airports and assassination plots target business executives in European cities.