Germany on Thursday expelled a Russian diplomat suspected of running a German-Ukrainian woman as a covert operative against Berlin's military support for Ukraine, marking the latest escalation in Moscow's intelligence campaign targeting European security infrastructure.
The expulsion of Andrei M., identified as a deputy military attaché at Russia's diplomatic mission, follows directly from the arrest one day earlier of Ilona W., a German-Ukrainian national accused of supplying Moscow with classified details on Germany's defence assistance to Ukraine. The German Foreign Ministry made clear the government's position: "The German government does not tolerate espionage in Germany, still less under the disguise of diplomatic status."
Intelligence operation targeted Ukraine support infrastructure
According to German security officials, Ilona W. allegedly provided Andrei M. with sensitive information on multiple dimensions of Berlin's military aid to Kyiv. The intelligence reportedly included specifics on German defence industry sites involved in Ukraine support, details of drone testing programmes, and planned drone deliveries to Ukrainian forces.
The operation's methodology reflects sophistication in targeting networks around military decision-making. Ilona W. allegedly leveraged contacts with former German military personnel to access information, while simultaneously facilitating Andrei M.'s attendance at political events using aliases—a classic tradecraft approach to expand intelligence collection beyond formal diplomatic channels. The recruitment of a German-Ukrainian national suggests deliberate exploitation of diaspora communities with linguistic access and potential sympathy vectors.
Members are reading: Analysis of why Russia is mapping Europe's Ukraine support infrastructure with operational-level precision
Pattern of escalation
The expulsion follows a sustained pattern of Russian intelligence activity across Europe since the February 2022 invasion, with European officials reporting a dramatic surge in suspected Russian sabotage incidents targeting critical infrastructure. The number of Russian attacks in Europe nearly tripled between 2023 and 2024, after quadrupling between 2022 and 2023, while the International Institute for Strategic Studies found that Russian sabotage operations in Europe have quadrupled since 2023. Multiple European nations have documented intensified collection efforts targeting military supply routes, NATO infrastructure vulnerabilities, and political decision-making around Ukraine support—all indicating Moscow's intelligence apparatus has shifted from strategic monitoring to tactical pre-positioning. Germany's public exposure of the diplomat's specific role sends a clear signal that European security services are prepared to impose costs on Russia's intelligence operations, even at the risk of further diplomatic deterioration.
Subscribe to our free newsletter to unlock direct links to all sources used in this article.
We believe you deserve to verify everything we write. That's why we meticulously document every source.
