Russian FIMI in Germany

Country context and strategic relevance

Germany occupies a central place in Russia’s calcu­la­tions, because it is at once the most important European supporter of Ukraine and a country whose political weight is indis­pensable to the cohesion of the European Union and to the strength of NATO. As the EU’s largest economy and its most populous member state, Germany shapes the decisions that matter most to Moscow: the scale of military and financial aid to Kyiv, the mainte­nance of sanctions, the pace of enlargement, and the direction of the Union’s common foreign and security policy. When Berlin moves, Europe tends to follow; when Berlin hesitates, the whole edifice begins to look unstable. This is precisely why the country’s domestic political direction is so conse­quential for the Kremlin. Were a party committed to leaving the European Union and kneeling before Russia — the AfD —to gain real power, the effects would be close to ideal for Russia: it would fracture the European Union from within, weaken the coalition supporting Ukraine, and validate the narrative about the end of the Western way of life. Germany, in other words, is not one theatre of influence opera­tions among many; influence there is a lever with conti­nental reach.

The current state of relations reflects how far the two countries have diverged. Russia has officially placed Germany on its list of “unfriendly states”, and the relationship has deteri­o­rated into open antag­onism beneath the surface of formal diplomacy.[1]  Persistent espionage, the recruitment and deployment of so-called low-level agents, and a widening reper­toire of hybrid warfare are now increas­ingly recog­nised as such by German decision-makers, and the frosty state of bilateral ties follows directly from this recog­nition. Chancellor Merz has captured the essence of this shift, warning that Germany finds itself in a hybrid war — no longer at peace, not yet at war in the conven­tional sense.[2] This turn in perception has nonetheless been slow and is still incomplete.As a result, Georgia now has a hybrid infor­mation ecosystem in which foreign influence is no longer wielded exclu­sively from abroad/​by foreign actors. Instead, Russian strategic narra­tives are localized, legit­imized, and amplified by mainstream domestic actors. The Fourth EEAS FIMI Threat Report identifies Georgia as one of the countries targeted by false allega­tions of EU- and NATO-backed desta­bi­lization plots, which is one element of the broader Russian campaign whose narra­tives are then picked up and repro­duced in Georgian domestic political discourse.

The Russian FIMI playbook in Germany

Moscow’s exploitation rests on a set of entrenched German vulner­a­bil­ities. There is, first, the deep-seated “Russland-Romantik.” This refers to a cultural sympathy for Russia that is rooted in liter­ature, music, history and a diffuse sense of shared destiny and that repeatedly softens German judgement and provides an emotional entry point for manip­u­lation. Russland-Romantik is reinforced by the long tradition of German Ostpolitik, which, for decades, assumed that the key to peace and order in Europe lay in Moscow — a habit of mind that still inclines parts of the political class to seek accom­mo­dation with the Kremlin and to read Russian conduct in the most forgiving light.[3] There is also the legacy of energy depen­dence: for years, German reliance on Russian natural gas delivered by Gazprom through the Nord Stream pipelines was itself a channel of leverage, and the abrupt rupture of that relationship created anxieties that are easily inflamed.[4]

In addition to those vulner­a­bil­ities, Russia works on the resentment surrounding refugees and migration. Moreover, it attacks the enduring divide between East and West Germany — a fault line bound up with the unresolved social and psycho­logical conflicts linked with reuni­fi­cation, an area where feelings of having been treated as second-class citizens remain polit­i­cally potent. Each of these vulner­a­bil­ities offers a ready-made grievance that can be amplified, obviating the need to invent new ones. Layered over all of this is the memory of the Second World War, which Russian actors instru­men­talise with particular cynicism: the propa­ganda works to portray Germany as once again turning aggres­sively against ‘the East’, and, in its attempt to recast today’s Ukraine and its German backers as the heirs of fascism, inverting historical guilt by forgetting, conve­niently, that Ukraine itself suffered enormously under Nazi occupation during the Second World War, bearing some of the heaviest losses of any territory — a fact that flatly contra­dicts the entire construction.

Identity, historical memory, security fears and socio-economic grievance are thus not separate targets but a single inter­locking surface that Moscow assails from several direc­tions at once. The first objective of Russian FIMI in Germany is to erode public support for Ukraine, wearing down the willingness to sustain military and financial aid. The second is to fracture the cohesion of the European Union and NATO, in part by framing Germany as a mere puppet of the United States, stripped of genuine sover­eignty. The third is to delegit­imise the federal government and the mainstream media, corroding the trust on which democ­ratic delib­er­ation depends. A further — more subtle — objective, as we also know from the leaked internal documents of the Kremlin-linked Social Design Agency, is simply to raise the general level of insecurity and anxiety about the future among the German public.[5][6] These objec­tives are mutually reinforcing and find their common denom­i­nator in the Kremlin’s objective to strengthen the AfD and to a lesser degree the BSW, whose electoral success is read by Moscow as a direct weakening of the West.

The tactics, techniques and proce­dures used to spread these narra­tives are evolving constantly. Crucially, none of this lands in a vacuum: it is directed at political actors who are already receptive to it. In Germany this is the AfD above all, the far left-wing BSW in part, and some useful idiots in other parties. In hack-and-leak opera­tions — most strik­ingly the inter­ception and publi­cation of a confi­dential Bundeswehr discussion about Taurus cruise missiles in 2024 — cyber intrusion was fused with the targeted exploitation of the stolen material to maximise political damage.[7]  Not to be forgotten are the acts of physical inter­ference denoted by the second “i” in FIMI: sabotage, arson, drone overflights of sensitive sites, and the recruitment of low-level agents through Telegram.[8]

In the realm of social media, infor­mation manip­u­lation first began with relatively crude troll farms. These days, opera­tions in this area are more targeted and more automated. Bot networks generate and amplify content around the clock. The main distri­b­ution channels are Telegram, TikTok, X, Facebook and YouTube. Another frontier is the delib­erate “poisoning” of Large Language Models, seeding the web with manip­u­lated material in the expec­tation that LLM systems will absorb and reproduce it.[9] Paid influ­encers carry Kremlin-aligned messaging to different German audiences, and increas­ingly convincing deepfakes depict events that never happened. Alongside these, “overload opera­tions” flood fact-checkers with a deluge of fabri­cated claims. A newly uncovered campaign dubbed “Roska Bridge” now targets decen­tralised platforms, using the open-source software Brid.gy to seed pro-Russian content on Mastodon and then mass-replicate it onto Bluesky.[10]

Moreover, although social media networks are the principal distri­b­ution channels for disin­for­mation, breaking through into the respected German mainstream media remains an ambition  — one that is easier to achieve when the ‘respected’ media outlets welcome Russian propa­ganda with open arms. The daily Berliner Zeitung is a case in point.[11]

One conclusion must be stated with complete clarity. Every one of the vulner­a­bil­ities that Moscow exploits, the AfD exploits too; every narrative that Moscow propa­gates, the AfD plays as well. The algorithmic dynamics the Kremlin utilizes are also utilized by the AfD. The party mirrors the Kremlin’s propa­ganda, echoes its talking points and lends them domestic legit­imacy. For that reason the single greatest entry point, the most effective vector of ampli­fi­cation and, ultimately, the gravest danger posed by Russian FIMI in Germany is the AfD itself.

Resilience and countermeasures

Thus far, the German response has been shame­fully insuf­fi­cient. Few attempts at monitoring or counter­mea­sures can be counted as successes. In January 2024, the German Foreign Ministry discovered the vast Doppel­ganger network operating on X.[12] However, this success was due to the work of only a very small number of government experts. In March 2024, the Bundestag’s Parlia­mentary Oversight Panel, in a rare inter­vention, warned publicly that the existing tools and proce­dures for intel­li­gence handling were no longer suffi­cient to meet the challenge.[13] The freshly published annual report of the Bundesamt für Verfas­sungss­chutz (Germany’s federal domestic intel­li­gence service) reinforces this assessment, documenting the growing intensity of Russian espionage, sabotage and disin­for­mation against Germany.[14] That mounting evidence has yet to be matched by a commen­surate build-up of capability. To this end, new depart­ments and workstreams are being set up within the ministries, including the newly opened Joint Centre for Countering Hybrid Threats (GAZ Hybrid), which will need to make disin­for­mation a core part of its remit. One of its most important tasks must be to establish a functioning, methodical system for monitoring the infor­mation space, so that Germany actually knows what is happening in real time rather than learning of Russian opera­tions only once they have produced their effects.[15]

The lesson Germany offers to other countries is, uncom­fortably, a cautionary one. Germany should serve as a warning of what happens when a serious and sustained threat is under­es­ti­mated for too long. It is a negative example from which its partners can learn, so that they do not proceed with the same compla­cency. The imper­ative now is to convert this awareness, which came at such a high cost for Germany, into action.

Political leaders must commu­nicate the threat honestly, ending the highly dangerous ignorance with which evidence of Russian sabotage has too often been met, and equipping the security services with the powers the situation demands. At the European level, all of this should be embedded in a coherent common strategy against hybrid threats — one basing its approach on those in Scandi­navia, where both insti­tu­tional defence and societal resilience are markedly more advanced.

Moreover, we should not look only to Sweden and its neigh­bours: Ukraine and Moldova, both countries which have withstood Russian infor­mation warfare at its most intense and sustained, have a great deal to teach us. Germany would do well to listen to these friends and partners and to heed their recom­men­da­tions, which are based on hard experience.[16] The common thread running through these recom­men­da­tions is: infor­mation manip­u­lation must at last be treated not as a peripheral nuisance but as a first-order question of security.

[1] Russia added Germany, all EU member states and numerous other countries to its official register of “unfriendly states” by Government Decree (Raspor­jaschenije) No. 430‑r of 5 March 2022, adopted alongside Presi­dential Decree No. 95 of the same date. See Deutscher Bundestag, Wissenschaftliche Dienste, “Russische Gegen­sank­tionen als Reaktion auf westliche Sanktionen”, WD 5 – 3000 – 020/​22 (Berlin, 2022); an official German trans­lation of Decree No. 430‑r appears in Osteuropa-Recht 68, no. 2 (2022): 15, https://doi.org/10.5771/0030–6444-2022-x-15.

[2] Friedrich Merz, remarks at the “Ständehaus-Treff” of the Rheinische Post, Düsseldorf, September 2025: “Wir sind nicht im Krieg, aber wir sind auch nicht mehr im Frieden.” See “Bundeskanzler Merz: ‘Wir sind nicht mehr im Frieden,’ ” ZDFheute, 24 September 2025, https://www.zdfheute.de/politik/ausland/merz-frieden-bedrohung-russland-100.html. On the “hybrid war” formu­lation, see “Merz warnt vor Putin: ‘Er führt einen hybriden Krieg gegen uns,’ ” n‑tv, September 2025, https://www.n‑tv.de/politik/Merz-Wir-sind-nicht-im-Krieg-aber-auch-nicht-mehr-im-Frieden-article26064729.html.

[3] On the tradition of Ostpolitik and “Wandel durch Annäherung” and its strategic reassessment after 2022, see Susan Stewart, “Consol­i­dating Germany’s Russia Policy: Refine Existing Approaches and Clarify Trade-offs”, SWP Comment 2023/​C 30 (Berlin: Stiftung Wissenschaft und Politik, 2023), https://doi.org/10.18449/2023C30. On the origins of the concept, see the Friedrich-Ebert-Stiftung’s account of Egon Bahr’s 1963 Tutzing speech and the distinction between Cold-War détente and post-1991 Russland­politik, https://www.fes.de/themen/zeitenwende-frieden-und-sicherheit/die-historische-entspannungspolitik-und-der-russische-angriff-auf-die-ukraine.

[4] On German energy depen­dence on Russia via Nord Stream and Gazprom as a source of political leverage: around 55 per cent of German gas imports came from Russia in 2021 (up from roughly 32 per cent in 2010, following the commis­sioning of Nord Stream 1). See Institut der deutschen Wirtschaft, Die Bedeutung russischer Gasliefer­ungen für die deutsche Wirtschaft (Gutachten für die Atlantik-Brücke, 2022), https://www.atlantik-bruecke.org/wp-content/uploads/IW-Gutachten_Die-Bedeutung-russischer-Gaslieferungen.pdf; and Manuel Frondel and Christoph M. Schmidt, “Deutsch­lands Energiev­er­sorgungsrisiko”, Perspek­tiven der Wirtschaft­spolitik 23, no. 3 (2022), https://doi.org/10.1515/pwp-2022–0030. The German government halted Nord Stream 2 certi­fi­cation in February 2022, and Russian pipeline gas supplies ceased in the course of 2022.

[5] On the leaked internal documents of the Kremlin-linked Social Design Agency (SDA), which reveal, among other goals, the aim of height­ening Germans’ “fear of the future” (Zukun­ft­sangst), see the joint inves­ti­gation by WDR, NDR and Süddeutsche Zeitung, “Leak enthüllt russische Desin­for­mation”, tagesschau.de, 2024, https://www.tagesschau.de/investigativ/ndr-wdr/desinformation-russland-social-design-agency-100.html.

[6] Bundesamt für Verfas­sungss­chutz, Verfas­sungss­chutzbericht 2024, presented 10 June 2025, chapter on “Spionage, Cyberan­griffe und sonstige nachrich­t­en­di­en­stliche Aktiv­itäten”, subsection on Russian “Einflussnahme und Desin­for­mation”, page 300ff https://www.verfassungsschutz.de/SharedDocs/publikationen/DE/verfassungsschutzberichte/2025–06-10-verfassungsschutzbericht-2024.html.  An English-language summary is available at https://www.verfassungsschutz.de/SharedDocs/publikationen/EN/reports-on-the-protection-of-the-constitution/2025–06-brief-summary-2024-report-on-the-protection-of-the-constitution.pdf (see p. 61).

[7] On the “Taurus” inter­ception, Margarita Simonyan (editor-in-chief of RT) published a recording on 1 March 2024 of a c. 30-minute Webex conver­sation that took place on 19 February 2024 among senior Luftwaffe officers, including Inspector Ingo Gerhartz, who were discussing possible Taurus deliv­eries to Ukraine. The German Ministry of Defence confirmed the record­ing’s authen­ticity, and Defence Minister Boris Pistorius attributed the breach to an individual appli­cation error on an unsecured connection. See “Abhöraffäre um Taurus-Gespräch”, Tagesschau, March 2024, https://www.tagesschau.de/

[8] On sabotage, drone overflights and Telegram-recruited “low-level agents”, see Bundesamt für Verfas­sungss­chutz, Verfas­sungss­chutzbericht 2024 (Cologne/​Berlin, June 2025), section on espionage, sabotage and influence activities.

[9] On the delib­erate “poisoning”/“grooming” of Large Language Models via the Pravda/“Portal Kombat” network, see McKenzie Sadeghi and Isis Blachez, “A Well-Funded Moscow-Based Global ‘News’ Network Has Infected Western Artificial Intel­li­gence Tools Worldwide with Russian Propa­ganda,” NewsGuard, 6 March 2025, https://www.newsguardtech.com/special-reports/moscow-based-global-news-network-infected-western-artificial-intelligence-russian-propaganda/; VIGINUM, Portal Kombat: A Struc­tured and Coordi­nated Pro-Russian Propa­ganda Network (Paris: SGDSN, 12 February 2024); and DFRLab, “Pravda Network,” 12 March 2025, https://dfrlab.org/2025/03/12/pravda-network-wikipedia-llm‑x/. See also Agora Digitale Trans­for­mation, Meinungs­bildung im Wandel (July 2026), https://agoradigital.de/wp-content/uploads/2026/07/ADT_Studie_Meinungsbildung-im-Wandel.pdf.

[10] Check­First, “Roska Bridge: How a Pro-Russian IMS Exploits Vulner­a­bil­ities of Decen­tralised Platforms to Spread Propa­ganda,” 2025, https://checkfirst.network/roska-bridge-how-a-pro-russian-ims-exploits-vulnerabilities-of-decentralised-platforms-to-spread-propaganda/. Active since at least September 2025, the campaign recycles content from EU-sanctioned outlets such as the Pravda network and shows struc­tural overlaps with Portal Kombat.

[11] On criticism of the Berliner Zeitung as a dissem­i­nator of Kremlin-aligned narra­tives, see “Putins Propa­ganda in Europa: Die Klone des Kreml,” taz, 2024; and “Sprechen wie der Kreml? Die spezielle Berichter­stattung der Berliner Zeitung,” Übermedien. The Bavarian State Office for the Protection of the Consti­tution had listed berliner-zeitung.de among websites whose content the Doppel­gänger actor redis­tributed in its “Doppel­gänger” analysis of August 2024, but revised that categori­sation in September 2024 after protests from the outlets concerned, clari­fying that it did not thereby allege that these media dissem­i­nated Russian propa­ganda; the listing is therefore not cited here as evidence.

[12] The German Foreign Office first went public with its findings on the large-scale Doppel­ganger network on X in January 2024, based on a six-week obser­vation window from mid-December 2023 to the end of January 2024, in which it identified more than 50,000 inauthentic accounts; it published the full technical analysis on 5 June 2024. Auswär­tiges Amt, Technical Report (5 June 2024).

[13] Parla­men­tarisches Kontroll­gremium, “Bewertung des Parla­men­tarischen Kontroll­gremiums gemäß § 10 Absatz 2 Satz 1 des Kontroll­gremi­umge­setzes: Russische Einflussnahme in Deutschland,” Bundestags­druck­sache 20/​10655, 13 March 2024, https://dserver.bundestag.de/btd/20/106/2010655.pdf. The panel warned that Germany stands “at the centre of Russian influence opera­tions” and that the existing means were no longer adequate.

[14] Bundesamt für Verfas­sungss­chutz, Verfas­sungss­chutzbericht 2024 (June 2025), chapters on Russian espionage, sabotage and disin­for­mation, https://www.verfassungsschutz.de/SharedDocs/publikationen/DE/verfassungsschutzberichte/2025–06-10-verfassungsschutzbericht-2024.html.

[15] On the “Gemein­sames Zentrum zur Abwehr hybrider Bedro­hungen” (GAZ Hybrid), opened by Federal Interior Minister Alexander Dobrindt on 16 June 2026 and hosted by the Bundesamt für Verfas­sungss­chutz as a coordi­nation platform of some 40 federal and state agencies with a dedicated working group on disin­for­mation and influence (“AG Desin­for­mation und Einflussnahme”), see Bundesamt für Verfas­sungss­chutz, “GAZ Hybrid,” 16 June 2026, https://www.verfassungsschutz.de/SharedDocs/kurzmeldungen/DE/2026/2026–06-16-gaz-hybrid.html; and “Was soll das gemeinsame Abwehrzentrum bringen?,” Tagesschau, 16 June 2026, https://www.tagesschau.de/inland/gesellschaft/abwehrzentrum-hybride-bedrohungen-100.html.

[16] On the Baltic states and Nordic countries as models of insti­tu­tional defence and societal resilience against disin­for­mation, see the work of the European Centre of Excel­lence for Countering Hybrid Threats (Helsinki) and the NATO Strategic Commu­ni­ca­tions Centre of Excel­lence (Riga); e.g. Hybrid CoE, https://www.hybridcoe.fi/.