Russian FIMI in Germany

Country context and strategic relevance

Germany occupies a central place in Russia’s calcu­la­tions, because it is at once the most important European supporter of Ukraine and a country whose political weight is indis­pensable to the cohesion of the European Union and to the strength of NATO. As the EU’s largest economy and its most populous member state, Germany shapes the decisions that matter most to Moscow: the scale of military and financial aid to Kyiv, the maintenance of sanctions, the pace of enlar­gement, and the direction of the Union’s common foreign and security policy. When Berlin moves, Europe tends to follow; when Berlin hesitates, the whole edifice begins to look unstable. This is precisely why the country’s domestic political direction is so conse­quential for the Kremlin. Were a party committed to leaving the European Union and kneeling before Russia — the AfD —to gain real power, the effects would be close to ideal for Russia: it would fracture the European Union from within, weaken the coalition supporting Ukraine, and validate the narrative about the end of the Western way of life. Germany, in other words, is not one theatre of influence opera­tions among many; influence there is a lever with conti­nental reach.

The current state of relations reflects how far the two countries have diverged. Russia has officially placed Germany on its list of „unfri­endly states“, and the relati­onship has deterio­rated into open antagonism beneath the surface of formal diplomacy.[1]  Persistent espionage, the recruitment and deployment of so-called low-level agents, and a widening reper­toire of hybrid warfare are now incre­asingly recog­nised as such by German decision-makers, and the frosty state of bilateral ties follows directly from this recognition. Chancellor Merz has captured the essence of this shift, warning that Germany finds itself in a hybrid war — no longer at peace, not yet at war in the conven­tional sense.[2] This turn in perception has nonetheless been slow and is still incomplete.As a result, Georgia now has a hybrid infor­mation ecosystem in which foreign influence is no longer wielded exclu­sively from abroad/​by foreign actors. Instead, Russian strategic narra­tives are localized, legiti­mized, and amplified by mainstream domestic actors. The Fourth EEAS FIMI Threat Report identifies Georgia as one of the countries targeted by false allega­tions of EU- and NATO-backed desta­bi­lization plots, which is one element of the broader Russian campaign whose narra­tives are then picked up and repro­duced in Georgian domestic political discourse.

The Russian FIMI playbook in Germany

Moscow’s explo­itation rests on a set of entrenched German vulnerabi­lities. There is, first, the deep-seated „Russland-Romantik.“ This refers to a cultural sympathy for Russia that is rooted in literature, music, history and a diffuse sense of shared destiny and that repea­tedly softens German judgement and provides an emotional entry point for manipu­lation. Russland-Romantik is reinforced by the long tradition of German Ostpo­litik, which, for decades, assumed that the key to peace and order in Europe lay in Moscow — a habit of mind that still inclines parts of the political class to seek accom­mo­dation with the Kremlin and to read Russian conduct in the most forgiving light.[3] There is also the legacy of energy depen­dence: for years, German reliance on Russian natural gas delivered by Gazprom through the Nord Stream pipelines was itself a channel of leverage, and the abrupt rupture of that relati­onship created anxieties that are easily inflamed.[4]

In addition to those vulnerabi­lities, Russia works on the resentment surrounding refugees and migration. Moreover, it attacks the enduring divide between East and West Germany — a fault line bound up with the unresolved social and psycho­lo­gical conflicts linked with reuni­fi­cation, an area where feelings of having been treated as second-class citizens remain politi­cally potent. Each of these vulnerabi­lities offers a ready-made grievance that can be amplified, obviating the need to invent new ones. Layered over all of this is the memory of the Second World War, which Russian actors instru­men­talise with parti­cular cynicism: the propa­ganda works to portray Germany as once again turning aggres­sively against ‚the East‘, and, in its attempt to recast today’s Ukraine and its German backers as the heirs of fascism, inverting histo­rical guilt by forgetting, conve­ni­ently, that Ukraine itself suffered enorm­ously under Nazi occupation during the Second World War, bearing some of the heaviest losses of any territory — a fact that flatly contra­dicts the entire construction.

Identity, histo­rical memory, security fears and socio-economic grievance are thus not separate targets but a single interlo­cking surface that Moscow assails from several direc­tions at once. The first objective of Russian FIMI in Germany is to erode public support for Ukraine, wearing down the willingness to sustain military and financial aid. The second is to fracture the cohesion of the European Union and NATO, in part by framing Germany as a mere puppet of the United States, stripped of genuine sovereignty. The third is to delegi­timise the federal government and the mainstream media, corroding the trust on which democratic delibe­ration depends. A further — more subtle — objective, as we also know from the leaked internal documents of the Kremlin-linked Social Design Agency, is simply to raise the general level of insecurity and anxiety about the future among the German public.[5][6] These objec­tives are mutually reinforcing and find their common denomi­nator in the Kremlin’s objective to strengthen the AfD and to a lesser degree the BSW, whose electoral success is read by Moscow as a direct weakening of the West.

The tactics, techniques and proce­dures used to spread these narra­tives are evolving constantly. Crucially, none of this lands in a vacuum: it is directed at political actors who are already receptive to it. In Germany this is the AfD above all, the far left-wing BSW in part, and some useful idiots in other parties. In hack-and-leak opera­tions — most strikingly the inter­ception and publi­cation of a confi­dential Bundeswehr discussion about Taurus cruise missiles in 2024 — cyber intrusion was fused with the targeted explo­itation of the stolen material to maximise political damage.[7]  Not to be forgotten are the acts of physical inter­fe­rence denoted by the second “i” in FIMI: sabotage, arson, drone overflights of sensitive sites, and the recruitment of low-level agents through Telegram.[8]

In the realm of social media, infor­mation manipu­lation first began with relatively crude troll farms. These days, opera­tions in this area are more targeted and more automated. Bot networks generate and amplify content around the clock. The main distri­bution channels are Telegram, TikTok, X, Facebook and YouTube. Another frontier is the deliberate „poisoning“ of Large Language Models, seeding the web with manipu­lated material in the expec­tation that LLM systems will absorb and reproduce it.[9] Paid influencers carry Kremlin-aligned messaging to different German audiences, and incre­asingly convincing deepfakes depict events that never happened. Alongside these, „overload opera­tions“ flood fact-checkers with a deluge of fabri­cated claims. A newly uncovered campaign dubbed „Roska Bridge“ now targets decen­tra­lised platforms, using the open-source software Brid.gy to seed pro-Russian content on Mastodon and then mass-replicate it onto Bluesky.[10]

Moreover, although social media networks are the principal distri­bution channels for disin­for­mation, breaking through into the respected German mainstream media remains an ambition  — one that is easier to achieve when the ‘respected’ media outlets welcome Russian propa­ganda with open arms. The daily Berliner Zeitung is a case in point.[11]

One conclusion must be stated with complete clarity. Every one of the vulnerabi­lities that Moscow exploits, the AfD exploits too; every narrative that Moscow propa­gates, the AfD plays as well. The algorithmic dynamics the Kremlin utilizes are also utilized by the AfD. The party mirrors the Kremlin’s propa­ganda, echoes its talking points and lends them domestic legitimacy. For that reason the single greatest entry point, the most effective vector of ampli­fi­cation and, ultim­ately, the gravest danger posed by Russian FIMI in Germany is the AfD itself.

Resilience and countermeasures

Thus far, the German response has been shamefully insuf­fi­cient. Few attempts at monitoring or counter­me­a­sures can be counted as successes. In January 2024, the German Foreign Ministry disco­vered the vast Doppel­ganger network operating on X.[12] However, this success was due to the work of only a very small number of government experts. In March 2024, the Bundestag’s Parlia­mentary Oversight Panel, in a rare inter­vention, warned publicly that the existing tools and proce­dures for intel­li­gence handling were no longer suffi­cient to meet the challenge.[13] The freshly published annual report of the Bundesamt für Verfas­sungs­schutz (Germany’s federal domestic intel­li­gence service) reinforces this assessment, documenting the growing intensity of Russian espionage, sabotage and disin­for­mation against Germany.[14] That mounting evidence has yet to be matched by a commen­surate build-up of capability. To this end, new depart­ments and workstreams are being set up within the minis­tries, including the newly opened Joint Centre for Countering Hybrid Threats (GAZ Hybrid), which will need to make disin­for­mation a core part of its remit. One of its most important tasks must be to establish a functioning, metho­dical system for monitoring the infor­mation space, so that Germany actually knows what is happening in real time rather than learning of Russian opera­tions only once they have produced their effects.[15]

The lesson Germany offers to other countries is, uncom­for­tably, a cautionary one. Germany should serve as a warning of what happens when a serious and sustained threat is undere­sti­mated for too long. It is a negative example from which its partners can learn, so that they do not proceed with the same compla­cency. The imperative now is to convert this awareness, which came at such a high cost for Germany, into action.

Political leaders must commu­nicate the threat honestly, ending the highly dangerous ignorance with which evidence of Russian sabotage has too often been met, and equipping the security services with the powers the situation demands. At the European level, all of this should be embedded in a coherent common strategy against hybrid threats — one basing its approach on those in Scandi­navia, where both insti­tu­tional defence and societal resilience are markedly more advanced.

Moreover, we should not look only to Sweden and its neigh­bours: Ukraine and Moldova, both countries which have withstood Russian infor­mation warfare at its most intense and sustained, have a great deal to teach us. Germany would do well to listen to these friends and partners and to heed their recom­men­da­tions, which are based on hard experience.[16] The common thread running through these recom­men­da­tions is: infor­mation manipu­lation must at last be treated not as a peripheral nuisance but as a first-order question of security.

[1] Russia added Germany, all EU member states and numerous other countries to its official register of „unfri­endly states“ by Government Decree (Raspor­ja­schenije) No. 430‑r of 5 March 2022, adopted alongside Presi­dential Decree No. 95 of the same date. See Deutscher Bundestag, Wissen­schaft­liche Dienste, „Russische Gegen­sank­tionen als Reaktion auf westliche Sanktionen“, WD 5 – 3000 – 020/​22 (Berlin, 2022); an official German trans­lation of Decree No. 430‑r appears in Osteuropa-Recht 68, no. 2 (2022): 15, https://doi.org/10.5771/0030–6444-2022-x-15.

[2] Friedrich Merz, remarks at the „Ständehaus-Treff“ of the Rheinische Post, Düsseldorf, September 2025: „Wir sind nicht im Krieg, aber wir sind auch nicht mehr im Frieden.“ See „Bundes­kanzler Merz: ‚Wir sind nicht mehr im Frieden,‘ “ ZDFheute, 24 September 2025, https://www.zdfheute.de/politik/ausland/merz-frieden-bedrohung-russland-100.html. On the „hybrid war“ formu­lation, see „Merz warnt vor Putin: ‚Er führt einen hybriden Krieg gegen uns,‘ “ n‑tv, September 2025, https://www.n‑tv.de/politik/Merz-Wir-sind-nicht-im-Krieg-aber-auch-nicht-mehr-im-Frieden-article26064729.html.

[3] On the tradition of Ostpo­litik and „Wandel durch Annäherung“ and its strategic reassessment after 2022, see Susan Stewart, „Conso­li­dating Germany’s Russia Policy: Refine Existing Approaches and Clarify Trade-offs“, SWP Comment 2023/​C 30 (Berlin: Stiftung Wissen­schaft und Politik, 2023), https://doi.org/10.18449/2023C30. On the origins of the concept, see the Friedrich-Ebert-Stiftung’s account of Egon Bahr’s 1963 Tutzing speech and the distinction between Cold-War détente and post-1991 Russland­po­litik, https://www.fes.de/themen/zeitenwende-frieden-und-sicherheit/die-historische-entspannungspolitik-und-der-russische-angriff-auf-die-ukraine.

[4] On German energy depen­dence on Russia via Nord Stream and Gazprom as a source of political leverage: around 55 per cent of German gas imports came from Russia in 2021 (up from roughly 32 per cent in 2010, following the commis­sioning of Nord Stream 1). See Institut der deutschen Wirtschaft, Die Bedeutung russi­scher Gaslie­fe­rungen für die deutsche Wirtschaft (Gutachten für die Atlantik-Brücke, 2022), https://www.atlantik-bruecke.org/wp-content/uploads/IW-Gutachten_Die-Bedeutung-russischer-Gaslieferungen.pdf; and Manuel Frondel and Christoph M. Schmidt, „Deutsch­lands Energie­ver­sor­gungs­risiko“, Perspek­tiven der Wirtschafts­po­litik 23, no. 3 (2022), https://doi.org/10.1515/pwp-2022–0030. The German government halted Nord Stream 2 certi­fi­cation in February 2022, and Russian pipeline gas supplies ceased in the course of 2022.

[5] On the leaked internal documents of the Kremlin-linked Social Design Agency (SDA), which reveal, among other goals, the aim of heigh­tening Germans‘ „fear of the future“ (Zukunfts­angst), see the joint inves­ti­gation by WDR, NDR and Süddeutsche Zeitung, „Leak enthüllt russische Desin­for­mation“, tagesschau.de, 2024, https://www.tagesschau.de/investigativ/ndr-wdr/desinformation-russland-social-design-agency-100.html.

[6] Bundesamt für Verfas­sungs­schutz, Verfas­sungs­schutz­be­richt 2024, presented 10 June 2025, chapter on „Spionage, Cyber­an­griffe und sonstige nachrich­ten­dienst­liche Aktivi­täten“, subsection on Russian „Einfluss­nahme und Desin­for­mation”, page 300ff https://www.verfassungsschutz.de/SharedDocs/publikationen/DE/verfassungsschutzberichte/2025–06-10-verfassungsschutzbericht-2024.html.  An English-language summary is available at https://www.verfassungsschutz.de/SharedDocs/publikationen/EN/reports-on-the-protection-of-the-constitution/2025–06-brief-summary-2024-report-on-the-protection-of-the-constitution.pdf (see p. 61).

[7] On the „Taurus“ inter­ception, Margarita Simonyan (editor-in-chief of RT) published a recording on 1 March 2024 of a c. 30-minute Webex conver­sation that took place on 19 February 2024 among senior Luftwaffe officers, including Inspector Ingo Gerhartz, who were discussing possible Taurus deliveries to Ukraine. The German Ministry of Defence confirmed the recording’s authen­ticity, and Defence Minister Boris Pistorius attri­buted the breach to an individual appli­cation error on an unsecured connection. See „Abhör­affäre um Taurus-Gespräch“, Tages­schau, March 2024, https://www.tagesschau.de/

[8] On sabotage, drone overflights and Telegram-recruited „low-level agents“, see Bundesamt für Verfas­sungs­schutz, Verfas­sungs­schutz­be­richt 2024 (Cologne/​Berlin, June 2025), section on espionage, sabotage and influence activities.

[9] On the deliberate „poisoning“/„grooming“ of Large Language Models via the Pravda/„Portal Kombat“ network, see McKenzie Sadeghi and Isis Blachez, „A Well-Funded Moscow-Based Global ‚News‘ Network Has Infected Western Artificial Intel­li­gence Tools Worldwide with Russian Propa­ganda,“ NewsGuard, 6 March 2025, https://www.newsguardtech.com/special-reports/moscow-based-global-news-network-infected-western-artificial-intelligence-russian-propaganda/; VIGINUM, Portal Kombat: A Struc­tured and Coordi­nated Pro-Russian Propa­ganda Network (Paris: SGDSN, 12 February 2024); and DFRLab, „Pravda Network,“ 12 March 2025, https://dfrlab.org/2025/03/12/pravda-network-wikipedia-llm‑x/. See also Agora Digitale Trans­for­mation, Meinungs­bildung im Wandel (July 2026), https://agoradigital.de/wp-content/uploads/2026/07/ADT_Studie_Meinungsbildung-im-Wandel.pdf.

[10] Check­First, „Roska Bridge: How a Pro-Russian IMS Exploits Vulnerabi­lities of Decen­tra­lised Platforms to Spread Propa­ganda,“ 2025, https://checkfirst.network/roska-bridge-how-a-pro-russian-ims-exploits-vulnerabilities-of-decentralised-platforms-to-spread-propaganda/. Active since at least September 2025, the campaign recycles content from EU-sanctioned outlets such as the Pravda network and shows struc­tural overlaps with Portal Kombat.

[11] On criticism of the Berliner Zeitung as a disse­mi­nator of Kremlin-aligned narra­tives, see „Putins Propa­ganda in Europa: Die Klone des Kreml,“ taz, 2024; and „Sprechen wie der Kreml? Die spezielle Bericht­erstattung der Berliner Zeitung,“ Übermedien. The Bavarian State Office for the Protection of the Consti­tution had listed berliner-zeitung.de among websites whose content the Doppel­gänger actor redis­tri­buted in its „Doppel­gänger“ analysis of August 2024, but revised that catego­ri­sation in September 2024 after protests from the outlets concerned, clari­fying that it did not thereby allege that these media disse­mi­nated Russian propa­ganda; the listing is therefore not cited here as evidence.

[12] The German Foreign Office first went public with its findings on the large-scale Doppel­ganger network on X in January 2024, based on a six-week obser­vation window from mid-December 2023 to the end of January 2024, in which it identified more than 50,000 inauthentic accounts; it published the full technical analysis on 5 June 2024. Auswär­tiges Amt, Technical Report (5 June 2024).

[13] Parla­men­ta­ri­sches Kontroll­gremium, „Bewertung des Parla­men­ta­ri­schen Kontroll­gre­miums gemäß § 10 Absatz 2 Satz 1 des Kontroll­gre­mi­um­ge­setzes: Russische Einfluss­nahme in Deutschland,“ Bundes­tags­druck­sache 20/​10655, 13 March 2024, https://dserver.bundestag.de/btd/20/106/2010655.pdf. The panel warned that Germany stands „at the centre of Russian influence opera­tions“ and that the existing means were no longer adequate.

[14] Bundesamt für Verfas­sungs­schutz, Verfas­sungs­schutz­be­richt 2024 (June 2025), chapters on Russian espionage, sabotage and disin­for­mation, https://www.verfassungsschutz.de/SharedDocs/publikationen/DE/verfassungsschutzberichte/2025–06-10-verfassungsschutzbericht-2024.html.

[15] On the „Gemein­sames Zentrum zur Abwehr hybrider Bedro­hungen“ (GAZ Hybrid), opened by Federal Interior Minister Alexander Dobrindt on 16 June 2026 and hosted by the Bundesamt für Verfas­sungs­schutz as a coordi­nation platform of some 40 federal and state agencies with a dedicated working group on disin­for­mation and influence („AG Desin­for­mation und Einfluss­nahme“), see Bundesamt für Verfas­sungs­schutz, „GAZ Hybrid,“ 16 June 2026, https://www.verfassungsschutz.de/SharedDocs/kurzmeldungen/DE/2026/2026–06-16-gaz-hybrid.html; and „Was soll das gemeinsame Abwehr­zentrum bringen?,“ Tages­schau, 16 June 2026, https://www.tagesschau.de/inland/gesellschaft/abwehrzentrum-hybride-bedrohungen-100.html.

[16] On the Baltic states and Nordic countries as models of insti­tu­tional defence and societal resilience against disin­for­mation, see the work of the European Centre of Excel­lence for Countering Hybrid Threats (Helsinki) and the NATO Strategic Commu­ni­ca­tions Centre of Excel­lence (Riga); e.g. Hybrid CoE, https://www.hybridcoe.fi/.