Loading story…
Germany declared a Russian Embassy staff member persona non grata and summoned Russia’s ambassador, saying it would not tolerate espionage—particularly under diplomatic cover—amid heightened tensions tied to Russia’s war in Ukraine. Reporting identified the expelled official as Andrei Mayorov, Russia’s deputy military attaché in Germany, alleged to be a GRU officer and the handler for a dual Ukrainian-German citizen arrested in Berlin on suspicion of spying for Russia.
German prosecutors allege the arrested woman (identified in reporting as Ilona Kopylova/Ilona W.) leveraged contacts with current and former German defence ministry employees to collect information related to German military aid to Ukraine, drone testing sites, and the arms industry, and also helped her handler operate under a false identity to attend political events and cultivate contacts. Russia’s embassy rejected the allegations as a provocation and warned Berlin’s actions would not go unanswered, while German officials framed the expulsion as a clear signal that hostile intelligence activity in Germany will carry consequences.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
After the expulsion, the Russian Embassy in Berlin denied the spying allegations and warned that Moscow would respond. The exchange further escalated tensions between Germany and Russia.
Germany declared a Russian diplomat persona non grata and ordered him to leave immediately over alleged espionage tied to the Ukraine war. Media reports identified him as Andrei Mayorov, Russia’s deputy military attaché in Germany, who was accused of acting as Kopylova’s handler.
German authorities arrested Ilona Kopylova in Berlin on suspicion of espionage for Russia. Prosecutors allege she used contacts linked to Germany’s defense ministry to gather information on military aid to Ukraine, drone testing sites, and the arms industry, and helped her handler attend political events under a false identity.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Germany formally blamed Russia for the 2015 cyberattack on the Bundestag, identifying Russian national **Dmitry Badin** as a suspected operative of the GRU’s Unit 26165, also known as **APT28** or **Fancy Bear**. Federal prosecutors obtained an international arrest warrant accusing him of intelligence activity and data espionage, while Berlin summoned the Russian ambassador and said it had hard evidence tying Moscow to the intrusion. Investigators said the breach began with spearphishing emails disguised as United Nations messages about the Ukraine conflict, leading to malware infections inside the parliamentary network. The attackers allegedly escalated privileges, used tools including `Mimikatz`, and exfiltrated at least **16 GB** of data, including large volumes of lawmakers’ emails, before the operation was stopped. Germany also pushed for **EU-wide sanctions** under the bloc’s cyber sanctions regime, making the case one of Europe’s most prominent state-linked cyber attribution actions.
Aug 15, 2026
Germany publicly accused Russia of orchestrating a cyberattack against Deutsche Flugsicherung, the state-owned air traffic control authority, and conducting a coordinated disinformation campaign aimed at influencing the upcoming federal election. The German Foreign Ministry stated it had clear evidence linking the August 2024 cyberattack to APT28 (Fancy Bear), a group associated with Russia’s GRU military intelligence, and attributed the election interference to the Storm 1516 threat actor. In response, Germany summoned the Russian ambassador, announced plans for countermeasures in coordination with EU partners, and supported new sanctions targeting those involved in hybrid attacks. The Russian embassy has denied the allegations, while European officials have warned of a broader campaign of Russian cyber operations targeting critical infrastructure and political processes across the continent. These developments come amid heightened concern over nation-state cyber threats in Europe, with both France and Germany reporting recent attacks attributed to foreign actors. The French Ministry of Interior is investigating a suspected nation-state breach of its email servers, though details remain limited. European authorities have documented a surge in nation-state-backed cyberattacks, with the EU Agency for Cybersecurity reporting 46 such incidents between July 2024 and July 2025. Officials across Europe have condemned Russia’s use of hybrid tactics, including cyberattacks and disinformation, as part of a broader strategy to destabilize Western democracies.
Jun 29, 2026
Germany has attributed an August drone incident in Leipzig to Russia, reinforcing concerns that Moscow is intensifying deniable operations on NATO territory. Public reporting linked the incident to an explosive-drone discovery at Leipzig/Halle Airport; related German investigations have also examined alleged Russian-linked reconnaissance of parcel-bomb routes and a suspected weapons cache intended for covert violence. The incident fits a broader Russian hybrid campaign combining sabotage, cyber activity, drone incursions, disinformation, election interference, and pressure on European defense and Ukraine-support supply chains. Intelligence assessments judge further hostile activity and significant cyber operations in NATO countries likely, with ambiguous attacks intended to test alliance cohesion and complicate an Article 5 response, while an imminent conventional Russian invasion of NATO remains unlikely.
Sep 3, 2026