NextFin News - Germany is at risk of being drawn into a violent conflict with Russia, the head of the country's foreign intelligence service warned on Monday, as Moscow's undeclared "shadow war" against Europe takes on a "new and more dangerous phase." Martin Jäger, president of the Federal Intelligence Service, told a public hearing of the Bundestag's intelligence oversight committee that no other country currently poses such a direct, comprehensive, and concrete threat to Germany — a judgment that reframes a year of drone strikes, arson, GPS jamming, and consulate expulsions from a nuisance into a pre-conflict environment for European investors to price.
The Warning From Berlin
Jäger's testimony on October 5 marked one of the most explicit public acknowledgments by a senior Western intelligence official that Russia's campaign against Europe has moved beyond espionage into sabotage and coercion with a tolerance for civilian risk. "Germany is not in a state of defence, yet they are still under attack – that is precisely what a shadow war is," he said, according to remarks reported from the hearing. The confrontation, he said, "cannot be characterised using traditional military or legal categories."
The BND chief anchored his warning in a specific incident: the attempted attack at Leipzig/Halle Airport in August, when an explosives-laden drone was discovered at a major cargo and passenger hub. Berlin formally accused Russia of the plot on September 1, and German reporting has since tied the operation to Unit 29155 of Moscow's GRU military intelligence agency. "The attempted attack in Leipzig is merely a fraction of such cases," Jäger said. Germany's domestic intelligence chief, Sinan Selen of the BfV, went further, stating that the defence industry and military infrastructure are "in the crosshairs" and that Moscow "is already accepting the risk of potential civilian casualties" in its campaign.
The political backdrop sharpened the message. A day earlier, on October 4, Chancellor Friedrich Merz made an unannounced visit to Kyiv and pledged €1.3 billion in assistance — €1 billion in military aid and €350 million for energy grid repairs — reaffirming Germany's position as one of Kyiv's largest backers. Russia, which has denied involvement in the Leipzig plot and the wider hybrid campaign, responded to the attribution with the closure of its consulate in Bonn and reciprocal measures against German cultural institutions — the kind of diplomatic tit-for-tat that usually signals a relationship in freefall rather than a manageable dispute.
What Is New About This Phase
The critical distinction Jäger drew is between a shadow war that probes red lines and one that accepts collateral risk. For years, Russia's hybrid toolkit — disinformation, cyberattacks, election interference, low-level sabotage — was calibrated to stay below the threshold that would trigger NATO's Article 5 collective defence clause. The alliance has clarified that a hybrid operation or cyberattack of sufficient gravity could, in principle, activate Article 5, but the bar is deliberately high and untested.
What has changed, according to the German assessment, is the kinetic character of the operations and the willingness to endanger civilians on NATO soil. The Leipzig drone plot targeted an airport — a site where a detonation would have killed bystanders regardless of whether the intended target was military. Arson attacks in Munich, also attributed to the Russian-directed network, struck on German soil. In late September, a Russian Mi-8 helicopter breached Polish airspace for 42 seconds, forcing a scramble response; Romanian officials have reported more than 100 drone or fragment incursions near their border. In the Baltic, a Russian warship fired flares at a Danish military helicopter and commercial and military vessels around Denmark experienced prolonged GPS signal jamming attributed to Russian satellites.
These incidents share a design logic: they are deniable enough to avoid forcing a treaty response, yet disruptive enough to test whether European governments will absorb the cost. That is the mechanism by which a shadow war works — not by winning battles, but by raising the price of staying engaged until political will erodes. Jäger said Russia's objective is to undermine Europe's political support for Ukraine, and warned that Moscow's nuclear threats would likely be voiced again as part of the intimidation campaign.
The escalation ladder is visible in the sequence. It began with espionage and influence operations that Europe tolerated as the cost of doing business with a nuclear-armed neighbour. It moved to cyberattacks on parliament and energy networks that were absorbed with attribution statements and sanctions listings. It has now reached kinetic plots on NATO soil — a drone at a German airport, fires in a German city, a helicopter inside Polish airspace — each one closer to a death that would force a response Moscow cannot control. The "new phase" is not a single incident; it is the narrowing of the gap between provocation and consequence.
A Playbook Two Decades In The Making
Nothing about Russia's shadow war is improvised; it is the export of a doctrine refined at home and field-tested in Ukraine since 2014. The same GRU unit linked to Leipzig, Unit 29155, has been tied by European investigators to assassination attempts, arms-dealing networks, and sabotage operations across the continent over more than a decade. What changed after the full-scale invasion of Ukraine was not the existence of the network but its mandate: operations that once served leverage now serve attrition.
The historical comparison matters for the market's pricing model. Between 2014 and 2021, Europe treated Russian hybrid activity as a manageable friction cost — the price of interdependence. Cyberattacks on the Bundestag in 2015, the NotPetya strike in 2017, election interference campaigns: each was absorbed, attributed, and filed under diplomatic disputes. The 2022 invasion broke that assumption for energy and defence policy, but capital markets have been slower to apply the same logic to physical security. The shadow-war escalation is the bridge between those two repricings: it tells investors that the risk to European assets is not confined to the energy complex or the defence order book, but extends to every node of the continent's logistics, digital, and industrial infrastructure.
There is also a historical lesson in how these campaigns end. Russia's hybrid pressure on the Baltic states in the 2010s — GPS jamming, airspace probes, cyberattacks on parliaments and banks — did not produce a negotiated accommodation. It produced exactly the opposite: deeper NATO integration, permanent forward deployments, and a hardening of the very institutions Moscow sought to weaken. If the pattern holds, the shadow war's medium-term effect is to lock in the defence-spending upcycle that investors are already underwriting, while adding a permanent security-surcharge line to European corporate capital budgets.
The Market's Unanswered Question
For investors, the immediate question is not whether the threat is real — intelligence chiefs across Europe have been saying so for months — but whether it is priced. European defence budgets are already on a structural upcycle. Germany's Zeitenwende, announced after the 2022 invasion, committed the country to a €100 billion special defence fund and a sustained push toward NATO's 2 per cent of GDP spending target; the 2026 intelligence reform Jäger referenced expanded the BND's mandate to conduct more aggressive covert action, not merely gather information. Defence contractors, cybersecurity firms, and critical-infrastructure security providers have already re-rated on that thesis.
What the shadow-war escalation adds is a second-order cost layer that the consensus has not fully underwritten. First, the defence-industrial base is now an explicit target, not just a beneficiary. Sabotage and cyber operations against European manufacturers producing armaments for Ukraine turn supply chains into front lines, raising insurance, hardening, and redundancy costs that compress margins even as order books swell. A factory running at full capacity to fill multi-year backlog is a high-value target; every incident at such a site forces a choice between production delays and security spending that no earnings model currently carries.
Second, critical infrastructure — ports, airports, energy grids, undersea cables — moves from "resilience budget line" to "probable attack surface," forcing utilities, logistics, and telecom operators into capital expenditure they had planned to phase in over years. The Leipzig airport plot is the template: civilian dual-use infrastructure that also serves military logistics. Third, the Article 5 ambiguity itself becomes a risk premium: assets in the Baltic states and Poland trade with a geopolitical discount that widens every time an incursion goes unanswered. That discount is not abstract — it shows up in the cost of capital for regional banks, the pricing of political-violence insurance, and the hurdle rates applied to any long-dated investment on the eastern flank.
There is also a fourth channel, less visible but potentially the most expensive: the re-rating of Europe's entire risk model for doing business with a revisionist neighbour. For three decades, European capital allocation assumed that the continent's eastern frontier was economically integrable — Russian energy, German industry, central European manufacturing, all connected by cheap gas and open logistics. The shadow war is the security corollary to the energy decoupling that followed the 2022 invasion: it tells investors that the friction between Europe and Russia is not a policy cycle but a permanent feature of the landscape. That is a structural repricing of European assets, not a tactical volatility spike.
The cyclical versus structural call matters here. A cyclical reading would treat the spike in incidents as a function of the battlefield tempo in Ukraine — more Russian pressure on the ground produces more hybrid pressure in Europe, and both ease if negotiations advance. That view has some support: Jäger noted there are currently no signs Russia is planning a large-scale military attack on the West, and he allowed only that "the possibility of low-level Russian military activities in the Baltic states cannot be ruled out." But the structural reading is stronger. The shadow war is not a tactic Moscow adopted for this conflict; it is the instrument of a state that sees confrontation with Europe as enduring. The networks behind Leipzig and Munich are infrastructure, not one-off hires. The targeting of defence industry and the explicit acceptance of civilian risk are doctrinal shifts, not battlefield improvisation. Even if the Ukraine war freezes or ends on terms, the incentive to keep Europe divided and deterred does not disappear. This is a regime shift in the European security environment, and regime shifts do not mean-revert.
The Counter-Thesis
The strongest case against Jäger's framing is that it is precisely what Moscow wants: a public escalation of threat language that validates Russia's narrative of an existential confrontation and hands hardliners in the Kremlin an argument for further mobilisation. Some European leaders, including Finland's president, have cautioned against overreaction, noting that sowing panic and chaos is itself a Russian objective. From this angle, the "new phase" is partly a function of detection and attribution — Europe is simply better at naming what has been happening for years — rather than a genuine intensification. If the Leipzig plot was intercepted before detonation and the Polish airspace breach lasted 42 seconds without consequence, the operational record shows containment, not collapse.
That counter-thesis has force, but it underestimates the cumulative effect of below-threshold attrition. Containment of individual incidents is not the same as deterrence of the campaign. A state conducting a shadow war does not need any single operation to succeed; it needs the target to exhaust itself responding to all of them. The falsifying signal for the structural view is specific: if, over the next two quarters, attributed incidents on NATO soil fall materially — say, to the pre-2026 baseline of isolated espionage cases rather than monthly kinetic or near-kinetic events — and if Russian diplomatic channels reopen following a negotiated settlement in Ukraine, then the shadow war was cyclical escalation tied to battlefield leverage, and the risk premium embedded in European infrastructure and eastern-flank assets should unwind. Until that print arrives, the default assumption must be that the campaign is structural and that the market is still discounting its full cost.
What To Watch
Three signals will determine whether this phase hardens further. First, the German response: Berlin's 2026 intelligence reform gave the BND new offensive tools, and Jäger's public testimony is itself a signal that the agency intends to use them — watch for reciprocal covert disclosures or expulsions beyond the consulate closures. Second, NATO's threshold management: the alliance's next move after an airspace breach or GPS attack on a member's military asset will set the practical meaning of Article 5 for hybrid operations. Third, the Ukraine trajectory: any credible negotiation track would reduce the incentive for Moscow to pressure Europe, while a Russian battlefield surge would likely be accompanied by a hybrid surge.
Short term, expect volatility around each new attribution — every drone, fire, or jamming incident will move defence, energy, and cybersecurity names before the facts settle. Medium term, the beneficiaries are clear: defence primes, munitions suppliers, cyber and physical security vendors, and the engineering firms that harden critical infrastructure. The exposed are equally clear: operators of European energy, transport, and telecom assets facing unplanned security capex; insurers underwriting political violence and war-risk coverage; and eastern-flank equities carrying a geopolitical discount that could widen before it narrows.
Three scenarios frame the path ahead. In the base case, the shadow war continues at its current tempo — monthly near-kinetic incidents, steady attribution, no treaty-level response — and Europe's security premium grinds slowly higher as each event confirms the structural thesis. In the upside case for risk assets, a negotiated Ukraine settlement removes Moscow's incentive to pressure the continent, incident frequency falls back toward the espionage-only baseline, and the eastern-flank discount unwinds. In the downside case, a successful attack with mass casualties on NATO soil forces the Article 5 debate into the open; defence and security names rally sharply, but the broader European equity risk premium gaps wider as investors price a continent that has moved from deterrence-by-denial to deterrence-by-punishment.
The shadow war's central paradox is that its success depends on remaining half-invisible — but the moment an intelligence chief stands before parliament and names it, the market's job is to decide whether the visibility is the warning or the noise. Jäger has made his call. The question now is whether Europe's defences, and its asset prices, catch up before the next incident forces the answer.
Explore more exclusive insights at nextfin.ai.
