Two Bulgarians Arrested After Incendiary Attack on Munich Defense Firm
Source: Stock Image
EXECUTIVE SUMMARY
German police arrested two Bulgarian nationals on September 3, 2026, after they allegedly threw incendiary devices at a construction site adjacent to the headquarters of Rohde and Schwarz in Munich. One device ignited and was extinguished without major damage; a second failed to function and was neutralized by police. German federal security authorities told Tagesschau on September 5 that the attack shows strong indications of Russian intelligence direction.
ANALYSIS
The attack occurred in the early morning hours of September 3 near the Munich headquarters of Rohde and Schwarz, a German defense electronics firm whose products include drone detection, electronic warfare, and jamming systems used by North Atlantic Treaty Organization (NATO) member militaries. A 28-year-old Bulgarian woman and a 38-year-old Bulgarian man were arrested at a nearby petrol station shortly after the incident. One device successfully ignited and burned before it was extinguished. A second was found unexploded and rendered safe by police. No injuries were reported and no major structural damage occurred.
German broadcaster Tagesschau reported September 5 that federal security officials found strong indications the attack was carried out at the direction of a Russian intelligence service. The Bulgarian Foreign Ministry confirmed its nationals were detained. German federal prosecutors have jurisdiction over the espionage aspects of the investigation. The suspects' identities, travel history, communication records, and financial transactions are the primary focus of the current investigation.
Rohde and Schwarz does not manufacture weapons platforms but its drone detection, electronic support, and jamming systems are embedded in NATO's operational capacity to counter Russian drone operations. The target selection expands the documented Russian hybrid warfare target list beyond direct Ukraine resupply nodes to include the European defense technology ecosystem more broadly. Disrupting firms that produce detection and defeat systems degrades NATO's battlefield advantage without attacking a formal weapons production facility.
The operational model, Bulgarian nationals directed to conduct a low-signature incendiary attack overnight and arrested at a nearby transit point, matches the proxy-recruitment pattern documented in prior attributed Russian hybrid actions across Europe. Prior incidents in the current cycle, including the August 4 Leipzig-Halle Airport drone strike attributed to Russia and the Brandenburg and Rhineland power grid attacks, did not produce immediate arrests. The Munich case is among the first in the current wave to result in named suspects in custody.
SOURCES
