Germany’s Power Grid Attacks Fit a Documented Pattern Tied to Ukraine Support
Maryam Tariq
German authorities launched a major security investigation after coordinated sabotage struck two power substations hundreds of kilometers apart within hours of each other on September 1. Taken alongside a wave of similar infrastructure attacks recorded across Europe over the past two years, the incident fits a pattern researchers have been documenting closely, sabotage that consistently targets countries and infrastructure connected to supporting Ukraine.
What Happened in Brandenburg and Cologne
The first attack struck the Turnow-Preilack substation in Brandenburg early on September 1, near Germany’s largest coal-fired power plant. Perpetrators fired specially designed rockets carrying conductive material into extra-high-voltage lines, intended to trigger mass short circuits across the grid. Brandenburg Interior Minister Jan Redmann confirmed bomb disposal teams found dozens of improvised explosive and incendiary devices at the site, with at least one having detonated before the rest were safely secured. Grid operator 50Hertz reported a brief regional power fluctuation and a temporary shutdown at the plant, though a mass blackout was avoided. Just hours later, a second attack struck the Bergheim substation near Cologne, successfully forcing a short circuit that knocked five lignite-fired power units offline, wiping out 4,200 megawatts of combined capacity. Essen police formally classified the incident as a deliberate act rather than a technical failure.
A Notable Coincidence in Timing
The same day these attacks occurred, German officials formally blamed Russia for a separate, thwarted drone plot targeting Leipzig Airport, a major logistics hub for transporting foreign military assistance to Ukraine. Investigators have not publicly confirmed any direct link between the airport plot and the substation attacks, but the overlap fits a documented broader trend security analysts have been tracking closely.
The Documented Pattern Behind These Attacks
Research from the International Centre for Counter-Terrorism and GLOBSEC, analyzing 151 sabotage incidents across Europe between February 2022 and February 2026, found sabotage operations quadrupled in 2024 compared to the previous year. Separate reporting tied to the Munich Security Report 2026 found more than 150 suspected Russia-linked hybrid incidents across the EU and NATO in early 2026 alone, with Germany specifically recording 321 suspected incidents, including drone intrusions and infrastructure-focused disinformation campaigns. Crucially, the same research identified the primary criterion determining which targets get hit, their connection to countries supporting Ukraine, rather than any inherent military value.
Who’s Actually Carrying Out These Attacks
One of the most striking findings from the ICCT and GLOBSEC research involves who is physically committing these acts. Of 172 individuals identified as involved in the 151 studied incidents, roughly 95 percent had no demonstrable ties to Russian intelligence services. Analysts describe many as repeat offenders, economically desperate migrants, and even minors recruited through platforms like TikTok and Telegram, a low-cost, deniable model that lets Russian intelligence services orchestrate damage while maintaining plausible distance from it.
Why This Strategy Persists
Analysts describe the underlying objective as primarily psychological and political rather than military. Geoeconomics expert Alex Kokcharov has described Russia’s ongoing hybrid campaign as a highly coordinated, sub-threshold effort aimed at destabilizing Western political systems, fracturing NATO and EU unity, and eroding public support for continued assistance to Ukraine. The strategy relies specifically on staying below the threshold that would trigger a unified military or political response, exploiting the absence of clearly defined red lines and a coordinated EU-wide approach.
Brandenburg’s Own Precedent
This isn’t the region’s first brush with infrastructure sabotage either. Brandenburg has previously seen attacks from domestic extremist groups, including a 2024 arson attack on an electricity pylon that completely paralyzed production at a nearby Tesla factory, meaning investigators are also weighing domestic far-left extremism as a possible explanation alongside the state-sponsored hybrid warfare theory, without having publicly settled on either as of this reporting.
What Comes Next
Brandenburg State Premier Dietmar Woidke called the incidents a deeply worrying escalation, urging Germany to reinforce security around critical energy infrastructure. With sabotage operations tied to Ukraine support continuing to climb year over year across the continent, and the individuals carrying them out often disconnected from any traceable state actor, security officials face a threat that is, by design, difficult to definitively attribute and even harder to fully prevent.
Sources:
· German police probe sabotage attempt on Brandenburg power plant — Anadolu Agency: https://aa.com.tr/en/europe/german-police-probe-sabotage-attempt-on-brandenburg-power-plant/4043902
· German power grid under fresh sabotage attack, police say — Reuters: https://www.reuters.com/world/europe/german-power-grid-under-fresh-sabotage-attack-police-say-2026-09-02/
· Russia’s escalating hybrid attacks put Europeans in a bind — Jefferson City News-Tribune: https://www.newstribune.com/news/2026/aug/27/russias-escalating-hybrid-attacks-put-europeans/
· Russia’s Hybrid Warfare and Sabotage, A Threat to Europe or an Overblown Scare — Defense Magazine: https://www.defensemagazine.com/article/russias-hybrid-warfare-and-sabotage-a-threat-to-europe-or-an-overblown-scare
