On the morning of 8 June a substation burned in Reutlingen and roughly 30,000 people lost power. Within hours, before the fire was out, anonymous Sicherheitskreise had handed the dpa a propagandist decree. Links. Left-extremist. The police at the actual lectern said something honest instead. They were investigating in every direction, a technical fault among them, with no political indicator in hand.
Three burn points and a cut fence. That was the evidence, which has hallmarks of Russian special servcies. The conclusion that serves the Russian propaganda arrived ahead of it.
I have tracked Russian critical infrastructure attacks for decades. Notable is Berlin, September 2025: two pylons in the southeast, around 50,000 households dark for sixty hours. Berlin, January 2026: a cable bridge in Lichterfelde, 45,000 households without heat for days in a winter freeze. Both were falsely pushed as left-extremist within the hour. Both were pinned on a phantom called the Vulkangruppe, which has Russian links. Fifteen years of attacks under that influence banner, and German authorities have produced zero convictions.
Start with the name, because the name gives the game away. I have done deep investigations into anarchist hacking culture, and I can tell you what any true energy-infrastructure cell manifests into. Autonome Zellen. Revolutionäre Zellen. A date, a martyr, a class signifier. Anarchists run on no gods, no masters. So a hero-worship cell that brands itself after the Roman god of the forge, the divine blacksmith of weapons and armor, fails every test the left has kept for a century. Roman mythology reads as bourgeois classical education, which reads as fascist. The forge celebrates the instruments of industrial power. Germans built their identity on beating Rome. Russians built theirs on inheriting it, the Third Rome, Tsar from Caesar.
The Vulkan name fits Moscow’s vocabulary, not Berlin’s.
The grammar leaks too. The 2011 Hekla-Empfangskomitee is clumsy German that snaps into place the moment you read it as Russian. A German militant writes Fraktion, Zelle, Gruppe, Bund. A German does not convene a reception Komitee. Komitet is the Russian default, as in Komitet Gosudarstvennoy Bezopasnosti, the KGB. The Icelandic volcano aliases mean nothing to a German activist, and volcanoes are the precise opposite of what a climate movement protests. This is backstopping, a thin cover layered on after the fact.
Now the coincidence that should end the argument. NTC Vulkan is a Moscow military contractor founded in 2010 by St Petersburg academy graduates, cleared for classified state work in 2011, builder of infrastructure-attack and information-operations tooling for Sandworm. In 2011 a self-named Vulkangruppe began burning German infrastructure. The same year. The same forge.
The investigations fit the cover, not a hunt. In 2024 two suspects were arrested and the Amtsgericht Tiergarten acquitted both, the prosecution declining to appeal. Arrest, insufficient evidence, acquittal, no appeal is the signature of a case where intelligence equities have made prosecution impossible. The Verfassungsschutz lists the Berlin membership potential as nicht bekannt, unknown. That is the profile of a managed service, not a leaky anarchist scene.
Now read the map of what actually gets hit.
The IISS record and the German prosecutor’s own files describe one logic, and it has a name. Ukraine support. An IMSI-catcher plot against Patriot crews at Patch Barracks near Stuttgart. German-Russians caught in Bayreuth scouting the US base at Grafenwöhr to disrupt arms logistics. A plot to murder the chief executive of Rheinmetall. A fire at the Diehl plant in Berlin that builds IRIS-T air defense for Kyiv. An incendiary device in the DHL air hub at Leipzig. The Verfassungsschutz states the method plainly. Russian services commission arson on German soil through locals who never learn who hired them. Poland proved it with the Warsaw mall fire. Russia proved it inside Germany with the Be Greener operation, more than 270 vehicles vandalized by FSB-recruited hands to smear the Greens before the 2025 election. False-flag environmentalism is a tool they have already run in the open.
Lay the documented events end to end and the shape of a Russian campaign in Germany is hard to miss.
| Date | Location | Event | Status |
|---|---|---|---|
| 2011 | Berlin, Ostkreuz | Rail cable bridge set alight, rail disrupted | First Vulkangruppe claim, no convictions |
| 2013 | Berlin, Adlershof | Arson at a radio mast | Vulkangruppe claim, unsolved |
| 2018 | Berlin, Charlottenburg | Arson cut power to roughly 6,500 homes | Vulkangruppe claim, unsolved |
| 2020 | Berlin | Arson at the Heinrich Hertz Institute | Vulkangruppe claim, unsolved |
| 2021 | Grünheide | Cable arson idled the Tesla factory | Vulkangruppe claim, unsolved |
| 2021 to 2022 | Berlin, British Embassy | Guard David Smith passed material to Russia | Convicted of spying for Russia |
| 2022 | Stuttgart, Patch Barracks | IMSI-catcher plot to track Ukrainian Patriot crews | GRU-linked plot |
| 2024 (Mar) | Grünheide | Pylon arson cut power to the Tesla factory | Vulkangruppe claim, unsolved |
| 2024 (Mar) | Berlin, Lichtenberg | Nine Teslas torched in one night | Arson suspected, unsolved |
| 2024 (Apr) | Bayreuth and Grafenwöhr | Two German-Russians caught scouting the US base, plotting arson on arms logistics | Arrested, GRU-linked |
| 2024 (May) | Berlin | Fire at the Diehl plant making IRIS-T for Kyiv | Cause officially undetermined, sabotage suspected |
| 2024 (Jun) | Germany | AfD Bundestag staffer fraudulently naturalized | Citizenship revoked by court |
| 2024 (Jul) | Germany | Plot to assassinate Rheinmetall CEO Papperger | Russian plot, thwarted |
| 2024 (Jul) | Leipzig | Incendiary device ignited at the DHL air hub | Russian parcel-arson plot |
| 2024 (Aug) | Geilenkirchen and Cologne | Drone probe of the AWACS base, cut fence at an airbase water plant | GRU reconnaissance |
| 2025 (Feb) | Across Germany | Be Greener op damaged more than 270 vehicles before the election | FSB false-flag, blamed on climate activists |
| 2025 (Mar) | Berlin, Steglitz and Treptow | Four Teslas torched in one night | Arson suspected, unsolved |
| 2025 (Sep) | Berlin, Johannisthal | Two pylons, roughly 50,000 households dark for 60 hours | Vulkangruppe claim, officially left-extremist |
| 2026 (Jan) | Berlin, Lichterfelde | Cable bridge, roughly 45,000 households out for days in a freeze | Vulkangruppe claim, officially left-extremist |
| 2026 (Jan) | Berlin | Ilona W., GRU agent posing as a Ukrainian advocate, mapped drone sites and arms deliveries | Arrested, handler expelled |
| 2026 (Mar) | Germany and Spain | Surveillance of a drone supplier to Ukraine, filming home and workplace | Arrested, GRU-linked |
| 2026 (Jun) | Reutlingen | Substation fire cut power to about 30,000, three burn points and a cut fence | Suspected arson, left-extremist floated, under investigation |
What gets more interesting is to lay this attack campaign over the AfD vote campaign, and the “official story” melts from two directions at once. Where Russia hits Ukraine logistics it hits cities, because that is where the bases and the defense plants and the freight hubs sit, and cities are where the AfD runs thin. Cologne, probed repeatedly, holds the party’s worst result in the country. Leipzig, the DHL hub, is a low-AfD island inside Saxony, one of its strongest states. By target logic these attacks should run where the AfD does not yet have control.
The Vulkangruppe grid attacks obey the same rule rather than reversing it. They cluster in Berlin, where the AfD runs far behind its national share, with the Tesla site at Grünheide on the edge. Vote share selects neither set of targets. Infrastructure does, with the capital and the Musk brand adding their pull. The tell sits elsewhere, in the division of labor. The physical operations follow the cables and the bases into the cities, while the party works the other half from its eastern strongholds. The AfD is the bloc German lawmakers have called a sleeper cell loyal to Russia, after a flood of parliamentary inquiries seeking drone-defense capabilities, military logistics schedules, civil-protection resources, data-center locations and emergency power supplies. Thuringia’s interior minister said the AfD looked to be working a checklist from the Kremlin. That is reconnaissance from inside the office. The same party was caught running a Russian into German citizenship through a Bundestag office, until a court reversed it.
And the program reads like the objective the fires are built to deliver. The AfD’s 2025 platform demands the immediate lifting of sanctions and the repair of Nord Stream, with Ukraine pushed to neutrality outside NATO and the EU.
sofortige Aufhebung der Wirtschaftssanktionen gegen Russland
In the Bundestag the AfD fraction rejects weapons on principle, in the same way that Trump campaigned that he would end all wars on day one. Tino Chrupalla calls the war none of our business and proposes taking Russian gas through Nord Stream 2 in the same breath. Alice Weidel, once investigators traced the pipeline blast to a Ukrainian team, demanded Kyiv pay Berlin compensation.
Björn Höcke calls Putin a rational man who wants peace, works the Friedensspaziergang circuit where the energy crisis and the weapons deliveries braid into one grievance, and wraps the war in a Soros-and-Covid conspiracy that any reader of the last century knows on sight.
The peace-research institute PRIF reached the cautious version. This program attacks Ukraine and strengthens Russia by weakening Germany. The blunt version needs fewer words. It is Moscow’s war aims disguised as a German ballot.
Then there is the red handprint on the pen weakening German infrastructure the most. Alexander Dobrindt, the Interior Minister who once looked at copper and fiber and chose copper, dragging Germany to the bottom of European broadband, looked at the threat data and started speaking Russian propaganda. In June 2025 he told a press conference that violent left-extremists were rising significantly, to 11,200, while the chart in his own hand held them flat. Volksverpetzer put it cleanly, a significant rise from 11,200 to 11,200. The report he was holding showed right-wing extremists up by a quarter to 50,250, right-wing violent crime up 47 percent, left-wing violent crime down nearly 30. He buried the larger number and inflated the smaller one, fundamentally lying. Then, after the Berlin blackout, he told everyone on ZDF that Russia should be ruled out immediately before the investigation closed and he promised to expand surveillance of the “left”. A government that names a GRU threat must answer it. A government that blames domestic extremists can defer, study, and score points with or against the AfD by pushing the country hard-right into Russia’s hands. That is the choice Dobrindt repeatedly makes, espousing the language of fascism in the German government.
So let me be precise, because Germans love precision as much as their trains never run on time. This is a convergence of aims. The public evidence stops there. Intelligence has not yet reported AfD ties to arson, and the case needs none to see the fit. Russia burns the logistics. The party harvests the result in two currencies, votes on one side and the instant story on the other, the story that sends “Vulkan” signals while the hand that struck stays in Moscow. A German minister supplies the stamp to transfer foreign influence to domestic.
The grid was burned in Reutlingen, and inside the hour the same word popped into three mouths, like a pattern. The wire service. The party. The minister. One of them lit the disinformation fire to smoke the political scene. One breathes it in. One writes the law. They all want the same right-wing extremist propaganda in German minds.
