Same Putin Playbook, Same War, Different Deniability

This week over 1,000 buildings in Kyiv lost heating. Russia had launched nearly 1,100 strike drones, 890 guided aerial bombs, and over 50 missiles against infrastructure in Ukraine.

Temperature: minus 10 Celsius.
Impact: Over 500,000 civilians in danger from Russian attacks.

Zelenskyy called it “conscious, cynical Russian terror against the people.”

In Berlin, timed for the same winter cold spell, Russia targeted heating and energy systems. Their Vulkangruppe attacked civilian dependence on critical infrastructure in freezing weather.

The operational logic is identical. The difference is how Putin architects deniability.

The Strategy Has a Name

What Russia is executing across both theaters is “coercive degradation”. It is a systematic destruction of civilian trust in infrastructure to break political will without triggering direct military response. The target appears to be infrastructure itself. The target is actually trust in democracy, undermining confidence that a representative government can protect its citizens.

In Russian military doctrine, this falls under “reflexive control”: shaping an adversary’s decision-making by controlling the information and conditions they use to make decisions. When German citizens lose heat in winter and their government lacks a coherent explanation, they begin to question their safety. That questioning is the objective. It of course also matters that Russia has radical right-wing politicians working for them in Germany, pre-maturely declaring the enemy can’t be Russia.

The Gerasimov doctrine explicitly prioritizes non-military means of achieving military objectives. The ratio he proposed: 4:1, non-military to military.

Infrastructure sabotage in any NATO territory is the non-military component. Missile strikes in Ukraine are the military component. We see this play out a single campaign, where different tools are calibrated to what each theater will tolerate.

Russia can’t invade Germany, yet. But they can have the German CDU party and interior minister sow political fear and doubt after Russian assets destroy critical infrastructure.

The Deniability Gradient

Russia operates on a sliding scale of attribution:

• Ukraine: Overt military strikes. Denial is performative – everyone knows, Russia doesn’t care. The message is raw power.
• Germany: Covert sabotage. Plausible deniability maintained. Attribution is slow, contested, buried in bureaucratic process. The message is vulnerability.
• Undersea cables, pipelines: Technical deniability. “Accidents happen.” Years of investigation, sporadic arrests of Russians, no consequences. The message is impunity.

This gradient is the core feature of hybrid warfare, as I discussed earlier with the CIA Snow Globe methodology. Russia calibrates pressure precisely to stay below the threshold that would trigger unified NATO response while still inflicting costs. Each level of deniability corresponds to a different political tolerance in the target population.

Germany should know better than to delay infiltration and disruption of Vulkangruppe’s ties to Russia.

Winter as Weapon

Russia has weaponized winter for centuries, and celebrates it as one of their tactical advantages. Hitler and Napoleon both were wrecked. What’s new is the precision application across multiple countries simultaneously, calibrated to each target’s political tolerance and attribution capacity.

The seasonal window is extremely strategic. Infrastructure attacks in July reveal the many Russian weaknesses. Infrastructure attacks in January are signature Russian, psychologically damaging and potentially lethal. Russia synchronizes its offensive operations with weather that multiplies impact of their least efforts. The same sabotage in summer that would be laughed away, becomes a crisis instead when timed for hospital and school pipes to freeze and heating fail.

This isn’t opportunism. It’s diabolical operational planning. The winter offensive against Ukrainian infrastructure intensifies every year in the same months. The sabotage operations in Germany follow the same calendar. The pattern indicates Russian centralized planning exploiting weather vulnerabilities.

The Strategic Objective

The goal, as always with the Russians, is to fracture political cohesion, inject weakness into an enemy through disruption of representative government. In terms of NATO states, Russia aims for three things:

• Vulnerability: NATO members cannot protect their own critical infrastructure
• Impunity: Russia can impose costs without suffering consequences
• Linkage: Supporting Ukraine means accepting domestic attacks

Every German citizen who loses heat this winter is meant to ask: should I support the AfD (Nazi) party because I’m scared and they talk tough about the enemy? Every unanswered sabotage operation reinforces the message that your government needs a “strong man” to keep you safe.

This is the same logic as the terror bombing campaigns of the 20th century, updated for hybrid warfare. The innovation is plausible deniability for achieving the political effects of strategic bombing without the political costs of attribution.

Why Germany Won’t Say It

German authorities continue treating infrastructure attacks as a string of isolated criminal incidents rather than a coordinated Russian campaign. This unfortunately means that while German intelligence services understand exactly what’s happening, their hands are tied by political paralysis.

Naming Russia as the attacker would require a very different response. A response would require political will. Political will would require explaining to the German public that the AfD (Nazi) party has been involved in Russian sabotage operations, covered up by the CDU party in an attempt to win AfD voters back. Easier to investigate an incident separately, or not at all, and let attribution fade into bureaucratic process, and hope the pattern remains invisible to the public.

This is what Russia pays for and counts on.

The deniability gradient works because Western politicians cooperate and even collaborate with it. They try to spin a fiction of isolated incidents to use for political gain, because acknowledging the sustained attack would require action they’re not prepared to accept and take.

The Test

Ukraine can name its attacker. We see Zelenskyy call it “conscious, cynical Russian terror” because the missiles leave no room for ambiguity, and he is a leader.

Germany plays dumb, or incompetent, and creates a leadership vacuum by refusing to admit its attacker. 15 years of Vulkangruppe attacks and yet supposedly not a single clue linking it to the Moscow Vulkan contractors to FSB (known for Sandworm). Germans are making a choice to let the CDU/AfD dynamic play out and swing politics hard right, rather than force attribution that would expose it. That’s a choice. The sabotage leaves just enough room for official doubt, and German political culture fills that space with paralysis enabling a radical right-wing minister to point the wrong direction. I think we all know how this turned out in Germany before.

Weaponizing winter works the same whether you use missiles or ministers. The only question is whether German intelligence will leak and citizens will start to recognize the pattern before the next heating season, and whether recognition would change anything.

Russia is still betting the AfD (Nazi) party will continue to normalize sabotage. So far, that investment is paying off.

On the implausibility of anarchist operational security and the convenience of unsolved attacks with GRU footprints all over the “snow“.

In January 2026, a group calling itself the radical-right-sounding Vulkangruppe claimed responsibility for an arson attack that left 45,000 Berlin households without power during a winter freeze. A huge city without power and heat in freezing temperatures for four days, mobile networks unreliable, and it’s been classified as LOW. German authorities immediately, as if to bypass investigation, blamed an invisible “left-wing extremist” and anarchist movement. The Verfassungsschutz (Federal Office for Constitution Protection) dutifully updated its assessment. Politicians condemned eco-terrorism. The investigation begins now, after the political accusations.

This is the fifteenth year of such suspiciously directed investigations. None have produced a single conviction.

At some point in German history, the question for Berlin shifts from “who is this mystery Vulkangruppe?” to “why has no one been caught?” The answer reveals less about German use of anarchism for political purposes than about the architecture of plausible deniability in hybrid warfare. Or dare I say it’s about whether German intelligence is playing dumb, penetrated, or both.

…Nazi scene has crossovers with state officials. A Berlin police superintendent was accused of supplying classified police computer files to members of the far-right via a chat group. When this was discovered, the officer was simply relocated to another force.

The Timeline Problem

Vulkangruppe was launched in 2011. The Verfassungsschutz dates its founding to that year. The first attacks targeted railway infrastructure in Berlin, claimed by groups using volcano names of Iceland as their signature; a branding tactic that has remained remarkably consistent for fifteen years.

2011 definitely was not a random year in Russian politics, Russian infrastructure attacks, or Russian relations with radical-right groups in Germany. Vladimir Putin was preparing his return to the presidency after the Medvedev interregnum, consolidating what would become an increasingly aggressive posture toward the West. The following years saw Crimea’s annexation (2014), the systematisation of hybrid warfare doctrine, and the dramatic expansion of GRU operations across Europe. Putin, who served in the USSR to resurrect fascist groups in West Germany, was back in the saddle. Putin’s KGB Dresden tenure literally had been running Nazi assets undercover as chaos agent multipliers (e.g. building centrally planned and coordinated “anarchy” cells).

Vulkangruppe’s operational tempo tracks these developments with uncomfortable precision:

• 2011-2013: Initial attacks on rail and communications infrastructure during Putin’s return to power
• 2014-2017: Relative quiet during the consolidation of Crimea operations
• 2018: Resumption with power grid attacks as GRU operations intensify across Europe
• 2020-present: Escalating frequency and impact, paralleling documented GRU sabotage campaigns

Correlation is not causation. But when a group’s operational rhythm mirrors geopolitical strategy rather than ideological momentum, the analytical frame deserves proper caution and reconsideration.

Want more evidence? NTC Vulkan (НТЦ Вулкан) is a Russian company founded by Anton Markov and Alexander Irzhavsky in 2010. Both are graduates of St Petersburg military academy and served in the Russian army, with Markov reaching captain and Irzhavsky reaching major. Vulkan received special licences to work on classified military and state projects from 2011. Putin’s GRU gets a contractor called “Vulkan” cleared for classified work in 2011, and a self-described Vulkangruppe starts burning German infrastructure that same year. The contractor develops tools for infrastructure attacks and information operations, which is exactly what has been executed in Germany under “Vulkan” branding. The sheer coincidence of naming over time is a wonder to behold.

Not to state the obvious here but if a genuine anarchist momentum was suspected, it would need to explain an operational gap that perfectly brackets Vulkan’s focus on Ukraine.

The Operational Signature

The Center for Strategic and International Studies documented that Russian attacks in Europe nearly tripled between 2023 and 2024, after quadrupling between 2022 and 2023. The operational signature is now well-established: low-tech methods, high-impact targets, plausible deniability, locally recruited perpetrators, communications severed before primary attacks.

Vulkangruppe attacks display identical characteristics:

• Incendiary devices at cable infrastructure (low-tech, reproducible)
• Targeting of power substations and communications nodes (high-impact chokepoints)
• Ideological framing that provides alternative attribution (climate activism, anti-capitalism)
• Sophisticated operational security despite supposedly decentralised structure
• Zero successful prosecutions despite fifteen years of activity

The last point warrants emphasis. German intelligence acknowledges a 2015 “strategy paper” suggesting “a fixed structure.” Linguistic analysis of claim letters indicates a “partly identical circle of authors.” Yet the Verfassungsschutz officially reports: “Personenpotenzial in Berlin: nicht bekannt”—membership potential unknown.

This is NOT a description of anarchist cells. The opposite. Anarchist movements are notoriously penetrable; informants, defectors, and operational mistakes are endemic to decentralised structures. What German authorities describe is the operational security profile of a state intelligence service: compartmentalised, professionally managed, and protected.

The Acquittal Pattern

In 2024, German authorities arrested two suspects in connection with Vulkangruppe activities. The courts (Amtsgericht Tiergarten) found the evidence insufficient and acquitted both on 15 July 2024. The prosecution did not appeal.

This particular pattern of arrest, insufficient evidence, acquittal, no appeal is a well-known characteristic of cases where intelligence equities have complicated prosecution. Either the evidence cannot be presented without compromising sources, or the sources themselves are the complication.

German commentators have begun asking the obvious question: are Vulkangruppe operatives so far inside they also are Verfassungsschutz contacts? The precedent exists. Germany’s domestic intelligence services have a documented history of maintaining informants within extremist organisations who proved difficult to prosecute—the NSU case being the most notorious example.

But there is another possibility, less discussed: that the penetration runs in the opposite direction.

The AfD Intelligence Pipeline

In November 2025, German lawmakers described the Alternative für Deutschland (AfD) party of operating as a “sleeper cell loyal to Russia.” The accusation centred on the peculiar rush and direction of parliamentary inquiries. A flood of 47 requests within a single year were seeking very detailed information about:

• Police drone detection and defence capabilities
• Military logistics and procurement schedules
• Cybersecurity gaps at federal ministries
• Civil protection resources and healthcare facilities
• Data centre locations and emergency power supplies

Thuringia’s Interior Minister Georg Maier stated that the AfD appeared to be “working through a checklist from the Kremlin.”

The geographic overlap is precise. AfD’s strongholds of Thuringia, Brandenburg, Saxony are the exact same eastern German states where Vulkangruppe concentrates its operations. The Thuringia AfD branch, led by Björn Höcke (whom a German court ruled legally and officially you should call a fascist), has been under surveillance as a “proven right-wing extremist” organisation since 2021.

The information flowing through AfD parliamentary inquiries—infrastructure vulnerabilities, emergency response capabilities, power grid architecture—is precisely the reconnaissance data required for effective infrastructure sabotage.

The Designated and the Undesignated

The European Union, United Kingdom, Canada, Australia, and New Zealand have all designated The Base (Nazi organisation operated from St. Petersburg by alleged Russian intelligence asset Rinaldo Nazzaro) as a terrorist organisation.

The United States has not.

In December 2025, Nazzaro released audio calling for “acceleration teams” to conduct “targeted attacks on essential infrastructure” in America and Ukraine. Less than three weeks later, a fire at a San Francisco PG&E substation knocked out power to 130,000 customers. The cause remains under investigation by Exponent, the notorious firm whose business model is manufacturing reasonable doubt for corporate clients.

Germany faces an analogous situation. Presumably a Nazi terrorist group like The Base doesn’t need to focus there, given Vulkangruppe operates with impunity. And there is no Exponent snow job needed while authorities rush to insist the Roman god “Vulkan” group represents “left-wing extremism.” Perhaps most damning, documented Russian intelligence operations, including AfD’s systematic collection of infrastructure data, proceed through legitimate parliamentary channels.

The analytical question is not whether Vulkangruppe members personally hold some political beliefs of anarchy. Some may even wear an anarchist patch. The question is whether those beliefs, and the ideological framing of attack claims, are simply cover for operations serving ideologically different strategic purposes.

The Preparedness Day Parallel

On 22 July 1916, a bomb exploded during San Francisco’s Preparedness Day parade, killing ten people. The attack was never solved. But it was used very specifically to prosecute innocent left-wing organisers Tom Mooney and Warren Billings on fabricated evidence. This served President Wilson’s domestic political agenda, aligned with Germany, while actual German sabotage networks operated freely across American infrastructure.

The institutional utility of attacks plaguing America remaining “unsolved” was that they could be attributed to whoever served the administration’s purposes. The actual perpetrators, connected to German military intelligence operations active across American industrial targets, remained ghosts.

Wilson knew German agents were bombing American infrastructure and shipping in 1915. He was briefed by U.S. intelligence on German “Nachrichtendienst”, and that America was under foreign attack. His infamous “neutrality” rhetoric while investigating left-wing leaders provided domestic cover for foreign sabotage and bombings, even as they were described at the time as a “holocaust” of fire in American industrial areas.

Contemporary Germany faces a structural parallel. The unsolved “left-wing extremist” attribution over more than a decade serves multiple functions:

• It directs investigative resources away from Russian intelligence networks
• It provides political ammunition against climate activism and anti-capitalist movements
• It maintains the fiction that infrastructure attacks are domestic rather than foreign
• It avoids the policy implications of acknowledging GRU operations on German soil

The attacks continue. The investigations produce nothing. And German citizens lose power in winter while their government debates the extremism of environmentalists.

What Would Evidence Look Like?

Critics will note that this analysis is circumstantial. No intercepted communications, no defector testimony, no documentary proof links Vulkangruppe to Russian intelligence.

This is true. It is also the point.

The absence of evidence after fifteen years of investigation is itself evidence of either spectacular incompetence or structural barriers to discovery. German intelligence services that successfully penetrate genuine anarchist networks, that maintain informants across the extremist spectrum, that coordinate with European partners on Russian hybrid threats, have somehow failed to identify a single member of an organisation conducting repeated attacks on critical infrastructure.

The growing question goes far beyond what would prove Russian involvement. It now is what would disprove the link, and whether German authorities are structured to even ask.

When the AfD gathers infrastructure intelligence through parliamentary inquiries, this is documented and denounced but not prosecuted. When Vulkangruppe attacks infrastructure with professional precision, this is investigated and unsolved. When European partners attribute identical attack signatures to GRU coordination, Germany maintains the anarchist frame.

The pattern suggests not investigative failure but investigative success to protect a conclusion that serves institutional interests.

Putin’s Abusive Attribution

Russia’s hybrid warfare doctrine treats attribution as a weapon. Operations are designed to permit multiple interpretations, allowing target governments to choose comfortable explanations over destabilising truths. A government that acknowledges GRU attacks on its infrastructure must respond. A government that attributes those attacks to domestic extremists can defer, study, and ultimately accommodate.

Vulkangruppe may include recruits from anarchist meetups led to believe they are in a cause. This does not preclude, and may even facilitate, their quick utility to Russian strategic interests. The GRU’s documented recruitment model emphasises “locally recruited perpetrators” who are “often unaware of the strategic intent.” Putin was notorious in the KGB days for politically weaponizing German athletic clubs.

The August 2025 Vulkangruppe pamphlet announced intentions to target “Russian and Ukrainian oligarchs”, which is precisely the kind of misdirection a sophisticated operation would include. The January 2026 attack targeted affluent neighborhoods to “cut the juice to the ruling class”, using comic-book villain rhetoric that reads as ideological but functions as operational cover.

Fifteen years without an arrest. A strategy paper without identified authors. Parliamentary inquiries mapping infrastructure vulnerabilities. European partners warning of GRU sabotage at “record high” levels. And German authorities rapidly propping up signs that the only pattern to see here is anarchist eco-terrorism.

For historians of WWI Germany, the parallel requires no elaboration. For contemporary analysts, it demands one question: if this is not Russian hybrid warfare, what would Russian hybrid warfare look like? The answer, presumably, would look exactly like this.

The investigations continue, the exact wrong way. Perhaps because a conclusion was written before the evidence was examined.

NOTE: German intelligence services deny investigative failure and maintain that Vulkangruppe represents domestic left-wing extremism. The AfD denies being Nazis and acting on behalf of Russian interests, and characterises all surveillance other than their own as politically motivated. Russian authorities deny everything including conducting sabotage operations anywhere, ever.

US Secretary of State Rubio has defended AfD against extremist designation. FBI Director Patel has deprioritized far-right investigations. The Base remains undesignated in the country it explicitly targets. This transatlantic coordination of non-investigation of GRU footprints in today’s “snow globe” is, presumably, coincidental.

One must admit the cruelty, really. If you set out to design a cartoonishly villainous assault on Colorado specifically, you could hardly do worse than shitting in their coal and water in the same week. It’s as if someone studied the state seal, noted the pickaxe and the mountains, and thought: attack.

The coal situation achieves a kind of particular insult to Coloradans. Energy Secretary Chris Wright, a fracking CEO who donated $228,390 to Trump’s campaign and once swallowed fracking fluid on camera to fake its safety, has ordered a coal plant to remain open under emergency powers. The emergency does not exist. The grid doesn’t need the power. The plant itself is currently broken, after a critical part failed on December 19th, and produces nothing at all. Rural Colorado ratepayers will spend millions on “repairs”, then $85 million annually operating it, to generate electricity priced higher than alternatives nearly 100% of the time.

Peak Cruelty

The massive corruption for an undeserving beneficiary is not difficult to identify.

Two-thirds of that $85 million is fuel costs, paid to Trapper Mine, whose sole customer is this plant. The “emergency order” is a coal subsidy dressed in the language of grid reliability. This is Wright’s sixth such order – plants in Indiana, Michigan, Washington, Pennsylvania – suggesting less an emergency than a policy of preventing market forces from retiring coal under any circumstances.

Unpotable

The water situation is, if anything, more instructive. Trump vetoed the Finish the Arkansas Valley Conduit Act – a sixty-year-old project to deliver clean drinking water to 50,000 people in southeastern Colorado, where the groundwater is contaminated with radioactivity. The bill passed the House by voice vote and the Senate by unanimous consent. The Congressional Budget Office estimated the federal cost at under half a million dollars.

Trump’s stated rationale was utter nonsense. Eighty-five million for unnecessary coal from a dead site: “emergency” infrastructure. Just a half million for potable water to 50,000 people: a sudden taxpayer burden claim.

One does not need to be a student of logic to notice the hate for humanity behind the asymmetry.

The bill’s sponsor was a Trump loyalist Lauren Boebert. It was, by most accounts, the most significant legislation of her congressional career. However, six weeks earlier she had been summoned to the White House Situation Room and pressured to remove her name from the discharge petition forcing release of Jeffrey Epstein’s DOJ files. She declined to kiss the Epstein child trafficker ring. The Trump-Epstein disclosure bill passed 427-1. Thomas Massie described what they overcame: “We fought the president, the attorney general, the FBI director, the speaker of the House and the vice president.”

Boebert herself has raised the possibility that the veto was retaliation.

“I sincerely hope this veto has nothing to do with political retaliation for calling out corruption and demanding accountability,” she said, in the manner of someone who believes precisely the opposite.

Colorado, it should be noted, also refused to release election-tampering convict Tina Peters after Trump’s pardon. A pardon that is fraud as it does not apply to state crimes. The state has managed to become a target of the Trump family on multiple fronts.

The Scorpion

Rural Coloradans who voted for Trump three times will now subsidize overpriced and unneeded coal to enrich executives of a plant that doesn’t work, while drinking water is left dangerously contaminated because half a million dollars for health was deemed a waste of money by Trump. The coal industry receives an $85 million handout from taxpayers laundered through abuse of emergency powers. A loyalist who defected on a single vote, and cared about children, watches her signature achievement destroyed.

This is not governance.

It is not even competent grift.

It is the behavior of a very sick man who is proving consequences do not apply to him, like a cartoon villain with no redeeming qualities.

This is a giant T burning on the lawns of Colorado.

The cruelty is the point. America is being recast as the bad cowboy. What would Captain Silas Soule say?