Munich Molotovs, Bulgarian passports: the cheap hands of a spy service that lost its embassies

German police have arrested on 3 September two Bulgarian citizens after Molotov cocktails were thrown from a car at a building site in front of the Munich headquarters of Rohde & Schwarz, the defence and secure-communications group that supplies the Bundeswehr.

A 28-year-old woman and a 38-year-old man were stopped at a petrol station on Innsbrucker Ring shortly after midnight. One device ignited near construction containers. Damage was slight; nobody was hurt. A second device was made safe. Bavarian investigators have not named a motive. They have not even confirmed that the pair threw the bottles. That caution should stay in the first paragraph. The target, the method and the passports sit in a pattern Europe already knows.

Rohde & Schwarz is not a random warehouse. It builds jamming-resistant radios, classified communications and cyber tools for governments and armed forces. Its Munich site is the group’s research core. In a week when Berlin has already blamed Russia for a drone plot at Leipzig airport, an arson attempt at a company that digitises German land forces is not a curiosity. It is a hypothesis that has to be tested — and a reminder that the testers will often not be Russians in diplomatic plates.

A catalogue, not a coincidence

Bulgarian nationals have become a recurring cast in Europe’s hybrid file.

In Britain, six Bulgarians were jailed in 2025 for running, from a Great Yarmouth guesthouse, what police called one of the largest foreign-intelligence operations seen in the UK: surveillance of journalists, dissidents and a US base in Germany where Ukrainians trained, directed by Wirecard fugitive Jan Marsalek for Russian services. They were not illegals from Yasenevo. They were a beautician, a lab assistant, a decorator, a fighter — subcontractors paid to do the watching.

In Paris, four Bulgarians were convicted over the “red hands” daubed on the Holocaust Memorial, an operation French services tied to a Russian influence play designed to look like a Gaza-war spasm. One of the same networks brushed the Eiffel Tower coffin stunt of June 2024: five boxes labelled as French soldiers dead in Ukraine, a Bulgarian driver who said he was paid a few tens of euros, two others allegedly paid a few hundred, a van, a coach station, a bus toward Berlin. Theatre for the price of a weekend job.

None of that proves the Munich pair work for Moscow. It proves why a prosecutor in Bavaria will now ask who paid for the petrol.

Why Eastern Europe, why now

After February 2022 Europe did the one thing that used to hobble Soviet and Russian intelligence: it threw the officers out. MI5 has put the number of Russian diplomats and suspected intelligence officers expelled across the continent between 2022 and 2024 at around 750. Embassies shrank. Legal residencies vanished. The professionals who planned operations from consulates in Vienna, Brussels and Berlin lost their cover. The services adapted.

The replacement model is ugly and efficient. Recruit on Telegram. Offer €1,500 to €10,000 for a “simple task”: film a site, light a container, paint a wall, leave a prop. Prefer people who can move inside Schengen without a visa drama – EU citizens from Bulgaria and Romania, residents from Moldova and Serbia, Ukrainians and Belarusians with papers, anyone with debts and a willingness to travel, act and leave. GLOBSEC’s incident set of Russian-linked kinetic activity in Europe now runs to 151 cases since the full-scale invasion; a large share of the hands were not locals of the target country. They were travellers. Bulgaria sits in that list for a reason that is structural, not cultural: EU passport, cheap travel, large diaspora, language skills, and a domestic politics in which parts of the elite still treat “Russian hand” as an insult rather than a working assumption.

The product is deniable and disposable. A GRU officer caught with a detonator is a casus belli. A 28-year-old from the Balkans caught with a bottle is a crime story. Even failure pays. Arrests seed headlines, strain police, and feed the line that Europe is unsafe because of migrants, Ukraine, or its own panic. Moscow does not need the fire to take the building. It needs the fire to be on television.

Germany is the pressure plate

The last few days in Germany – Leipzig, a station blast, a substation, now Munich – are being read in Warsaw as the moment hybrid war stopped being “nuisance on the internet.” Polish foreign minister Radoslaw Sikorski told colleagues at the Gymnich that it now means arson, trains and assassination squads, and that more Russian diplomats should go. That is the old toolkit. The new toolkit is already through the Schengen door. You can close a consulate. You cannot close every cheap coach from Sofia.

For Sofia the file is no longer someone else’s. A partner newsroom, Sega, flagged the Munich arrests this morning. The UK convictions, the Paris sentences and the coffin van already put Bulgarian names in European courts. If Bavaria finds a handler, the question for the Bulgarian state is not whether “our people” are saints. It is whether the Bulgarian counterintelligence DANS and the prosecutor’s office treat recruitment of citizens as a national-security problem or as bad luck that happens abroad.

The article in Bulgarian by EUalive’s partner Sega can be found here.

Caption: A German police car is stationed at the scene of an explosion near the main train station in Augsburg, southern Germany, 2 September 2026. An explosive device detonated near Augsburg Central Station early on 2 September. Two Ukrainian nationals, aged 17 and 18, suffered minor injuries. Bavarian State Police cordoned off the area and launched a large-scale investigation. EPA/ANNA SZILAGYI