For years, Western intelligence services and security experts have warned about the danger to the Western Balkans and Europe posed by the activities of Russian intelligence services in Serbia, as well as the threat of the country becoming a “springboard” for Russian hybrid operations in the region and the EU. Although the Serbian authorities are apparently cooperating with Western intelligence services to prevent possible incidents, the threat has not disappeared. The latest case involving the exposure of the alleged involvement of Serbian citizens in a planned act of sabotage in Germany demonstrates that the problem has still not been resolved.
Arrests at the Border
At the beginning of June, Serbian police detained two men at the border with Hungary who may have been preparing an act of sabotage in Germany on behalf of the Russian intelligence services. A dangerous explosive device was found in the detainees’ luggage. It is unknown which specific target in Germany may have been the intended target of the sabotage, although there are suspicions that it was a site connected with the production or supply of military equipment for Ukraine.
The prevention of the terrorist attack and the arrest of the suspects became known to the German newspaper BILD, which reported on the matter on 7 July.
According to the journalists, those detained in Serbia are so-called “disposable agents”, that is, individuals recruited by an intelligence service to carry out a single task, usually with very limited knowledge of the operation as a whole.
BILD reported that the operation to detain the agents was carried out on the basis of information provided to the Serbian authorities by partner intelligence services, including the German ones.
As early as mid-June, German Federal Minister of the Interior Alexander Dobrindt stated that the security services had prevented preparations for an attack involving an explosive device against a facility located in Germany. According to him, the authorities were able to thwart the plan by placing under surveillance the individuals involved in preparing the attack. On 19 June, Die Welt reported that the foiled attack had been planned to take place in Bavaria. The security services told the newspaper that Russian intelligence services had been involved in preparing the act of sabotage.
On 10 July, Radio Free Europe (RFE/RL) reported that the Higher Court in Subotica had ordered the detention of two individuals (B.D. and Đ.S.) who had previously been arrested on suspicion of planning an act of sabotage in Germany.
The arrested individuals have been charged with unauthorized production, possession, and trafficking of weapons and explosive materials, as well as forgery of documents.
The suspects are to be remanded in custody until 10 August.
Nothing has been reported about the origin of the detainees, although, as Serbian journalists note, “it would not be surprising if they were Serbian citizens.”
Pig Heads and Paramilitary Camps
The media recall that Russian intelligence services have previously used Serbian citizens as agents, including so-called “disposable agents.”
In September of last year, 11 people were arrested in Smederevo, near Belgrade, on suspicion of engaging in illegal activities in Germany and France. Three of the eleven entered plea agreements, receiving sentences of house arrest ranging from six months to one and a half years. The cases of the remaining eight defendants are still under investigation.
According to the court’s findings, the group carried out several actions directed against Jewish and Muslim religious communities with the aim of increasing tensions in Germany and France. Thus, from April to September 2025, the group splashed green paint on the Holocaust Museum and three synagogues in Paris, left pig heads in front of nine mosques in the city and its surrounding suburbs, and placed plastic skeletons in central Berlin near the Memorial to the Murdered Jews of Europe. As noted in the court findings, the group received its orders, instructions, and funding from the “structures of the intelligence service of the Russian Federation.”
Another example of Serbian citizens being involved in operations carried out by Russian intelligence services was the establishment of a paramilitary training camp near the Serbian city of Loznica for Moldovan and Romanian citizens ahead of last year’s parliamentary elections in Moldova. The purpose of the training, allegedly conducted by Russians, was to teach participants how to efficiently resist Moldovan police on election day. The expectation was that by organizing unrest, it would be possible to prevent the pro-European party from coming to power in Moldova.
In September of last year, several days before the elections, more than 70 people who had allegedly received training in organizing unrest in Serbia were arrested in Moldova. The Moldovan police published a video which, according to their statement, showed paramilitary camps in Serbia “organized by the Russian intelligence service.”
At approximately the same time, two Serbian citizens were arrested in Serbia and charged with organizing the training camp for citizens of Moldova and Romania. According to Serbian media, after being questioned by the Prosecutor’s Office in Šabac, they were released, and the case remains under investigation.
Despite repeated requests to the law enforcement authorities, journalists still do not have sufficient information about the progress of these cases, which concern the participation of Serbian citizens in Russian hybrid operations in Europe.
A Testing Ground for Russian Special Operations
Following the publication of BILD’s article about the detention of two suspected saboteurs at the Hungarian border, Serbian journalists pointed out that, had it not been for this publication, nothing would have been known in Serbia about the arrest of the “Russian agents.” The Ministry of Internal Affairs of Serbia and other state institutions remained silent about the case, issuing not even a brief statement.
On 9 July, the opposition Movement of Free Citizens issued a statement demanding that the Ministry of Internal Affairs, the Security and Intelligence Agency (BIA), and the Government of Serbia provide “an urgent and comprehensive explanation regarding the claim made by the German newspaper BILD that, at the beginning of June, two individuals suspected of acting as Russian ‘disposable agents’ were arrested at the Serbian-Hungarian border, and that explosives intended for possible sabotage in Germany were found in their possession.” “It is unacceptable that the citizens of Serbia learned about an event of this magnitude only a month later from the German media, while the institutions of their own country remained silent,” the authors of the statement emphasized.
The Movement of Free Citizens expressed “particular concern” over “the claim that the operation was carried out on the basis of information provided by partner services, including the German intelligence services.” “The public must know when the suspects were arrested, which Serbian institutions took part in the operation, whether the Prosecutor’s Office was informed, on what legal grounds the proceedings are being conducted, whether the suspects remain in custody, and who decided not to disclose even the most basic information about the case. The details of an ongoing investigation may be confidential, but secrecy cannot serve as an excuse for political and institutional irresponsibility,” the organization stressed.
“If the country’s leadership knew for weeks that individuals suspected of ties to the Russian intelligence services and of preparing acts of sabotage within the European Union had been detained in Serbia, then Aleksandar Vučić, who chairs the National Security Council, must personally explain why the public was not informed. This is not merely a matter of a single arrest, but the consequence of long-standing political, security, and propaganda ties between the Vučić regime and the regime of Vladimir Putin, which have turned Serbia into a suitable territory for the activities of Russian intelligence structures in the region and across Europe,” the statement says.
The statement further emphasizes that “this is precisely why the Movement of Free Citizens launched an initiative to abolish the so-called Serbian-Russian Humanitarian Center in Niš” (which in the West has a reputation as a “spies’ nest”). “Serbia must not create an institutional foundation for opaque structures while serious doubts remain regarding the scale of Russian intelligence and hybrid activities in our country. The latest allegations only further demonstrate how dangerous the policy that ties Serbia to the Putin regime is,” the organization stressed, adding that “such a policy already carries a price.”
“The closeness of the regimes in Belgrade and Moscow, the cooperation between our services and Russian structures, and the refusal to fully align Serbia’s policy with the European Union’s foreign and security policy have contributed to Serbia’s growing isolation. The messages the government has received from Strasbourg and Brussels through the European Parliament Resolution and the failure to open Cluster 3 cannot be separated from the long-standing policy of balancing, under which Vučić speaks of integration before Europe while simultaneously maintaining close ties with Vladimir Putin’s regime,” the statement concludes.
According to the Movement of Free Citizens, “Serbia must make a clear choice in favor of the European path,” which “requires full alignment of its foreign and security policy with that of the European Union, including the introduction of sanctions against the Russian Federation, a determined fight against foreign malign influence, and full cooperation with European security partners.” As the authors of the statement emphasized, “the citizens of Serbia deserve a state that protects their interests, not a state that, through its silence, leaves room for doubts that it has become a testing ground for someone else’s geopolitical operations.”
Conclusions
The latest reports concerning the detention in Serbia of individuals suspected of preparing an act of sabotage in Germany confirm that Russian hybrid activity in the Western Balkans remains a serious security challenge not only for Serbia itself and the region, but also for Europe as a whole. At the same time, the lack of transparency on the part of the Serbian authorities raises renewed questions both about the effectiveness of the country’s state institutions and about the nature of the security relationship between Belgrade and Moscow.
Although it is well known that Serbia categorically refuses to impose sanctions against the Russian Federation, acting contrary to the European Union’s foreign and security policy and to the obligations expected of candidate countries, it cannot be ruled out that the “special relationship” between the Serbian and Russian intelligence services is driven not so much by geopolitical considerations as by domestic political ones. In recent years, the Serbian authorities have demonstrated an interest in maintaining close relations with the Russian intelligence services, primarily in order to counter what they describe as a “colour revolution.” The clearest example is the report issued by the Federal Security Service (FSB), which the Serbian leadership has relied upon to deny allegations that a sonic weapon was used against demonstrators. This atmosphere of cooperation and trust at the highest level creates conditions in which the Russian intelligence services can operate in Serbia with a considerable degree of comfort and act accordingly.
CWBS Analytical Group
