German federal prosecutors opened an investigation after security services discovered two handguns and ammunition in a professionally built hiding spot on the outskirts of Berlin, a cache the country's interior minister says was "certainly intended for carrying out planned attacks."
The weapons were found in November 2025 inside a warehouse tucked into a wooded area near the Berlin-Brandenburg state border, after police acted on a tip-off. What followed was a quiet, months-long counterintelligence operation: German security services sabotaged the handguns, or swapped them for duds, replaced the cache so it appeared untouched, hid a GPS tracker inside, and put the building under surveillance. Breitbart reported that no one returned to the site for months, and investigators now believe the suspect or the intelligence service behind the drop noticed the police operation and abandoned the location.
Germany's Federal Prosecutors Office is investigating a suspect currently in custody in Romania. That individual may be one of two Ukrainian citizens from a Russian-occupied part of Ukraine who were detained in connection with the sabotage of Ukrainian-owned businesses inside the European Union, acts allegedly carried out at the direction of Russian intelligence. The specific Russian agency involved has not been publicly identified.
Federal Interior Minister Alexander Dobrindt addressed the discovery publicly on Friday, offering the German government's clearest assessment yet. He did not name Russia directly, but his language left little ambiguity about who Berlin suspects.
Dobrindt told reporters:
"These weapons and the ammunition that have been found were certainly intended for carrying out planned attacks... This case demonstrates that we are operating under the assumption of a high threat level."
German intelligence reportedly considers assassination the most likely intended use for the handgun cache. That assessment fits a pattern. The head of Rheinmetall, Germany's largest armaments company, was the target of an earlier plot that authorities detected before it could be carried out. He is now described as the best-protected figure in Germany's private sector. And just this week, Euractiv reported that the CEO of a German defense startup supplying Ukraine with drones has been living in hiding under police protection for months because of a separate Russian intelligence plot against him.
Neither executive's name has been made public in connection with the Berlin cache investigation.
The Berlin discovery is not an isolated find. In 2024, buried hand grenades and explosives turned up in another German state, details of that case remain limited, but the discovery added to a growing body of evidence that foreign operatives have been pre-positioning weapons on European soil. In November 2025, Austrian authorities seized a firearms cache in Vienna believed to have been hidden by Hamas for use by a terrorist cell.
The pattern echoes Cold War-era Soviet tactics. During that period, Moscow reportedly hid explosives across Western Europe for use by saboteur cells in the event of a conflict with NATO. Britain's MI5 took the threat seriously enough to maintain lists of suspected domestic saboteurs, left-wing extremists and others who might mobilize during a transition to war, with plans to detain roughly 3,000 individuals in requisitioned holiday camps in Wales and the Isle of Man. Those plans, drawn from declassified documents, reflected a recognition that hostile foreign powers would use proxy networks to strike from within.
The parallel is hard to miss. Russia's alleged use of Ukrainian citizens from occupied territory to carry out sabotage and potentially stage attacks inside EU nations follows the same operational logic: recruit assets with plausible cover, position weapons in advance, and maintain deniability through cutouts.
Germany's weapons cache investigation comes at a moment when the broader Western security environment is under strain. Diplomatic negotiations between the United States and Iran over Tehran's nuclear ambitions remain unresolved. Fox News reported that Iran submitted a second nuclear proposal through Pakistani mediators, but President Trump expressed dissatisfaction because the offer failed to adequately address Iran's nuclear program. Secretary of State Marco Rubio, in a separate interview, warned that Iran's negotiators are skilled at buying time.
"We have to ensure that any deal that is made, any agreement that is made, is one that definitively prevents them from sprinting towards a nuclear weapon at any point."
Rubio added bluntly that he has "no doubt" Iran's clerical regime will eventually pursue a nuclear weapon if it remains in power. The administration's posture, skeptical of adversaries' stated intentions and insistent on verification, stands in contrast to the European approach, where Germany and its neighbors are still catching up to the reality that hostile intelligence operations are already running on their soil.
The German investigation leaves significant gaps. Prosecutors have not disclosed the suspect's identity or the specific charges, if any, that have been filed. It remains unclear whether extradition proceedings are underway to bring the Romania detainee to Germany. The nature of the original tip-off, whether it came from a human source, signals intelligence, or another method, has not been revealed. And the specific Russian intelligence agency suspected of orchestrating the cache has not been named.
Equally unclear is what the "conspicuous police operation" at the warehouse looked like, the activity that investigators believe tipped off the cache's intended users and caused them to stay away. If German authorities inadvertently burned their own surveillance, that raises its own set of uncomfortable questions about operational discipline.
What is clear is the scale of the problem. Two handguns in a wooded warehouse near Berlin may sound modest. But paired with the Rheinmetall assassination plot, the defense CEO in hiding, the Vienna Hamas cache, and the buried grenades found elsewhere in Germany, the picture is one of a continent where hostile actors are staging assets for violence, and where European governments are only now beginning to treat the threat with the seriousness it demands.
Cold War planners understood that an adversary's sabotage network had to be dismantled before it could be activated. The question for Berlin, and for every NATO capital, is whether today's leaders have the same clarity, or whether they will keep discovering caches after the fact and calling press conferences about threat levels they failed to prevent.
