German federal prosecutors are investigating a concealed weapons cache discovered in a forest near Berlin after authorities said the firearms and ammunition were likely intended for future attacks.
Interior Minister Alexander Dobrindt said the case is being investigated on suspicion of intelligence activity and preparation of a serious offence threatening state security. A suspect linked to the case is currently being held in Romania.
The authorities are also examining whether a foreign intelligence service may have been involved.
Dobrindt said the participation of “foreign powers” could not be ruled out, but he did not publicly identify Russia as responsible. The intended target of any possible attack also remains unknown.
Weapons hidden in a forest near Berlin
Germany’s domestic intelligence service and Berlin’s state criminal police located the cache in October 2025.
According to Dobrindt, it contained two handguns and ammunition.
The weapons were either replaced or rendered unusable so that they no longer posed an immediate threat. Authorities then kept the hiding place under surveillance in an attempt to identify anyone who came to collect them.
No one did.
German security officials nevertheless believe the weapons had been placed there for use in an attack.
“These weapons that were found, including the ammunition, were certainly intended for attack planning,” Dobrindt said.
Federal prosecutors have now taken over the case.
The investigation concerns suspected intelligence activity and the preparation of a serious state-endangering offence, while authorities continue to examine the role of the suspect being held in Romania and the wider network that may have been connected to the cache.
Investigators examine a possible foreign intelligence link
The case has drawn particular attention because German security services have repeatedly warned of espionage, sabotage and other forms of hybrid activity by foreign states.
Dobrindt said involvement by a foreign power could not be excluded.
German media reporting has gone further.
According to research by NDR, WDR and Süddeutsche Zeitung cited by ZDF, Germany’s domestic intelligence service has indications that the cache may have been created on behalf of Russian intelligence services and intended for operatives carrying out so-called kinetic operations in Germany.
The Guardian has also reported that investigators believe the weapons cache may have links to Russia.
Those reports have not yet been matched by a formal public attribution from the German government.
Dobrindt deliberately stopped short of naming Russia, saying the continuing investigation would have to establish whether a foreign state was involved.
Germany warns of a broader hybrid threat
The interior minister said the Berlin-area weapons cache should not be viewed as an isolated case.
Germany has investigated a growing number of so-called low-level agents — people allegedly recruited to carry out limited acts of surveillance, sabotage or other covert tasks rather than operating as professional intelligence officers.
Dobrindt said there had been multiple arrests in Germany connected to such activity and described the country as facing a “high threat level.”
The weapons discovery comes amid heightened concern over a series of suspected sabotage incidents and plots across Europe.
German security services have recently dealt with the discovery of a drone carrying explosives at Leipzig/Halle airport. According to ZDF, the device failed to detonate because its fuse malfunctioned. Ukrainian cargo aircraft were nearby at the time.
The Guardian has separately reported on European investigations into alleged Russian plots targeting defence-industry figures and logistics networks supporting Ukraine.
Those cases remain separate from the weapons-cache investigation and do not by themselves prove Russian responsibility for the cache near Berlin.
They do, however, explain why German authorities are treating the discovery as a potential national-security case rather than an ordinary firearms offence.
Security policy is shifting in response
The case has emerged as Germany moves to strengthen its response to espionage, sabotage and other hybrid threats.
Authorities have expanded coordination between the federal police, domestic intelligence service and the BND, Germany’s foreign intelligence agency, as Berlin seeks to improve its ability to respond to hostile activity below the threshold of conventional military conflict.
Dobrindt has argued that Germany must be better equipped to confront covert operations by foreign states.
The growing focus on sabotage and intelligence threats marks a significant shift in Germany’s security debate, particularly as officials warn that hostile actors increasingly rely on intermediaries, criminal networks and expendable recruits rather than traditional intelligence officers.
What is known — and what remains unproven
Several elements of the case have now been confirmed.
A cache containing two handguns and ammunition was discovered near Berlin in October 2025.
German security authorities believe the weapons were intended for use in attack planning.
A suspect is being held in Romania.
The Federal Prosecutor’s Office is investigating suspected intelligence activity and preparation of a serious state-endangering offence.
What remains unclear is equally important.
Authorities have not disclosed the intended target of any planned attack.
They have not publicly identified the foreign state, if any, behind the suspected operation.
And although German media reports point to possible Russian intelligence involvement, Berlin has not formally attributed this specific weapons cache to Moscow.
For now, the case remains an active investigation into suspected attack preparations and possible foreign intelligence activity.
But its significance extends beyond the two handguns found in a forest outside Berlin.
The investigation comes at a time when Germany increasingly views espionage, sabotage and covert violence as part of a broader European security challenge — one in which the boundary between intelligence operations and direct physical attacks is becoming harder to define.
Sources: ZDF; Associated Press; reporting by NDR, WDR and Süddeutsche Zeitung cited by ZDF; The Guardian.
