Russian Hybrid Operations and the Threat of Extremist Convergence in Germany

Russia appears to be returning to active subversive operations in Germany after a period of concentrating on influence campaigns and psychological operations. We are convinced that the Kremlin is seriously considering a plan to overthrow the constitutional order in the country, as well as to undermine Germany’s territorial integrity by bringing the eastern lands—once part of the so-called GDR—back under Moscow’s control.

Germany’s Federal Prosecutor has charged eight members of the extremist group “Saxon Separatists,” which was dismantled in November 2024. According to investigators, the group had been preparing to seize part of eastern Germany by force and establish a state founded on Nazi ideology.

Prosecutors stated that members of the group were convinced of the imminent collapse of the German state and intended to use “Day X” to seize power in Saxony. They face charges of creating and belonging to a terrorist organization, as well as preparing acts of treason.

According to the investigation, the militants conducted firearms training and paramilitary exercises, practicing shootouts in urban conditions, night maneuvers, and forced marches. During searches, authorities found knives, machetes, ammunition, helmets, camouflage, and other gear.

The Saxon Separatists (also called Sächsische Separatisten, “Saxony Separatists

are a far-right extremist / neo-Nazi paramilitary-style group in the German state of Saxony. They were founded around November 2020.
Their leadership includes a figure known as Jörg S.

Their ideology is rooted in neo-Nazism, white supremacism, and racism. They also hold apocalyptic or conspiratorial beliefs about a future collapse of the state.
They believe in a coming “Day X” — a scenario where the current political order collapses — after which they imagine establishing control over parts of Saxony (and potentially eastern Germany more broadly) under a nationalist / racialist regime
Part of their worldview includes “undesirable” or “unwanted” groups (ethnic, religious, migrant) being removed from territory, i.e. there are concrete plans for exclusion or even ethnic cleansing.

The group was under investigation by German authorities and classified as a domestic terrorist organizationunder German law (Section 129a).
Police arrested eight suspects in a coordinated operation involving ~450 officers, with searches of ~20 properties. Some arrests were in Saxony, others in Poland. Jörg S. was arrested in Poland.
Some of the arrested individuals have links with the far-right Alternative for Germany (AfD), in particular its youth wing (Junge Alternative) and local party positions. For example, Kurt Hättasch, an AfD councilor in Grimma, is named as one of the suspects

We are convinced that the organization, through its party structures, maintained ties with Russia’s military intelligence. Its activities correspond to the indicators typically associated with Russia’s hybrid operations.

The Saxon Separatists show how domestic extremist groups are moving from fringe rhetoric to paramilitary planning. Their preparation (gear, training, ideology) suggests potential for violence beyond mere protest or political agitation. The concept of anticipating state collapse (or exploiting a crisis as pretext) is common among far-right extremist groups elsewhere. In many international security reviews, such narratives are flagged as early warning indicators. The implied or actual connections of some members to established or semi-established political parties (AfD in this case) complicate detection and response. Even if a party doesn’t formally endorse extremist acts, having individuals who cross between extremist/sleeping cell activity and legitimate political structures makes the threat more diffuse and harder to disrupt early. The arrests demonstrate state capacity to detect and act against extremist paramilitary plotting. They also likely increase the scrutiny of far-right parties, youth organizations, and radical networks. Could lead to stricter oversight, intelligence-sharing, possibly preventive legislation. For states concerned about internal destabilization (through similar groups), this case offers useful parallels:

Weapon caches, training, and paramilitary readiness are key indicators.
Propaganda framing (e.g. future collapse, threat narratives) often precedes mobilization.
Hybrid political-extremist cells can draw from political legitimacy while planning illegal operations.

The German Federal Prosecutor’s Office (Generalbundesanwalt) indictment of the Sächsische Separatisten(Saxon Separatists) does not mention any direct operational or financial links to Russia. The charges focus on domestic terrorism, neo-Nazi ideology, weapons training, and “Day X” planning inside Germany web sources above.
The November 2024 arrests (including leader Jörg S. in Poland) showed the group had access to military-style gear and training, but no confirmed evidence of Russian funding, arms supplies, or coordination was presented by authorities.

The group’s rhetoric—about sovereignty, “Day X,” and anti-system rebellion—mirrors narratives Russia has amplified in Europe through propaganda: fear of state collapse, delegitimization of Western democracy, glorification of “self-defense groups.”
Russian media and disinformation channels often signal-boost far-right discontent in Germany, including AfD talking points, migration fears, and separatist sentiment in eastern Germany.

Russia has a track record of courting European far-right movements (AfD in Germany, Jobbik in Hungary, Lega in Italy, RN in France) through media, loans, or soft-power events.
Some AfD members have taken trips to occupied Crimea or Moscow, giving Moscow opportunities to build informal networks.
Because some Saxon Separatist suspects had ties to AfD youth structures, there’s an indirect channel where Russian influence could intersect, even if not yet proven.

The group stockpiled equipment and trained for urban warfare. While this resembles Russian-backed separatists in Donbas (2014), there is no evidence these caches came from Russian sources. Most appear to have been procured domestically or via private networks.
Geographic Sensitivity: Saxony borders Poland and the Czech Republic. Security services fear it could serve as a hub for Russian intelligence “gray activity”, but again, no direct tie to this group has been proven.

As of late 2024, the Saxon Separatists are treated as a homegrown German extremist/terrorist organization, not a Russian proxy. However, the facts suggest that the separatists may represent the militant wing of a political structure that receives financial and organizational support from Russia.
No hard evidence of Russian direction, funding, or logistics has been presented.
However, Russia benefits indirectly: the group’s actions destabilize German politics, reinforce narratives of state fragility, and overlap with Kremlin propaganda themes.

Vector: Amplify grievances (“Day X”, anti-state, anti-migrant), launder narratives via fringe portals, fake videos, sock-puppet pages, or Russian-aligned outlets.
Indicators: Coordinated narratives across Telegram/X; reused memes/accounts from prior operations; local stories suddenly boosted by RU-aligned ecosystems; references to “civil war/occupation/ethnic cleansing” frames.
Why it matters: Low-cost pathway to radicalize and recruit, normalize paramilitary talk, and create permission structures for violence

Vector: Parasocial ties with far-right milieus (events, “observer” trips, conferences), informal introductions via sympathetic politicians/activists; reputational cover from overlaps with party youth structures.
Indicators: Travel to Russia/occupied territories; “delegations” to Crimea/Donbas; photo-ops with RU officials or proxies; messaging convergence with RU state media.
Why it matters: Creates soft-contact networks that can evolve into tasking, funding, or at least message discipline. (Context: German authorities have separately scrutinized AfD figures over Russia links, though not as proof of direction of the Saxon Separatists case.)

3) Covert Funding & Logistics

Vector: Small-denomination transfers via cut-outs/NGOs/crypto; “donations” for media or gear; procurement help (comms, optics, protection gear).
Indicators: Unexplained cash/crypto inflows; imports of dual-use kit; identical equipment batches across cells; donors tied to RU-linked orgs.
Why it matters: Even modest funding can scale training, mobility, and operational security. (No public evidence of RU funding the Saxon Separatists; German prosecutors charge them as a domestic terrorist org.)

4) Tradecraft & Training (Operational Enablement)

Vector: Instruction (OPSEC, surveillance detection, IED basics) via online RU-language manuals or intermediaries with RU training lineage; contact with foreign “veterans.”
Indicators: Shared TTPs with RU proxy groups; mirrored SOPs (cell structures, caches); travel patterns aligning with known training hubs.
Why it matters: Raises a fringe group’s ceiling from mere posturing to credible violent capability. (German case evidence shows paramilitary-style training, but no confirmed RU pipeline.)

5) Cyber-Enablement

Vector: RU-linked hack-and-leak to inflame local crises; doxxing of officials/journalists; bot amplification to mask small numbers.
Indicators: Leaks timed to protests; identical botnets pushing calls to action; overlaps with RU TTP clusters documented around elections.
Why it matters: Cyber actions can catalyze street mobilization and intimidate adversaries with deniability.

6) Crisis Exploitation & False Flags

Vector: During external shocks (elections, migration spikes, energy/infrastructure incidents), attempt to provoke clashes or stage “defensive” actions.
Indicators: Sudden calls for “self-defense patrols”; synchronized disinfo tying migrants/authorities to conspiracies; attempts to infiltrate protests with violence-minded cadres.
Why it matters: Converts information ops into real-world escalation at opportune moments. (EU and Nordic cases document RU/Belarus use of migration pressure in Procurement & Caching

Vector: Assistance sourcing weapons/explosives or facilitating domestic diversion; advising on caches to enable “Day X.”
Indicators: Common serials/supply routes; cross-border smuggling signatures; shared stash layouts/triggering kits.
Why it matters: Caches transform online extremism into kinetic potential. (German arrests found gear and training; public filings do not allege RU-supplied weapons

German Federal Prosecutor (Nov 5, 2024): Eight suspects from the Saxon Separatists arrested; ~20 locations searched; leader detained in Poland; charges under §129a (terror org). The communiqué does not allege Russian tasking or funding.

Wider environment: Documented RU disinformation targeting Germany’s elections; EU/EEAS reports on foreign information manipulation; analyses of RU hybrid tactics (including weaponised migration) across the EU’s north/east

In our assessment, there may be a link between the Saxon Separatists and the Reichsbürger movement. Such conclusions follow from an analysis of the groups’ ideology and modus operandi.

Reichsbürger (“Citizens of the Reich”) reject the legitimacy of the modern German state, claiming the Deutsches Reich still exists.
The Saxon Separatists envisioned a “Day X” collapse of the German order, after which they would take control in Saxony under neo-Nazi/ethno-nationalist rule.
Both share:
- Anti-state, anti-constitution stance.
- Apocalyptic framing of regime change.
- Conspiratorial, anti-elite, anti-migrant beliefs.
This makes ideological cross-pollination highly likely. German domestic intelligence (BfV) already warns of fluid membership between far-right subcultures, where people can circulate between Reichsbürger, prepper groups, and neo-Nazi cells.

Reichsbürger cells were behind a foiled coup plot in December 2022 (Heinrich XIII “Prince Reuss” case) — arrests showed they sought weapons, military infiltration, and foreign contacts. The Saxon Separatists (2024 arrests) also stockpiled gear, trained in urban combat, and sought to prepare for armed revolt. Both groups moved beyond rhetoric into paramilitary preparation.Some individual suspects in both milieus had AfD affiliations, particularly in Saxony and Thuringia. Both drew on prepping networks and weapons collectors. Shared “Day X” culture: belief in collapse + need to arm and train.

Analysts describe these as overlapping ecosystems rather than formally linked hierarchies.

Reichsbürger conspiracies have been amplified on Russian disinformation channels, particularly the idea that Germany is an “occupied” U.S. colony. Saxon Separatists likewise push anti-state, NATO-hostile lines that Moscow benefits from.This creates functional convergence: both movements are useful to Moscow, even if no direct command/control exists.

Security services see Reichsbürger and Saxon Separatists as part of a continuum of extremist actors with potential for cross-fertilization.

The risk: individuals drifting between groups, bringing skills, weapons, or contacts — making cells harder to map.
Strategically:
- Reichsbürger aim to delegitimize Germany nationally.
- Saxon Separatists aimed at a regional secessionist, Nazi-style enclave.
- Both weaken federal authority and erode public trust — aligning with Russia’s interest in destabilizing Germany.

Bottom line:

There’s no formal structural link proven between the Saxon Separatists and Reichsbürger.
However, both organizations share ideological DNA, tactics, and milieus, with porous boundaries between members. Both are potentially exploitable by Russia as destabilizing instruments inside Germany.