Munich: firebombs at a defence firm, arrests on a witness call
Incendiary devices were thrown from a moving car at a construction site at the Rohde & Schwarz headquarters in Munich around midnight on the night of 2 to 3 September. One ignited and was put out by the first officers to arrive; another failed to function and was made safe by explosives specialists. Two Bulgarian nationals were detained at a petrol station within minutes. Damage was minimal and nobody was hurt.
The Bavarian State Criminal Police Office and the Munich prosecutor's office have taken the case on the assumption of a political background. The attack was seen, reported and stopped by a member of the public. That is the fourth time in recent Scorpius reporting that the effective detection capability against this kind of act was an ordinary person who happened to be looking.
↓ Download one-page brief (PDF)Around midnight - devices thrown from a moving car
Incendiary devices are thrown from a vehicle at the construction site at the Rohde & Schwarz headquarters in Berg am Laim. The car does not stop.
A witness sees it and calls the police
Eyewitnesses who saw the devices thrown from the vehicle telephone the police. That call starts the search that produces both detentions.
One device burns, one does not
A fire takes hold near construction containers and is put out by the first officers to arrive. At least one further device fails to function and is later made safe by explosives specialists of the Bavarian State Criminal Police Office.
Two detained at a petrol station
A 38-year-old man and a 28-year-old woman, both Bulgarian nationals, are stopped at a petrol station nearby during the immediate response. Neither comments on the allegations.
The case goes to the LKA and the prosecutors
The Bavarian State Criminal Police Office and the Munich prosecutor's office take the investigation on the assumption of a political background. Investigators say they are coordinating closely with other German and European security authorities to establish who the two detained people are.
Leipzig/Halle Airport
An explosive-laden drone was found at an air-cargo hub used by Ukrainian Antonov operations and NATO-relevant freight. The German government formally attributed it to Russia on 1 September. Reported by Scorpius.
Turnow-Preilack substation, Brandenburg
Improvised devices at an electricity substation, conductive material laid into high-voltage lines, one generating block tripped. Unattributed, with both foreign and domestic left-extremist lines open. Reported by Scorpius.
Bergheim substation, North Rhine-Westphalia
A second substation attacked the same evening, about 3,000 megawatts of generation off the grid. Essen police called it a deliberate criminal act. Unattributed. Reported by Scorpius.
Munich
Incendiary devices at a defence manufacturer. Two detained. Political background assumed, attribution open.
One of these four has a state attribution behind it and three do not. They are different methods against different target classes investigated by different authorities, and no authority has connected any of them to any other. What they share is a month and a country. That is enough to describe the environment a German site is operating in and not enough to describe a campaign, and the distinction matters because one of those two statements can be retracted and the other cannot.
The detection capability was a passer-by, for the fourth time
Somebody saw devices thrown from a car and rang the police, and that call produced two detentions inside the hour. Set against Tulcea, where radar never saw the drone and a resident reported it, Neptun Deep, where a merchant ship spotted the approach, and the Romanian field where a resident found a live device, this is a pattern in the reporting rather than a run of coincidences. Across four separate incidents in different countries, the thing that worked was a person who was looking.
A deliberate attack, and the rest is open
Devices thrown from a moving car at a defence manufacturer, an LKA takeover on the assumption of a political background, and two detentions. It is almost certain this was a deliberate attack on a defence-industrial target. Beyond that nothing is established: no charge, no claim, no named state, and no stated motive.
Whether this is the recruited-proxy pattern is the open question, and it is being asked
Two foreign nationals detained at the scene of an attack on a defence firm fits the model seen at Skarzysko-Kamienna and in the foiled Slovak plot, and investigators saying they are coordinating with other German and European security authorities to establish who the two are is the sound of that question being asked. It is a realistic possibility that the two were recruited proxies acting on foreign direction. That band is deliberately lower than the one this report would carry in Poland, because in Poland prosecutors opened the case under the article covering assistance to a foreign intelligence service, and here they have said only that the background is political - which in Germany also covers a domestic left-extremist arson precedent that is live and recent.
The method is cheap, unreliable, and chosen for that
Devices thrown from a passing car at a construction site, at least one of which did not work, against a perimeter rather than a plant. It requires no access, no skill and no reconnaissance worth the name. An operation designed to be deniable is also designed to be survivable when it fails, and the low quality of the attempt is evidence about the model rather than about the seriousness of the intent behind it.
Where this goes
It is likely that further attempts of this kind are made against European defence manufacturers, because the method costs almost nothing and a failure imposes disproportionate cost on the defender. It is a realistic possibility that the two detained are charged under provisions relating to a foreign intelligence service, which is the point at which this report would need updating. Whether German authorities ever name a state for this particular attack is a separate question and unlikely to be answered quickly.
Set this beside Skarzysko-Kamienna on 31 August, where a masked man went over a fence with an incendiary charge at a drone plant and was disturbed by a worker. Same target class, same method family, same week, two countries. In Poland the case was opened as assistance to a foreign intelligence service; in Germany it has been opened as a political background. The difference in the charging framework is the clearest available signal of how far each investigation has actually got, and it should be read before the similarity of the two events is.
- The person who calls is your detection system. This attack was seen, reported and interrupted by a member of the public. Make sure the neighbours, the delivery drivers and the night staff around your site know what number to ring and that ringing it is wanted.
- Look at the perimeter from a moving vehicle. The devices were thrown from a car at a construction area, not carried in. Drive your own boundary at midnight and ask what could be thrown from the road and what it would land on.
- Treat a construction site as part of the estate. Building works put combustible material, containers and a weakened perimeter at the address for months. The protective posture of a site under construction is rarely the one its security plan describes.
- A failed attack still changes your risk picture. Nothing of consequence burned here. The address is now one that somebody was prepared to attack, and that is the fact to plan against rather than the damage figure.
- Read the charging framework, not the coincidence. Poland charged a foreign intelligence article for a similar attack; Germany has said political background. Those are different distances travelled, and briefing them as the same overstates what is known.
- Expect the response cost to exceed the attack cost every time. Two people with cheap devices produced an LKA investigation, a prosecutor's file and European liaison. Resourcing for this threat means resourcing the response to attempts, most of which will fail.
- https://www.euronews.com/my-europe/2026/09/03/two-arrested-after-attack-on-defence-companies-in-munich
- https://www.20min.ch/story/muenchen-de-brandanschlaege-auf-ruestungsfirmen-politisches-motiv-vermutet-103627097
- https://www.watson.ch/international/deutschland/895656100-anschlag-auf-konzern-in-muenchen-zwei-bulgaren-unter-verdacht
- https://www.abc.net.au/news/2026-09-04/sabotage-germany-defence-manufacturer/107114408
Compiled from open-source reporting for professional security discussion. This is a protective-security lessons-learned assessment, not an operational account. Two people have been detained and neither has been charged; both are entitled to a fair trial and nothing here should be read as a finding against either. No claim of responsibility has been made and no state or group has been named by any authority for this incident. The intended target has not been officially confirmed: the Bavarian State Criminal Police Office has said it remains subject to the investigation, 20 Minuten reports several defence firms in the same complex, and Euronews names the drone maker Helsing alongside Rohde & Schwarz. Accounts differ on the number of devices, two or three, and both figures are given rather than reconciled. The Berg am Laim district is as reported by 20 Minuten; the marker on the map is placed at Munich city, not at the district or the site. The judgement that the two detained may have been recruited proxies is Scorpius's and is not a German finding.