Russia’s Federal Security Service (FSB) has detained a Swedish citizen in the Pskov region near the Estonian border on Thursday.

The man is accused of crossing the border illegally, according to a press release published by the FSB. The accused also faces allegations of “organizing activities of a terrorist organization” and “mercenarism”.

The FSB also published videos of the Swedish citizen, in which he confirms his identity and says he is 35 years old. He also states that he signed a contract with the Armed Forces of Ukraine’s Aidar Battalion in order to carry out acts of sabotage in Russia.

The Aidar Battalion and the Ukrainian army have so far not commented on the allegations, but his relatives confirmed to Swedish television that he had visited Ukraine sporadically and fought there.

“The Ministry for Foreign Affairs and the Embassy in Moscow are investigating these reports,” the Swedish Foreign Ministry said in comments.

The Armed Forces of Ukraine did not respond to a request for comment by the time of publication.

In the meantime, the Swedish embassy in Moscow advised its citizens against visiting Russia as “a sharp deterioration in the security situation may limit the Embassy’s ability to provide consular support.”

Earlier this week, the FSB detained a correspondent for Japan’s Hokkaido Shimbun in Sakhalin on suspicion of espionage, accusing him of gathering information about Russia’s defense capabilities.

Japanese Prime Minister Sanae Takaichi rejected Russia’s allegations. “There is no such fact,” she told reporters.

An Israeli surveillance technology firm has run a large-scale operation to infect mobile phones with spyware using online advertisements to hack the devices, researchers said on Thursday.

An investigation by the University of Toronto’s Citizen Lab and cybersecurity firm Confiant Threat Intelligence laid bare an ad-based infection technique developed by an Israeli company that researchers named “AdFection.” The hacks weaponized legitimate online ad systems for espionage purposes, allowing spyware manufacturers to connect to millions of devices and identify, track and target victims.

“Plugging into the online ads ecosystem provides the mercenary spyware industry a stealthy delivery system,” said Bill Marczak, senior researcher at The Citizen Lab. He said the findings were “surely just the tip of the iceberg” of how online ads are abused for espionage.

Researchers discovered critical details of the hacking tools by analyzing devices belonging to journalists and staff at the Al Jazeera media network, finding that 45 devices of journalists and staff were targeted and some infected with Israeli-made spyware known as Candiru.

At the heart of the hacking campaign is the Israeli company Discover-Tech that describes itself as an advertising business. Citizen Lab researchers said the company facilitated surveillance for commercial spyware operators. Its platform, called Controlium, allegedly allowed spyware makers like Candiru — which in 2025 was acquired by Integrity Labs — to identify, track and target devices by loading advertisements on websites and apps.

Discover-Tech and Integrity Labs did not immediately respond to a request for comment.

The scale is striking: An analysis of four billion advertising records found that Discover-Tech’s ads appeared across nearly 200,000 websites and mobile apps in dozens of countries over four months. Among the websites that featured the ads were institutional sites of NATO, the United Nations, the European Parliament, European Commission and Council of the EU.

The technique exploits real-time bidding — the automated system used by platforms such as Google to sell advertising space and target users. Rather than persuading victims to click a malicious link, attackers can exploit advertisements to identify and potentially infect devices without any interaction from the user — a technique known as “zero-click” infections.

Discover-Tech’s advertisements directed millions of devices to servers associated with Candiru, potentially enabling large-scale surveillance and reconnaissance, researchers said. That does not mean all those devices were infected.

Citizen Lab, based in Toronto, is a globally recognized research group that previously uncovered spyware scandals targeting Catalan political figures, a member of the European Parliament and the inner circle of murdered Saudi journalist Jamal Khashoggi.

The findings triggered calls for further investigation on Thursday. “The possibility that EU institutions have been exposed should set off alarm bells across Brussels,” said Hannah Neumann, a German European Parliament lawmaker of the Greens group. Neumann herself was the victim of a cyber-espionage operation by an Iranian hacking group.

“Europe cannot claim to defend democracy while leaving its own democratic institutions vulnerable to spyware,” Neumann said.

BRUSSELS — The European Commission’s cybersecurity division is rolling out a plan to use artificial intelligence to respond to high-risk cyberattacks, according to a document obtained by POLITICO.

The undated document, written by the Commission’s IT department, sets out how to prepare the EU executive’s cyber defenses for “emerging AI-driven threats.” It proposes an action plan to shore up defenses in light of AI, with the most urgent move being the speed of response to attacks.

Governments have rushed to grapple with the rising threat brought by AI’s ability to expose and exploit cybersecurity vulnerabilities. Incidents like OpenAI’s accidental intrusion into Hugging Face have prompted calls, including at the highest political level, to be more wary of advanced AI models.

Being able to respond quickly to cyberattacks is most crucial in “high-risk scenarios,” the EU executive’s internal cyber defenders warned, saying that the ability to detect an attack is “not sufficient if containment measures cannot be taken quickly enough.”

Officials at the in-house IT department, DG DIGIT, are planning to use automated “protective measures” in specific high-risk scenarios, it said. Those scenarios were redacted in the document, which was provided to POLITICO in response to a freedom of information request.

The plan does not amount to “uncontrolled automation” and there will be strict controls in place including human oversight, according to the document.

As well as laying out the response plan, the document sets out the cybersecurity challenges the Commission faces from AI.

The most advanced AI models are expected to “significantly increase the speed, scale and adaptability of cyberattacks” and the Commission must therefore have defenses in places for an environment where “attacks are likely to become faster, more frequent and more scalable,” it said.

Risks include situations where “malicious activity occurs outside EC [European Commission] normal working hours, spreads more rapidly across systems, or results in large-scale exfiltration or operational disruption before manual intervention can be organized by EC,” they said.

The Commission’s cyber division has sought approval internally to move ahead with the plans, it said, though it’s not clear whether the plans have yet been put in place.

The Commission didn’t respond to a request for comment.

August Hanning spent seven years at the top of Germany’s foreign intelligence service, the BND, with access to some of the country’s most closely guarded secrets. Then came a second act: private consulting, corporate intelligence and business stretching across Europe, into Russia and Asia.

Now, the 80-year-old former spymaster is himself at the center of an espionage investigation, after German federal prosecutors arrested him Tuesday on suspicion of treasonous espionage, attempted treason and other espionage offenses. They allege he obtained a stream of secret intelligence from his former chief of staff and used the material to benefit his private consulting business.

“It’s catastrophic for Germany and for Western intelligence services. Everyone is in shock. The scale of it is enormous, especially at a moment like this,” said one EU intelligence official, who — like others in this report — was granted anonymity to discuss a clandestine arena. “And given that investigators stumbled across this while working on an entirely separate case, we’re likely to learn much more.”

For the BND, the case comes at an uncomfortable moment. Just last week, German parliamentarians began debating a new law proposed by Chancellor Friedrich Merz’s government to grant the agency sweeping new authority, as part of an effort to return Berlin’s foreign intelligence service to the top ranks of global espionage. The timing is equally awkward for European intelligence more broadly. With Russian hybrid attacks continuously targeting Europe, governments across the bloc are rewriting decades-old security laws to give their spy agencies greater powers and be taken more seriously.

Prosecutors say Hanning’s former chief of staff, identified under German privacy rules as Manfred D., supplied him with roughly 2,000 BND documents between 2010 and June 2022. Many contained classified information intended exclusively for internal intelligence work, including material used to brief senior German officials.

In comments to German newspaper WELT, a lawyer representing Hanning said some of the allegations against the ex-spymaster were true but that he did not harm Germany.

“He was in possession of confidential documents. Incorrect, however, is the accusation that he had passed on information contained therein to the detriment of the Federal Republic of Germany — let alone [for] payment. Further investigations will show that,” he said.

In one case, prosecutors suspect Hanning used classified material to prepare an analysis for an employee of foreign intelligence service. They also allege he maintained a relationship with a representative of another foreign intelligence service for several years, passing along political information that was partly based on material obtained from Manfred D.

Prosecutors have not publicly identified either foreign service but German media has named Azerbaijan and Kazakhstan. Azerbaijan has denied any connection.

“In intelligence services, everything is logged — who accesses which documents and when. If an analyst working on right-wing extremism suddenly started looking at intelligence on China, that would raise red flags. But the position of chief of staff has access to virtually everything, so it wouldn’t look suspicious because of the seniority of the position,” said a second EU intelligence official.

Chiefs of staff often stay on when directors change, unless they don’t get along with the incoming boss, the official added.

“Every intelligence service will now be looking at what information it shared with the BND and assessing what damage may have been done,” he said.

Revolving door

Hanning led the BND from 1998 to 2005, before serving as state secretary at Germany’s interior ministry until 2009. Once out of government, he wasted little time entering the private sector.

In July 2010, Hanning and his wife established Hanning Consult. It was in the spring of that same year that Manfred D. agreed to provide him with intelligence from inside the BND in exchange for payment, according to the prosecutor’s statement. Hanning then used that information in his private consulting activities, they added.

Roderich Kiesewetter, a Christian Democrat lawmaker on the Foreign Affairs Committee in the German parliament, said that within Germany there is a “very widespread network” of people who use the contacts and knowledge acquired while they were in service to influence Berlin’s policy on behalf of foreign governments like Russia and China.

“It’s not only sad, it’s damaging the reputation of Germany,” Kiesewetter told POLITICO. “You could also say if you want to talk to Russia, take former members of the government or former members of the secret services.”

Hanning also became involved with Samuel Danilowitsch, a German businessman, who led the Swiss corporate intelligence consultancy, Pluteos. There, Hanning eventually became chairman and the two were listed as attending a 2019 Moscow gathering focused on Europe-Russia relations, attended by Russian political and business figures, where the annexation of Crimea was brought up as a “necessity” rather than a choice. Pluteos did not respond to a request for comment.

From around 2014, Hanning joined British consultancy G3 as a senior adviser, according to archived web pages seen by POLITICO. He later oversaw its work involving Russia and the former Soviet republics, according to German media outlet Correctiv. G3 did not respond to a request for comment.

In 2019, Hanning was invited as a “guest of honor” to a gathering organized by Russia’s Security Council of officials and experts from Arctic Council countries. It was chaired by former secretary of the Security Council of Russia, Nikolai Patrushev, one of the most powerful figures in President Vladimir Putin’s security orbit. As part of the cultural program, the group visited the remote Valaam Island monastery where Hanning was pictured next to Patrushev.

Hanning has also publicly ventured into some of the more politically explosive questions surrounding Russia’s war on Ukraine.

In 2024, he told WELT TV that he considered it “very likely” that Ukrainian President Volodymyr Zelenskyy knew about the 2022 operation that destroyed the Nord Stream pipelines. Days later, Hanning went further, suggesting an agreement between senior Ukrainian and Polish figures was behind the attack. Germany has since charged a Ukrainian national it identified only as Serhii K., with his trial due to begin in Hamburg in October.

None of those business relationships, contacts or statements establishes a connection to the espionage case now facing Hanning, though they paint a picture of the influence he continued to amass after leaving the German government. Prosecutors have not accused him of spying for Russia.

The steakhouse heiress

Investigators got onto Hanning’s trail starting with an extraordinary custody dispute involving Christina Block, an heiress to a German steakhouse empire.

Block is accused by the Hamburg Public Prosecutor’s Office of orchestrating the abduction of her two youngest children from their father in Denmark. Prosecutors in that case say Block and two men commissioned an Israeli security team to seize her children, then aged 10 and 13, from their father, Stephan Hensel.

According to the indictment, masked men beat Hensel and took the children across the Danish-German border, to southern Germany. The children were reunited with their father in Denmark four days later, under a court order. Block denies knowing about the abduction.

In September 2025, Hamburg investigators searched Hanning’s home and business premises in connection with the Block case, according to local media. Prosecutors suspected Hanning and a retired police officer had accepted a contract worth more than €100,000 to intercept the children on their way to school in November 2022. The plan ultimately failed as their father noticed suspicious figures and alerted Danish police. 

German broadcaster Taggeschau reported that the investigators, in the search of Hanning’s premises, discovered around 2,000 digital BND documents that ultimately triggered scrutiny of his handling of sensitive government information. Federal prosecutors took over the resulting investigation in May 2026.

Manfred D. had been Hanning’s chief of staff at the intelligence service and subsequently served several of Hanning’s successors, remaining in a senior position until March this year. 

Both men are now in custody.

“He’s reflecting the Germany between 1998 and 2011, so he has not the feeling of having done something evil,” said Kiesewetter. “He was just mirroring [the] state policy of the center-right Christian Democratic and conservative political alliance.”

Hans von der Burchard contributed to this report.