Anschlag Russian espionage plot

In 2011, German authorities uncovered a Russian espionage network that had been operating in Europe for over two decades. The case drew renewed international attention in 2025 when reports resurfaced that the spies had used, among other things, YouTube videos of Cristiano Ronaldo as a medium to send coded messages to Moscow. A married couple, using the false identities Andreas and Heidrun Anschlag, acted as Russian agents based in Marburg under Austrian passports, which were later found to be falsified. The couple spied for Soviet and later Russian intelligence, gathering classified information from agencies including NATO, the European Union, and the United Nations.

Events

Andreas and Heidrun Anschlag lived in Marburg, a town near Frankfurt, Germany, and used fraudulent Austrian passports while presenting themselves as South American nationals. Andreas worked as an engineer for an automotive company, and Heidrun managed the household and their daughter, who was unaware of their true identities and activities. Journalist Mika Beuster, who reported on the case, said that the couple blended well into the community, except for one peculiar habit: "They would make long phone calls in the garden, even in the middle of winter".

Andreas and Heidrun Anschlag were recruited in 1989 as deep-cover operatives before the fall of the Berlin Wall. Over the next 23 years, they supplied thousands of classified documents to Soviet and then Russian intelligence services. In return for their work, they were paid approximately €90,000 annually. The network relied heavily on information provided by Raymond Poeteray, a mole inside the Dutch Foreign Ministry, who had access to NATO secrets. The official transferred classified documents to the couple using dead drops, placing USB drives at pre-arranged locations. These were collected by the Anschlags and passed to Russian handlers.

For much of their career, the couple used traditional spycraft, including radio transmissions and satellite links, to maintain contact with Moscow. As new technologies emerged, they transitioned to online platforms, which provided more discreet channels. The Anschlags registered a YouTube account with the username @Alpenkuh1 on 8 May 2011, while a Kremlin linked account was established under the name @Cristianofootballer one month prior. Using these accounts, the spies and their handlers communicated via comments posted on videos featuring Real Madrid footballer Cristiano Ronaldo. According to intelligence reports and detailed accounts in Gordon Corera's book Russians Among Us, the comments appeared innocuous to the casual viewer but contained encrypted content. Messages and replies such as "It is a very nice video and the song is also very good" or "He runs and plays like the devil" were constructed with predetermined punctuation patterns, which could then be decoded into sequences of numbers that refer to secret instructions and messages. Investigators concluded that this technique was a digital evolution of Cold War-era numbers stations.

German intelligence monitored the Anschlags for months before launching a raid on 18 October 2011. In the operation, Heidrun was intercepted while receiving a coded radio transmission in their study. In July 2013, Andreas was sentenced to six and a half years in prison, and Heidrun to five and a half years, by a German court. Poeteray received a twelve-year prison sentence. In late 2014, Heidrun was released early from prison and deported to Russia after a bail payment of €500,000, speculated to have been paid for by the Russian government or part of a discreet prisoner exchange. Andreas Anschlag was deported to Russia in 2015.

See also

• Illegals Program
• Cold War espionage
• Germany–Russia relations
• Russian espionage in Germany