Key Judgments
- [CONFIRMED] – On September 8, 2026, Germany’s Federal Prosecutor General (Generalbundesanwalt) filed a 214-page indictment with the State Security Senate of the Berlin Kammergericht against seven men – two German nationals, a Danish national, a Bulgarian national, and several Lebanon-born defendants – for planning coordinated attacks on Israeli, Jewish, and pro-Israeli targets in Berlin and Vienna, timed to the second anniversary of the October 7, 2023 Hamas attack on Israel.
- [CONFIRMED] – The indictment describes an operational coordination base in Turkey used to build and train military cells across Europe, directing recruitment and operations remotely toward the ultimate target set. This represents the clearest documented case this dossier has reviewed of Hamas operating an external-operations command structure specifically oriented toward the European theater, rather than ad hoc cell activity coordinated loosely from Gaza or Lebanon.
- [CONFIRMED] – Investigators trace a documented weapons and logistics chain moving 13 pistols, one AK-47-pattern assault rifle, and more than 900 rounds of ammunition through Denmark, Germany, and Austria between mid-2025 and the network’s disruption, alongside explosive devices recovered from a Vienna storage cache and a pre-recorded video, filmed August 7, 2025, in which a network member claimed responsibility for the planned attack in advance in the name of the Qassam Brigades.
- [CONFIRMED] – Per a July 2026 investigation by the Swiss newspaper Neue Zürcher Zeitung, Hamas is assessed to have established sleeper-cell infrastructure specifically in Germany, Denmark, the United Kingdom, Greece, and Cyprus – a five-country footprint distinct from, and broader than, the two cities (Berlin and Vienna) named as the network’s immediate operational targets.
- [ASSESSED] – One of the seven indicted defendants, a Bulgarian national identified as Mohammad S., is reported by the German newspaper WELT to have served as a confidential source (Vertrauensperson) for Germany’s domestic intelligence service, the Bundesamt für Verfassungsschutz (BfV), while allegedly failing to disclose his own role in the network’s ammunition procurement to his handler. CommandEleven Intelligence assesses this cuts two ways simultaneously: it confirms BfV had a real, placed source inside the network, while also raising a legitimate, publicly unresolved question about source vetting and concealment that this dossier cannot resolve from public reporting alone.
Origins and Timeline
The network’s documented activity traces to at least July 2025, when a separately prosecuted figure – Mohammed A., described by German investigators as integrated into Hamas’s formal leadership structure – received five HS-9 pistols in Berlin and transported them to Vienna. There, he rented a storage unit and deposited the weapons alongside magazines, wool caps, tube scarves, and gloves – equipment consistent with concealment and rapid-deployment operational planning rather than casual possession. An initial ammunition shipment was reportedly discarded into the Spree River out of fear of discovery by German authorities; a replacement batch of 100 rounds was handed over in Berlin on August 25, 2025, and likewise transported to Vienna.
On August 7, 2025, Mohammed A. allegedly recorded a claim-of-responsibility video inside a Vienna apartment – masked, armed, positioned in front of a Hamas flag – announcing “bloody revenge actions” on European soil in the name of the Qassam Brigades. Germany’s Federal Criminal Police Office (BKA) has publicly confirmed this analysis of the footage. The recording of a claim video in advance of an attack, rather than after one, is a specific operational detail this dossier assesses as significant: it indicates a network confident enough in its own operational timeline to prepare propaganda material for release before execution, a level of procedural maturity distinct from opportunistic or loosely organized plotting.
Austrian authorities discovered the Vienna weapons cache in early November 2025, disrupting the plot roughly six days before its apparent October 7 second-anniversary target date had already passed – indicating the operation’s timeline had already slipped or that the original date was aspirational rather than fixed, a distinction this dossier’s sourcing does not fully resolve. Mohammed A. was separately arrested in London on November 3, 2025, by the UK National Crime Agency’s National Extradition Unit and has since been extradited to Germany to face proceedings before the Bundesgerichtshof.
The Turkey Node
The most analytically significant new element in the September 2026 indictment, relative to what was known at the time of the network’s initial disruption, is the explicit identification of a Turkey-based operational hub. Per the indictment’s own account, this base was used to build and train military cells across Europe and direct them remotely toward attacks on Israeli figures and Jewish community life. This dossier treats this as a materially different finding than the weapons-logistics chain: a coordination and training node is command infrastructure, not merely a transit or storage function, and its presence indicates a level of organizational investment in the European theater considerably beyond opportunistic cell activity.
- [DATA DEFICIT] – This dossier’s current sourcing does not establish the Turkey node’s precise relationship to Hamas’s formal international structure – whether it operates under direct Political Bureau authority, functions with some degree of operational autonomy, or represents a joint effort involving other actors operating from Turkish territory. CommandEleven Intelligence’s prior reporting has separately documented Turkey’s historical tolerance for Hamas political and financial activity on its soil; this dossier does not have sufficient sourcing to establish whether Turkish state authorities have knowledge of or any relationship to this specific operational node, and does not allege any such connection.
The Weapons and Logistics Chain
The documented weapons chain, aggregated across the full network per the July 2026 NZZ-sourced reporting, comprises 13 pistols, one AK-47-pattern assault rifle, and more than 900 rounds of ammunition transported through Denmark, Germany, and Austria. The Vienna cache specifically – recovered from a suitcase in a rented storage unit – contained five loaded pistols, ten magazines, over 100 rounds of ammunition, and explosive devices, which Austria’s Directorate for State Protection and Intelligence (DSN) attributed explicitly to “foreign-operational structures of Hamas.” Austrian Interior Minister Gerhard Karner characterized the find as evidence of DSN’s international coordination capability; Israel’s embassy in Vienna separately stated the discovery demonstrated Hamas poses a threat to all of Europe, not merely to the two cities directly targeted.
Germany’s Federal Prosecutor General has noted that many of the individuals connected to this network hold European Union citizenship or Schengen-area residence permits – a detail with direct operational significance, since such status enables largely unrestricted cross-border movement within the Schengen zone, reducing the network’s exposure to the kind of border-crossing scrutiny that might otherwise have surfaced its activity earlier.
The Target Set
Reporting on the indictment identifies the intended target categories as Israeli diplomatic personnel, Jewish community institutions, and pro-Israeli demonstrations in Berlin and Vienna specifically, timed to the October 7 second anniversary.
- [DATA DEFICIT] – This dossier’s sourcing does not identify specific named individuals, addresses, or events beyond these general target categories, and this dossier does not speculate beyond what has been publicly reported – a deliberate choice consistent with CommandEleven Intelligence’s standing practice of not reproducing granular targeting detail regardless of its presence in other open reporting.
The Informant Question
The disclosure that Mohammad S., one of the seven indicted defendants, served as a BfV confidential source complicates rather than clarifies the network’s disruption narrative. Per WELT’s reporting, Mohammad S. regularly delivered information to his BfV handler during the period in question but did not disclose his own participation in the network’s ammunition procurement. This is a distinct fact pattern from an intelligence service recruiting an outside informant to report on a network from beyond its perimeter: it describes a source who was simultaneously part of the criminal conduct under investigation and concealing that participation from the agency running him.
- [ASSESSED] – CommandEleven Intelligence assesses this detail carries two, not fully reconcilable, implications. First, it confirms BfV had genuine, placed access inside an active Hamas-linked network – a meaningful counter-terrorism capability data point. Second, it raises an unresolved question about the adequacy of source vetting and handling in a case involving live weapons procurement for a mass-casualty attack plot: an informant’s undisclosed participation in the substantive criminal conduct is, at minimum, a management failure worth independent scrutiny, whatever the eventual explanation. German authorities have not, as of this assessment, publicly addressed how or why this was not caught earlier, and this dossier does not speculate on that gap beyond noting its existence.
- [DATA DEFICIT] – This dossier does not know how long Mohammad S. served as a BfV source, what specific intelligence he provided, whether his procurement role was self-reported or discovered independently, or what role, if any, his status played in the network’s ultimate disruption in November 2025.
Assessment: A Command-and-Control Network, Not a Cell
The evidence assembled in this dossier supports treating the Berlin-Vienna case as something more structurally significant than an isolated terror plot: a Turkey-coordinated, multi-country command-and-control network with a documented weapons-logistics chain spanning at least four countries (Denmark, Germany, Austria, and the UK via Mohammed A.’s arrest), sleeper-cell infrastructure separately confirmed in Greece and Cyprus, and operational sophistication reflected in advance claim-video production and use of EU/Schengen mobility to minimize detection risk.
- [ASSESSED] – CommandEleven Intelligence assesses this network is best understood as a European instance of the broader post-October 7 Hamas external-operations pivot – the same shift toward operating beyond the immediate Gaza theater that CommandEleven Intelligence’s prior assessments, drawing on Combating Terrorism Center at West Point analysis, has documented across multiple European countries since 2023. This case is distinguished from that broader pattern primarily by the specificity and maturity of its command structure – a dedicated Turkey-based training and coordination node – rather than by any fundamentally new tactic or target category.
Cross-Reference
This dossier expands on ground briefly covered in Part IV of CommandEleven Intelligence’s Domestic Threat Landscape series, Europe as the Leading Indicator, which cited the German-Austrian Hamas cell’s original October 2025 disruption as supporting evidence for that series’ broader leading-indicator thesis. Readers seeking that series’ full argument – comparing this and other European incidents against emerging U.S. domestic patterns – should consult that dossier directly; this piece focuses specifically and exclusively on mapping this network’s structure, logistics, and open questions.
Sourcing Base (Confidence-Tiered, with Links)
CONFIRMED , Primary/Official Record & Direct Reporting:
- Euronews (German edition), “Hamas plante offenbar Anschläge in Berlin und Wien,” Sept. 11, 2026
- Tichys Einblick, “Terrorpläne für Berlin und Wien: Sieben Palästinenser angeklagt“
- Pfalz-Express, “Generalbundesanwalt klagt mutmaßliche Hamas-Zelle in Berlin an” (Turkey operational base detail)
- ORF Wien, “Der Hamas zugerechnete Waffen sichergestellt,” Nov. 6, 2025
- Israelnetz, “Waffenversteck der Hamas in Wien entdeckt“
- Junge Freiheit, “Hamas-Waffenlager mitten in Wien entdeckt” (Karner statement, London arrest/extradition detail)
- Yahoo News/PA Media, “Weapons cache linked to Hamas found in Vienna by Austria’s intelligence service” (NCA arrest confirmation)
- oe24.at, “Hamas-Terror: Wien im Mittelpunkt,” July 21, 2026 (NZZ-sourced network aggregation: weapons totals, Greece/Denmark/UK/Cyprus footprint)
ASSESSED , Credible Secondary Reporting:
- CommandEleven Intelligence, U.S. Domestic Threat Landscape series, Part IV, “Europe as the Leading Indicator” (companion piece; original citation of this network’s disruption)
- Combating Terrorism Center at West Point, “Hamas Plots in Europe: A Shift Toward External Operations?” (cross-referenced from CommandEleven Intelligence’s prior reporting)
Excluded from this dossier: Specific named individuals, addresses, or events beyond the general target categories (Israeli diplomatic personnel, Jewish institutions, pro-Israeli demonstrations) reported in connection with this plot. This dossier also does not allege any relationship between Turkish state authorities and the Turkey-based operational node beyond what is explicitly stated in available sourcing, which does not establish such a connection.
