Germany blames Russia for drone attack on Ukrainian plane at Leipzig airport

Why it matters

Germany has formally accused Russia of a sabotage attack on its soil, a sharp escalation in the hybrid conflict playing out on European territory. The target was a Ukrainian An-124 parked at one of the most important logistics hubs for Western military aid to Ukraine, and the device used closely resembles explosives linked to other Russian sabotage operations across Europe. The case also exposes an intelligence gap: German services reportedly knew of the suspect's GRU ties when he entered the country but did not place him under surveillance. Germany's response — a new security package and the closure of Russia's consulate general in Bonn — signals a tougher posture, while the more than 165 suspected sabotage cases logged since the start of 2026 frame the Leipzig incident as part of a broader pattern.

What happened

In the night of August 5, a drone carrying a detonator and approximately 1.8 kg of Semtex struck the wing of a parked Ukrainian An-124 cargo aircraft at Leipzig/Halle Airport, ricocheted off, and fell to the runway without exploding. The Antonov aircraft contained around 25,000 liters of aviation fuel; investigators later said detonation would have engulfed the airport area and caused major destruction. Ukraine's Foreign Ministry reported that no one was injured and that Antonov aircraft were not damaged.

German police initially classified the incident as a state security offense, and on September 1 the German government officially accused Russia of being behind what it called a hybrid attack. Interior Minister Alexander Dobrindt announced a package of countermeasures covering drone defense, critical-infrastructure protection, cyberattack defense, and the detection of spies and potential terrorists. Germany subsequently closed the Russian consulate general in Bonn.

A joint investigation by The Telegraph and Welt am Sonntag, drawing on intelligence documents from Germany, Lithuania and Poland and interviews with Western intelligence officials, identified Russian biker Oleg Levushkin, a Russian passport holder and motorcycle enthusiast, as the likely organizer. German investigators believe Levushkin then entrusted execution to Belarusian agent Andrey Karshakov, who had previously been detained for theft and suspected of arson in Poland. Levushkin reportedly traveled to Germany via Turkey, rented a car at Berlin airport around July 27, visited suspected weapons caches, and conducted reconnaissance at Leipzig airport on July 31. CCTV footage shows the drone striking the aircraft at about 19:30. Police also recovered debris from two additional drones and a homemade antenna system taped to a nearby tree, believed to have served as a control-signal relay.

Investigators believe the Semtex was smuggled into Germany through Bulgaria and Serbia, hidden in cavities of cargo trucks and possibly stored temporarily along the route. The device closely resembled explosives used in other Russian sabotage operations in Poland, Lithuania and Germany. German intelligence linked the attack to GRU sub-unit 29155, which it describes as the main driver of Kremlin-ordered sabotage operations in Europe, though Levushkin's specific affiliation with the unit has not been established. Levushkin has reportedly maintained contact for years with Denis Smolyaninov, described in a December 2025 Lithuanian intelligence report as heading the Ukraine-related department of the GRU and considered the main organizer of Russian explosives attacks in Europe; the UK Foreign Office sanctioned Smolyaninov in 2024. Germany's intelligence services say Russia aims to make Europeans perceive support for Ukraine as risky, in order to influence public debate and undermine support for Kyiv. The Russian Embassy in Berlin denied any Russian involvement. Levushkin did not respond to journalists' requests for comment.

How Ukrainian sources describe it

All of the supplied articles are from Ukrainian outlets summarizing the joint Telegraph/Welt am Sonntag investigation. They frame the incident primarily as an attack on a Ukrainian aircraft and on Ukraine's logistics corridor, emphasizing the GRU link and the Kremlin-ordered nature of the operation, and present Russia's denial as a counter-claim set against the volume of suspected sabotage cases recorded in Germany since the start of 2026.

How international sources describe it

No non-Ukrainian outlets are included in the supplied source set. The international framing can only be inferred from how the Ukrainian outlets summarize reporting by The Telegraph, Welt am Sonntag, Süddeutsche Zeitung and Die Zeit: that reporting is described as focusing on Russian intelligence via GRU Unit 29155, on the failure of German surveillance, on a senior German intelligence official's characterization of Germany as an 'operational theater' for Russian services, and on Russia's strategic intent to make support for Ukraine appear risky — rather than on the specific aircraft or Ukrainian victims.

Where reporting differs

Reports differ on Levushkin's nationality: one source calls him a Russian citizen, another a Russian citizen with a Latvian passport, a third a Russian-born Latvian passport holder, and a fourth a Belarusian-born Russian passport holder. Sources also differ on how the drone ended up on the ground: German police consider it possible the device was knocked down by a bus driver on a service tour, while an alternative account holds that the driver found it already on the ground and merely flipped it over. On August 7, Germany's Interior Ministry denied that the Ukrainian plane contained military ammunition, contradicting earlier German media reports that weapons were on board.

Background

Leipzig/Halle Airport has hosted Ukrainian Antonov aircraft since 2022 and is one of the most important cargo hubs for Western military aid to Ukraine. GRU sub-unit 29155 has been identified by German intelligence as the main driver of Kremlin-ordered sabotage operations in Europe. Denis Smolyaninov, regarded as the main organizer of Russian explosives attacks in Europe, was sanctioned by the UK Foreign Office in 2024 and is described in a December 2025 Lithuanian intelligence report as heading the Ukraine-related department of the GRU and as specializing in psychological operations linked to covert sabotage campaigns coordinated via Telegram.