Germany blames Russia for failed drone attack on Ukrainian cargo plane at Leipzig/Halle Airport
German authorities have formally attributed the August drone attack at Leipzig/Halle Airport to Russia, while U.S. intelligence assesses the incident as one of the first episodes of an expanded Russian sabotage and covert operations campaign against NATO countries. The operation involved at least three drones carrying military-grade Semtex explosive, positioned outside the airport perimeter near a Ukrainian An-124 cargo aircraft. European officials, briefed on U.S. intelligence findings, said Vladimir Putin personally ordered the new campaign.
Key points
- German government on 1 September stated it holds Russia responsible for the Leipzig attack
- U.S. intelligence assesses the operation as one of the first episodes of an expanded Russian sabotage campaign against NATO countries
- European officials briefed on U.S. intelligence said Vladimir Putin personally authorized the new campaign
- At least three drones loaded with military-grade Semtex were placed in bushes and under trees outside the airport perimeter near a Ukrainian An-124 cargo plane
- Drones were equipped with German 5G SIM cards and German cyber investigators traced their connections to servers previously used by Russia's GRU
- Western intelligence linked the operation to Colonel Denys Smolyianinov, a commander in the GRU's Service of Special Tasks; he is sanctioned by the EU and UK
- Following the attack, European countries reported a sharp increase in sabotage incidents, including arson at drone manufacturers in Estonia and Poland and attacks on Starlink stations in Poland, Lithuania and Bulgaria
Why it matters
The Leipzig incident suggests that covert attacks and sabotage may be extending from the war in Ukraine into European territory that supports Ukraine. Germany's formal attribution raises the prospect of NATO security responses — German officials considered invoking Article 5 if the attack had caused significant casualties. The alleged use of agents, explosives, drones, and concealed logistics networks across multiple countries also raises broader questions about the security of critical infrastructure in Europe, while the reported personal authorization of an expanded campaign by Vladimir Putin would significantly raise its strategic significance.
What happened
This summer, at least three drones loaded with military-grade Semtex explosive were positioned in bushes and under trees just outside the perimeter of Leipzig/Halle Airport in Germany, near a Ukrainian An-124 cargo aircraft. The drones carried German 5G SIM cards allowing remote internet-based control, and German cyber investigators traced their communications to servers previously used by Russia's GRU. German investigators believe the drones were operated by agents of Russian military intelligence, and they identified Oleg Levushkin as the coordinator of ground logistics, working with several Belarusian operatives who moved explosives across borders, assembled the drones and placed them.
On 1 September, the German government publicly stated it holds Russia responsible for the attempted attack in Leipzig. U.S. intelligence assesses the operation as one of the first episodes of an expanded Russian campaign of sabotage and covert operations against NATO countries. European officials briefed on U.S. intelligence findings said Vladimir Putin personally ordered the new campaign. Western intelligence linked the attack to Colonel Denys Smolyianinov, a commander in the Service of Special Tasks — a GRU unit formed in 2023 by merging several Russian special-purpose units under the leadership of Lieutenant General Andrii Averianov. Smolyianinov is sanctioned by the European Union and the United Kingdom and was previously identified as one of the commanders behind a plot to smuggle incendiary devices into DHL's parcel network, an operation investigators believed may have been aimed at civilian passenger flights to the UK and North America.
Investigators said Serbia served as a logistics hub for moving modified drones and explosives into Germany, with Semtex reportedly smuggled inside resealed food tins with detonators. Serbian authorities detained seven suspects alleged to belong to an organized group that purchased and stored explosives and drones before sending them to EU countries. Two days before the Leipzig operation, Levushkin and at least one Belarusian accomplice flew from Germany to Serbia and onward to Russia.
Following the Leipzig incident, European countries reported a sharp rise in sabotage attacks. In August, arson struck drone manufacturers in Estonia and Poland, and Slovak authorities said they prevented a planned arson attack on a Ukrainian drone factory on their territory. In autumn, Poland, Lithuania and Bulgaria reported sabotage attacks on Starlink stations, and a series of drone attacks struck commercial vessels in the Black Sea near the territorial waters of Bulgaria and Romania.
At the end of August, CIA Director John Ratcliffe visited Moscow to resume talks and warn Russia against escalating attacks on European allies. After the visit, Ratcliffe warned European intelligence counterparts and selected political leaders that Moscow was intensifying sabotage operations against their countries. U.S. Secretary of State Marco Rubio warned in early November 2025 that escalation could spread to NATO countries. Russia denies involvement in sabotage operations in Europe.
How Ukrainian sources describe it
Ukrainian coverage emphasizes the reported personal authorization of the campaign by Vladimir Putin and frames the Leipzig operation as an early episode of a broader campaign targeting NATO countries and the support network that sustains Ukraine. Ukrainian outlets highlight the scale and organization of the alleged Russian network — agents placed across Europe, military-grade explosives, modified drones, concealed logistics apartments, and covert underground storage sites — and stress the role of the Service of Special Tasks, a GRU unit created in 2023 specifically to wage covert warfare against Europe.
How international sources describe it
International coverage foregrounds Germany's formal attribution and the potential implications for NATO collective defense, including German officials' discussions about invoking Article 5 had the attack caused significant casualties. It also highlights the cooperation between German investigators, U.S. intelligence and European officials, the personal diplomatic track pursued by CIA Director Ratcliffe in Moscow, and the broader risk of escalation beyond the war in Ukraine into NATO territory.
Where reporting differs
Germany and U.S. intelligence attribute the Leipzig operation and the broader sabotage campaign to Russia and, according to European officials, to Vladimir Putin personally. Russia denies any involvement in sabotage operations in Europe, and Putin responded to Berlin's accusation over the Leipzig attack in early September by asking "Where is the evidence?"
Background
The Leipzig operation involved at least three drones loaded with military-grade Semtex explosive, positioned just outside the airport perimeter near a Ukrainian cargo aircraft. German 5G SIM cards enabled remote internet control, and German cyber investigators linked the drones to servers previously used by Russia's GRU. Investigators connected the operation to the Service of Special Tasks, a GRU unit formed in 2023, and specifically to Colonel Denys Smolyianinov, who is sanctioned by the EU and UK. Serbia served as the logistics hub for moving modified drones and explosives into Germany, while related sabotage incidents were reported in Estonia, Poland, Slovakia, Lithuania, Bulgaria, and the Black Sea region.