German authorities link Russian military intelligence to Leipzig airport drone plot
German security authorities have identified a member of Russia's military intelligence agency as the suspected logistics coordinator behind an attempted attack involving an explosive-laden drone at Leipzig airport last month, according to reports.
Officials believe Oleg Le, affiliated with the GRU—Russia's military intelligence service responsible for covert operations abroad including espionage and sabotage—organized the operation discovered on August 4. Investigators also identified a second suspect, Belarusian national Andrei Ka, based on DNA traces recovered at the scene.
The drone was found in the secure cargo operations area near a Ukrainian cargo plane. Leipzig airport functions as a critical logistics hub, hosting NATO's Strategic Airlift International Solution program, which operates nearly daily missions delivering equipment to NATO battle groups deployed from Finland to Romania and supporting EU and alliance operations.
Pattern of attacks at Leipzig
This incident marks the second suspected sabotage attempt at Leipzig airport in recent years. In 2024, an incendiary device ignited at a DHL logistics center at the facility, setting fire to a freight container before it could be loaded onto a cargo plane. Western security officials suspect Russian intelligence orchestrated that attack, which only avoided catastrophic damage because the aircraft departure was delayed.
The EU judicial agency Eurojust has attributed a 2024 wave of parcel bomb attacks across Europe to the GRU, with suspects currently on trial in Lithuania for sending explosive devices via DHL and DPD freight services targeting Germany, Poland and the United Kingdom.
Broader campaign of sabotage
The Leipzig incident fits within a larger pattern of hostile activities across Europe. The Associated Press has documented approximately 200 incidents of sabotage and malign activity blamed on Russia by Western officials since Moscow's 2022 invasion of Ukraine, including cyberattacks, espionage operations, disinformation campaigns and infrastructure interference.
In Germany specifically, the Federal Criminal Police Office registered 321 cases of sabotage against critical infrastructure in 2025, with some linked to Russian interference. Such coordinated harmful activities—combining information manipulation, cyberattacks, economic coercion and covert operations while remaining below the threshold of conventional war—constitute what EU institutions define as hybrid warfare.
Diplomatic fallout
These findings prompted Berlin to announce retaliatory measures, including the closure of Russia's consulate in Bonn and a Russian cultural center in Berlin. The Bonn mission was Moscow's last remaining consulate general in Germany, following the earlier closure of Russian consulates in Frankfurt, Hamburg, Leipzig and Munich by the end of 2023 amid escalating diplomatic tensions.
Russia has denied any involvement in the Leipzig incident. In response to Germany's actions, Moscow announced it would close German cultural centers operated by the Goethe-Institut in Moscow, St. Petersburg and Yekaterinburg.
Investigation details
According to the Welt Am Sonntag newspaper report, Le arrived in Germany from Turkey and departed to Serbia from Berlin airport before returning to Russia. Direct flights between Russia and Germany have been suspended since Russia's full-scale invasion of Ukraine in 2022.
Authorities were aware of Le's GRU connections when he entered the country but did not place him under surveillance. Investigators believe the explosives used in the operation may have been transported to Germany concealed in trucks traveling through Bulgaria and Serbia.
A spokeswoman for Germany's BfV domestic intelligence agency declined to comment on the report, citing the ongoing investigation. Germany remains a key supporter of Ukraine and has experienced a surge in suspected Russian sabotage operations, cyberattacks and other hostile activities since the 2022 invasion.
