German authorities identify suspects in failed drone attack at Leipzig airport

A drone packed with explosives hit a Ukrainian cargo plane at Leipzig/Halle Airport on the night of August 4-5 and simply didn’t go off. The detonator malfunctioned, turning what could have been a catastrophic attack on German soil into a forensic goldmine for investigators.

Now German authorities have identified the people they believe were behind it, and the trail leads directly to Moscow’s GRU military intelligence service.

What happened at Leipzig

The target was an Antonov An-124, a massive Ukrainian cargo aircraft commonly used to ferry military supplies to Ukraine. Leipzig/Halle Airport has become a critical logistics hub for those shipments, which makes it strategically significant in the broader Russia-Ukraine conflict.

According to findings announced on September 1 by German Interior Minister Alexander Dobrindt and Foreign Minister Johann Wadephul, the drone struck the aircraft but failed to detonate its payload. That payload reportedly consisted of approximately 1.8 kg of Semtex and PETN, a combination of plastic explosives potent enough to cause serious structural damage to the plane and surrounding infrastructure.

Three drones were ultimately linked to the operation. A third drone site, recovered on August 14, yielded roughly 50 grams of military-grade RDX, also known as hexogen.

The suspects identified by German investigators are a Russian national traveling on a Latvian passport and a Belarusian national carrying a Russian passport. Authorities described both as low-level operatives. The Russian suspect has been characterized as a logistics coordinator with ties to the GRU, while the Belarusian operative was identified through DNA evidence recovered from the explosives themselves.

That DNA evidence turned out to be particularly damning for another reason: traces matched those found at the scene of a 2024 arson attack at the same airport.

Germany’s response

The German government announced the closure of the Russian consulate in Bonn, effective September 18, as a direct retaliatory measure. Officials have also called for additional sanctions against Russia.

Germany moved from incident to public accusation in less than a month, a pace that signals both the strength of the evidence and the political urgency Berlin feels.

A pattern of hybrid warfare

The Leipzig attack fits into a well-documented escalation of Russian hybrid warfare tactics across Europe. Rail systems, energy infrastructure, undersea cables, and military logistics nodes have all been targeted. The common thread is disruption of systems that support Ukraine’s defense or NATO’s operational readiness.

The use of low-level operatives with mixed-nationality documentation is also a familiar playbook. Agents carrying passports from allied or neutral countries provide a thin layer of plausible deniability while making them harder to flag at border crossings.

What comes next

The failed detonation gave investigators intact forensic evidence—DNA, explosive residue, and drone components—that accelerated the attribution timeline.

The fact that the same airport was targeted in a 2024 arson attack, apparently by operatives in the same network, raises obvious questions about whether vulnerabilities identified two years ago were adequately addressed.

Disclosure: This article was edited by Editorial Team. For more information on how we create and review content, see our Editorial Policy.