Chancellor Friedrich Merz is expected to formally attribute the attempted attack to Moscow as Germany pushes for tougher national and European measures against Russian hybrid operations
Germany is preparing to formally hold Russia responsible for an attempted explosive-drone attack at Leipzig/Halle Airport, a move that could trigger a new round of sanctions and deepen already severe tensions between Berlin and Moscow.
According to German and European media reports, Chancellor Friedrich Merz’s government is expected to announce its assessment in the coming days, alongside what officials have described as potentially extensive punitive measures against Russian individuals or entities. The German response could coincide with additional sanctions being considered at European Union level.
The anticipated announcement would mark a significant escalation in Germany’s response to what European governments increasingly describe as Russian “hybrid” activity — operations that fall below the threshold of conventional warfare but can include sabotage, cyberattacks, disinformation, espionage and attacks against critical infrastructure.
The Leipzig incident has become one of the most serious recent examples.
On August 4, an explosives-laden drone was discovered near Leipzig/Halle Airport, one of Germany’s most important air-freight hubs. Ukrainian cargo aircraft were located nearby, including planes involved in transporting military supplies, raising suspicions that logistics connected to Western support for Ukraine may have been the intended target.
The incident could have been considerably more destructive. German officials said a bus driver intervened after encountering one of the drones, knocking it out of the air. Prosecutors subsequently confirmed that the device contained professional-grade explosive material.
Investigators later uncovered further evidence around the airport. Approximately ten days after the original incident, authorities found another drone west of the airport together with roughly 50 grams of suspected hexogen, also known as RDX — a powerful military explosive commonly used in munitions. Investigators have examined at least three drones linked to the episode.
Another aircraft was also reportedly involved in the wider sequence of events, with investigators examining whether a drone collided with a DHL cargo plane.
The circumstances immediately elevated the case from an aviation-security incident to a matter of national security. Leipzig/Halle is not merely a commercial airport. It is a major European cargo centre and an important logistics location for NATO activities and deliveries associated with support for Ukraine.
For German authorities, the suspected targeting of such a facility carries strategic implications.
European intelligence agencies have repeatedly warned that Russia may increasingly rely on deniable operations to disrupt Western infrastructure while avoiding actions that could clearly trigger NATO’s collective-defence mechanisms. Such activity allows an aggressor to create economic damage, uncertainty and political pressure while complicating the process of attribution.
Berlin has not yet publicly presented the evidence that reportedly underpins its planned attribution to Moscow. Until an official announcement is made, Russia’s responsibility remains an assessment reported by German media rather than a judicially established conclusion. Moscow has denied involvement in the Leipzig incident.
That distinction is especially important because formally accusing another state of directing or supporting an attempted attack on German territory carries major diplomatic consequences.
Merz had already indicated that the government was approaching a conclusion. Earlier in the week, he said Germany would soon identify those responsible for the attempted attack, while Interior Minister Alexander Dobrindt had previously referred more cautiously to the involvement of unspecified “foreign powers.”
Reports now suggest Berlin is preparing to go substantially further.
The government is considering direct German measures against Russian entities as well as supporting additional sanctions at EU level. Further German military assistance to Ukraine has also reportedly been discussed as part of the response.
The sanctions debate comes only weeks after the European Union adopted its 21st sanctions package against Russia on July 23. That package targeted 48 individuals and 170 entities, expanded restrictions on Russia’s shadow tanker fleet, imposed transaction bans on additional financial institutions and crypto platforms, and tightened controls on dual-use technology.
Further EU measures would therefore represent another step in an already extensive economic campaign against Moscow.
For Merz, however, the Leipzig case also raises a broader question about Germany’s ability to protect itself from covert attacks.
Berlin has become increasingly concerned about threats to transport networks, energy infrastructure, defence manufacturers and digital systems. Earlier this month, the German cabinet approved proposals that would expand the powers available to the country’s intelligence services, with the government explicitly citing growing cyber and hybrid threats.
France has responded to the Leipzig incident with similar concern. Nicolas Lerner, head of France’s domestic intelligence agency, said French authorities were reassessing potential threats against essential companies and infrastructure following the apparent drone attack in Germany.
The concern extends well beyond drones.
European governments have investigated numerous incidents in recent years involving suspected sabotage, damaged communications infrastructure, arson plots, cyber intrusions and attempted attacks on industrial or military-linked sites. Western intelligence agencies have frequently examined whether Russian intelligence services or intermediaries acting on their behalf were involved.
Moscow has consistently rejected accusations that it is conducting a campaign of sabotage against European countries.
That ambiguity is one of the central characteristics of hybrid conflict. Rather than conventional military attacks involving clearly identifiable forces, operations can be carried out through intermediaries, criminal networks, recruited individuals or technically deniable methods.
For policymakers, this creates a difficult dilemma: governments must respond forcefully enough to deter further attacks while ensuring that attribution is supported by sufficient evidence.
The Leipzig case could become an important test.
If Germany formally attributes the operation to Russia, Berlin would effectively be accusing Moscow of involvement in an attempted explosive attack against infrastructure inside NATO territory. Even without casualties, such an allegation would represent a serious deterioration in bilateral relations.
Germany has already emerged as one of Ukraine’s most important European supporters, supplying military equipment, financing and other assistance while simultaneously expanding its own defence capabilities.
Russia, meanwhile, has repeatedly portrayed German weapons deliveries as evidence that Berlin has become directly involved in the confrontation.
The political relationship between the two countries is therefore already at one of its lowest points since the end of the Cold War.
An official attribution over Leipzig would push it lower still.
The broader European response will also be closely watched. EU governments have increasingly sought to punish not only Russia’s conventional military operations in Ukraine but also activities described as destabilising actions or hybrid threats within Europe itself.
The European Council says existing sanctions now cover individuals and organisations associated with Russia’s war effort, military-industrial complex, energy revenues, propaganda activities and hybrid operations.
Germany’s reported plans suggest that European policy may increasingly treat attacks on civilian or logistical infrastructure as another front in the wider confrontation with Moscow.
Yet the Leipzig episode also illustrates the vulnerability of modern European infrastructure.
A relatively small unmanned aircraft carrying a limited quantity of explosives can potentially disrupt a major airport, threaten aircraft worth tens of millions of euros and interrupt strategically important supply chains. The financial cost of defending every airport, railway line, energy installation and defence facility against such attacks would be considerable.
That asymmetry is precisely what makes hybrid operations attractive.
For Berlin, the immediate challenge is therefore not only determining who was responsible for the Leipzig attack, but demonstrating that similar operations will carry consequences.
If Merz proceeds with the reported attribution and sanctions package, Germany will be sending Moscow a clear message: attacks conducted in the shadows will increasingly be treated as acts requiring a visible political and economic response.
The greater question is whether sanctions and stronger security measures will be sufficient to deter future attempts — or whether Leipzig represents the beginning of a more dangerous phase in the confrontation between Russia and Europe.
