Berlin prepares a coordinated response with European and NATO allies after explosive-laden drones were discovered around a key German cargo hub used by Ukraine

Germany is preparing to publicly identify who it believes was responsible for a suspected drone attack targeting Ukrainian-linked aviation operations at Leipzig/Halle Airport, as evidence from the investigation raises increasingly serious questions about possible Russian involvement.

Chancellor Friedrich Merz said the German government was finalising its assessment of the August incident and preparing a response in consultation with European Union and NATO partners. Berlin has so far stopped short of formally accusing Moscow, but German media and Western security officials have increasingly pointed toward Russian intelligence or Russia-linked actors as the most likely suspects. Russia has denied involvement.

The case has become one of the most closely watched suspected sabotage incidents in Europe this year because of both the nature of the devices involved and the strategic importance of Leipzig/Halle Airport.

The airport is one of Germany’s largest air-freight hubs and is used by DHL, NATO-related logistics operations and Ukraine’s Antonov Airlines, which operates heavy cargo aircraft capable of transporting military equipment.

Explosive drone discovered near Ukrainian aircraft

The investigation began after a drone carrying explosives was discovered on August 4 near a Ukrainian Antonov cargo aircraft at Leipzig/Halle Airport.

According to investigators cited in German and international media, the drone may have been intended to land or detonate on the aircraft’s wing. The Antonov plane was reportedly carrying a significant quantity of aviation fuel at the time, raising fears that a successful explosion could have caused a major fire or potentially catastrophic damage.

The explosive device did not detonate.

Around 20 minutes after the first drone was discovered, another suspected drone incident affected a DHL cargo aircraft attempting to land at the airport. The aircraft was forced to abort its landing and divert to Hanover.

Subsequent inspection reportedly revealed damage to the tail section of the aircraft, prompting investigators to examine whether it had collided with another drone. The suspected second device has not been recovered.

The case became significantly more serious when investigators later discovered a third drone in a field near the airport.

Forensic examination reportedly detected residues consistent with a powerful military-grade explosive. Investigators also uncovered electronic components and an antenna that may have formed part of a remote-control or communications system associated with the devices.

The findings have fuelled concerns that the August 4 incident was not an isolated drone intrusion but a potentially coordinated sabotage operation directed against a strategically important European logistics hub.

Berlin describes a new level of threat

German Interior Minister Alexander Dobrindt has described the Leipzig case as part of a broader hybrid-threat environment facing Germany.

Authorities have increasingly warned that hostile actors are using drones, cyber operations, sabotage, disinformation and covert recruitment networks to disrupt European infrastructure while remaining below the threshold of conventional military conflict.

Dobrindt has said Leipzig should not be regarded as an isolated incident, describing the broader threat as involving multiple potential attack scenarios. Germany has also moved to strengthen its anti-drone capabilities following the discovery.

Merz has adopted similarly forceful language.

Germany, he said, has increasingly become a target of hybrid operations in which attackers appear willing to accept substantial property destruction and potentially casualties.

The chancellor has promised consequences for whoever is ultimately found responsible.

His government is now expected to disclose more information about the investigation and outline its political and security response.

Russia remains the principal focus of suspicion

While Germany has not officially attributed the operation, intelligence reporting cited by German broadcasters and newspapers has focused heavily on possible Russian involvement.

Western and European security officials have argued that the Leipzig incident resembles other suspected sabotage operations associated with Russian intelligence networks since Moscow’s full-scale invasion of Ukraine in 2022.

A U.S. intelligence source cited by ABC News also linked the explosive drone discovered at Leipzig to Russian military intelligence, although German authorities have yet to publicly endorse that assessment.

Russia has repeatedly rejected allegations that it is orchestrating sabotage operations in Europe.

The attribution challenge is particularly complicated because intelligence services increasingly suspect hostile states of using intermediaries rather than official operatives.

European security authorities have warned that individuals can be recruited online to conduct surveillance, arson, sabotage or other disruptive activities, giving the organisers several layers of plausible deniability.

Such proxy operations can also make attacks unpredictable.

Individuals with limited training may be tasked with dangerous missions involving explosives, incendiary devices or drones, increasing the possibility of unintended casualties.

Part of a wider European pattern

The Leipzig investigation is unfolding against a broader backdrop of suspicious fires, explosions, cyber incidents and sabotage attempts affecting infrastructure connected to European defence industries or support for Ukraine.

European officials have repeatedly accused Russia of conducting what they describe as a campaign of hybrid aggression designed to impose political, economic and security costs on countries supporting Kyiv.

Weapons manufacturers, logistics facilities, communications networks and industrial sites have all become potential targets.

In recent weeks, authorities elsewhere in Europe have investigated suspicious incidents involving defence facilities and companies supplying equipment to Ukraine.

Security officials increasingly view these events not as isolated criminal activity but as possible elements of a broader strategy intended to test NATO’s response and undermine public confidence in European governments.

That interpretation remains contested until individual cases are formally attributed.

But the Leipzig episode is attracting particular attention because the consequences could have been severe.

If an explosive drone had detonated on or near a fully fuelled cargo aircraft, investigators believe the resulting fire and secondary explosions could have caused significant destruction across part of the airport.

A strategically important logistics hub

Leipzig/Halle’s importance extends far beyond civilian passenger travel.

The airport is among Europe’s largest cargo centres and hosts significant international freight operations. Its infrastructure has also become increasingly important for military and humanitarian logistics since the beginning of the war in Ukraine.

Ukraine’s Antonov Airlines operates heavy transport aircraft from European bases, moving oversized cargo and military-related equipment around the continent.

That makes aviation infrastructure connected to Ukrainian logistics an attractive target for any hostile actor seeking to obstruct Western military assistance without directly attacking NATO armed forces.

Sabotaging an aircraft on German territory would therefore carry significance beyond the physical damage inflicted.

It would demonstrate the ability to penetrate critical infrastructure inside one of Europe’s most powerful states.

Germany weighs its response carefully

The next major development will be Berlin’s attribution decision.

Merz has indicated that Germany intends to coordinate its response with European and NATO allies rather than act alone.

Possible responses reportedly under consideration include additional sanctions and measures targeting Russian economic networks, although the German government has not yet publicly announced the details.

Berlin’s caution reflects the political importance of attribution.

Formally accusing a foreign government of directing or facilitating an explosives attack on German territory would represent an extraordinary diplomatic escalation.

Germany would therefore need to demonstrate that its conclusions were supported by sufficient intelligence, forensic evidence and operational links.

At the same time, European security officials argue that failing to respond decisively to suspected sabotage could encourage further operations.

Former German intelligence officials and European security specialists have warned that adversaries closely observe NATO governments’ reactions to hybrid attacks, assessing how much disruption can be inflicted without provoking significant retaliation.

A test of Europe’s response to hybrid warfare

The Leipzig case illustrates one of the most difficult security challenges confronting Europe.

The dividing line between espionage, sabotage and military aggression is becoming increasingly blurred.

Commercial drones can be modified to carry explosives. Criminal networks can be recruited remotely. Cyber tools can disable infrastructure without conventional weapons. And operations can be designed so that responsibility remains ambiguous long enough to complicate any political response.

That ambiguity is often central to hybrid warfare.

Governments must decide whether to retaliate before they can publicly reveal all the intelligence supporting their conclusions.

Germany now appears close to making that decision.

If Berlin formally identifies Russia or Russia-linked actors as responsible for the Leipzig operation, the significance will extend well beyond one airport or one attempted attack.

It would add another major case to Europe’s growing catalogue of suspected covert operations linked to the confrontation between Russia and the West — and intensify the debate over how NATO countries should respond when attacks take place not on the Ukrainian battlefield, but inside their own territory.