Investigators found what they believe is explosives meters from a crashed drone near the Bundeswehr's Wunstorf air base in Lower Saxony, Germany, and the device matches the construction of drones used in the GRU-attributed Leipzig airport attack, Süddeutsche Zeitung, NDR, and WDR reported on 22 September. Germany's federal prosecutor and the Federal Criminal Police Office (BKA) have taken over the investigation, and the same reporting traced one of the Leipzig suspects to a sanctioned GRU colonel who directs sabotage against countries arming Ukraine.

Russia's sabotage campaign against countries supporting Ukraine has escalated from arson packages and recruited proxies to explosives-laden drones targeting military infrastructure inside NATO. Germany's military counterintelligence has attributed repeated sabotage on German soil to Russia, while Finnish President Stubb called the broader alarm about Russian threats an "overreaction"—a position the accumulating evidence from Germany and Poland does not support.

Explosives found days after the drone crash

A farmer discovered the drone, broken into several pieces, on the evening of 14 September, about one kilometer from the Wunstorf air base, Militarnyi reported. Days later, police found a suspicious substance just meters from the crash site. Security sources told SZ, NDR, and WDR they believe it is an explosive, though forensic analysis has not yet been completed.

The drone's design is similar to the devices used in the Leipzig airport attack on 4 August, when attackers tried to destroy Ukrainian cargo planes with explosives-laden drones. At least one component was manufactured using a 3D printer, the reporting found. Investigators believe the drone may have been near the military airfield for a long time—possibly up to two years.

Wunstorf air base houses the Bundeswehr's entire A400M transport fleet. The facility is Germany's central hub for moving troops and materiel worldwide. An explosives-laden drone near this base would represent a direct threat to the Bundeswehr's central global logistics hub.

The Wunstorf find was discussed at the weekly intelligence briefing in the Chancellery on 22 September, the outlets reported.

Leipzig suspect linked to sanctioned GRU colonel

The federal prosecutor's investigation connects the Wunstorf case to the Leipzig attack. In that case, Germany's government has officially blamed Russia. Two suspects were identified: Oleg L., a Latvian with a Russian passport, and Andrei K., a dual Belarusian-Russian citizen whose DNA was found at the Leipzig scene.

SZ, NDR, and WDR reported that Oleg L. maintained years-long contacts with GRU Colonel Denis Smolyaninov. The EU sanctioned Smolyaninov for directing sabotage operations against countries supporting Ukraine. Andrei K. had previously been noticed for minor offenses in the Baltic states and Finland and entered Germany on an Italian tourist visa. Moscow denied involvement in the Leipzig attack.

A drone violated the no-fly zone around NATO's missile shield base in Poland

The Wunstorf case came to light in the same week that a drone violated the no-fly zone around the US-operated Aegis Ashore missile defense base in Redzikowo, northern Poland, on 15 September.

Polish troops guarding the facility called civilian emergency services instead of neutralizing the drone, TVP World reported. Poland's defense ministry said the drone was a civilian device that "posed no threat" and remained under military surveillance, but Defense Minister Władysław Kosiniak-Kamysz ordered a full report into the incident.

Illia Bilyk, a 21-year-old Ukrainian national, admitted five counts of racially and religiously aggravated criminal damage on 17 September over graffiti at five Muslim institutions in east London, the BBC reported.

The BBC and Hope Not Hate linked Bilyk’s attacks to the same Russian network behind arsons targeting properties connected to former UK Prime Minister Keir Starmer. The network operated Direct Action UK, a fake British far-right group that recruited people through Telegram and shared images of the resulting vandalism. Investigations have documented the same recruitment model across Europe for surveillance, sabotage, and other criminal assignments.

The Metropolitan Police said Bilyk sprayed offensive graffiti at three mosques, Noor Ul Islam Primary School, and the Islamic Shariah Council on 23 and 25 January 2025. Images then appeared in a Direct Action UK Telegram group. Russian operators created the group to pose as a British far-right movement, the BBC reported. Bilyk will be sentenced on 19 October.

The handler, known as EL or “El Money,” also recruited through Telegram groups used by Ukrainians seeking work, the BBC found. Ukrainian builder Roman Lavrynovych was paid in cryptocurrency and steered from posters and graffiti to arson.

In May 2025, Lavrynovych set fire to a car and properties connected to Starmer. Nobody was injured. Lavrynovych was jailed for seven years, while Ukrainian-born Romanian national Stanislav Carpiuc was also convicted.

The BBC identified EL as Yevgeny Lyukshin, a 23-year-old Russian diplomat and son of a senior Foreign Ministry official. It cited matching personal details, his presence in the Direct Action UK chat, family connections, and information-warfare training from Rybar, a sanctioned pro-Kremlin Telegram outlet.

However, the BBC could not conclusively establish that Lyukshin was EL, while British police said they had no evidence the attacks were state-sponsored. Lyukshin did not respond. The Russian Embassy denied any connection between Russia or its Foreign Ministry and unlawful activity.

Paid local recruits make Russia-linked attacks look homegrown

The London operation is one of several cases across Europe and other continents.

UK intelligence warned that Moscow increasingly relies on non-state actors, meaning hired civilians and criminals outside its formal services, for espionage, sabotage, assassination, and information operations.

This month, US prosecutors alleged that another Russian network recruited local residents for surveillance, sabotage, and murder-for-hire.

A US-based recruit was promised up to $1,500 to surveil a prominent Russian dissident before being offered $40,000 to “eliminate” or “disappear” the target, the US Justice Department (DOJ) said on 15 September.

The charges connect that alleged plot to what prosecutors describe as a wider Russian assassination network operating since at least 2024 against dissidents, defectors, and countries perceived as supporting Ukraine.

A federal grand jury in Manhattan indicted five alleged members of what prosecutors call the “RIS Network”:

• Yuri Khrameev, 63: A Russian national and former colonel in the Russian intelligence services who allegedly recruited people to kill Russian dissidents.
• Kirill Khrameev, 27: Yuri Khrameev’s son and an officer in the FSB, Russia’s principal security service and a successor to the Soviet KGB.
• Oemis Romagoza Durruthy, 35: A Cuban national living in Russia who allegedly coordinated attacks and arranged travel for operatives.
• Yaidel Delgado Suarez, 35: A Cuban national accused of recruiting people in the US for surveillance and murder.
• Angel Eduardo Castro, 22: A Venezuelan national accused of helping Suarez recruit US residents to spy on and kill a Russian dissident.

Suarez sent the US resident two locations associated with the dissident, according to the indictment. After the resident delivered photographs and videos, prosecutors say, Suarez and Castro made the $40,000 offer. When the resident declined to carry out the killing, they allegedly asked whether he knew “someone [who] can do the work.”

In 2025, the indictment alleges, Kirill Khrameev recruited a US citizen to photograph a target in Lithuania for a promised $200. Yuri Khrameev then offered approximately $25,000 to kill the man. When the recruit refused, Khrameev allegedly proposed a “simpler job”: burning a warehouse or attacking an electrical substation. He said the purpose was to target countries helping Ukraine, according to prosecutors.

Prosecutors also allege that Durruthy coordinated travel and logistics for attacks in Prague, Czechia, in June 2024 and in Lithuania that September. The Justice Department did not specify what either attack involved.

All five defendants are charged with conspiracy to finance terrorism, carrying up to 20 years in prison. Yuri Khrameev, Suarez, and Castro also face a murder-for-hire conspiracy charge carrying up to 10 years.

All five remain at large. Kremlin spokesperson Dmitry Peskov said Moscow saw no need to comment without “credible evidence,” Reuters reported. An indictment is an allegation, and the defendants are presumed innocent.

From military espionage to alleged murder plots

Since Russia’s full-scale invasion, its covert campaign against Ukraine’s Western allies has combined intelligence gathering with escalating sabotage. CSIS found that suspected Russian attacks in Europe nearly tripled from 2023 to 2024, often using locally recruited agents against infrastructure and industries supporting Ukraine.

In August 2025, US prosecutors charged active-duty soldier Taylor Adam Lee with trying to transmit Abrams tank information and deliver hardware to someone he believed represented the Russian government, allegedly in exchange for Russian citizenship. That case involved an American insider allegedly offering military secrets, not a proven Russian recruitment operation.