German security services can now name two suspects in the drone attack on Leipzig/Halle airport with high probability, one of them attributed to Russian military intelligence, Welt am Sonntag reported, citing secret investigation files it obtained. The paper says that evidence is what allowed Berlin to blame Russia publicly a week and a half ago. Russia has denied any involvement.

The two men

The main suspects are a Belarusian citizen, Andrei Ka., and a Russian, Oleg Le., according to security sources cited by the paper. German investigators believe Le. was responsible for the preparation and logistics of the attack, and attribute him to the GRU, Russia's military intelligence agency.

Le. entered Germany through Türkiye, landing at Berlin Brandenburg airport, and later left from the same airport for Serbia. He is now back in Russia. Investigators knew at the point of entry that he was tied to the GRU's circle, and he was not surveilled afterward.

Explore further

A drone beside a Ukrainian cargo plane is costing Russia its last consulate in Germany

What was on the drone

The attack used three drones at Leipzig/Halle airport on the evening of 4 August, and two were destroyed at launch for reasons still unclear. The third landed beside a Ukrainian transport aircraft and sat there for hours. About 1.8 kg of Semtex, built into a vegetable can, failed to fire because a detonator tore loose. The Antonov it reached held 25,000 liters of kerosene, and investigators estimate a detonation would have destroyed parts of the airport.

How the trail was found

Forensic technicians recovered glove remains with DNA traces from the antenna used to fly the drone, and those traces were already on file in Finland and Lithuania, where Ka. has a record for ordinary criminal offenses, including theft in Finland. Polish prosecutors separately link him to a hardware-store fire in Łódź in the summer of 2024 that they treat as sabotage directed from Russia, which fits the pattern European authorities have documented since 2022: Russian services hiring residents, often migrants, to burn warehouses and malls. The Leipzig explosives are thought to have crossed from Bulgaria through Serbia in truck cavities and gone into buried caches, and police found several suspected hiding places after examining the suspects' rental-car data.

Explore further

Germany suspects Russian intelligence behind arson attack as hybrid warfare threat grows across Europe

What Berlin has done about it

German Foreign Minister Johann Wadephul and Interior Minister Alexander Dobrindt blamed Russia at a joint press conference on 1 September, ordering the closure of Russia's last consulate in the country and scrapping the agreement behind Moscow's cultural center in Berlin. Russia's embassy claims more than 150 of its mission staff and their families must now leave Germany, and Moscow answered by closing the German consulate in St Petersburg and the Goethe institutes.

Four days after the attribution, German investigators suspected Russian intelligence behind an arson attack on a defense company.

Fire tore through an ammunition depot belonging to the Bulgarian arms maker EMCO overnight on 12 September, according to RFE/RL. Nobody was hurt, and the interior minister says sabotage is among the versions being examined. It was the second fire at a site of the company, which supplies ammunition to Ukraine, in little over a month.

The warehouses burned one after another

The blaze started near the village of Gorni Varpishta, between Tryavna and Tsareva Livada in Dryanovo municipality. It was visible from Veliko Tarnovo, whose mayor, Daniel Panov, said the fire began around 23:00 on Friday. Gabrovo provincial governor Kristina Sidorova told reporters the fire had taken the depot base and was moving from one store to the next, and she had residents of nearby settlements warned through the BG-Alert emergency system.

Residents nearby heard a series of explosions. Two security guards were the only people on the site and both left in time, Bulgarian media reported. The nearest settlement lies more than a kilometer away, and firefighters ringed the area. EMCO production manager Slavcho Dimiev confirmed to Bulgarian National Television that the store held ammunition and powder, and he told Reuters it mainly contained ammunition, including a small quantity of medium-caliber rounds.

Explore further

Russia rehearsed how to disable Europe’s undersea communications cables near Svalbard. NATO forces drove them off

Sabotage among the versions

Interior Minister Ivan Demerdzhiev said on Saturday the fire was under control and an investigation was running.

"We will review previous cases in which similar fires occurred in the warehouses of this company, as well as at other companies, in order to look for a possible connection or a similar pattern," he said. "We are not ruling out outside interference."

Every ammunition depot in the country will now be inspected, Demerdzhiev said, because storage and security at such sites have been neglected. Dimiev also called for extra protection, saying that if the depots were being targeted, the attack was on the national interest rather than on one company. Lawmaker Bozhidar Bozhanov said the fires are too many and are aimed at one firm, whose owner Russian military intelligence tried to kill, and asked when the state would act.

The owner Russia tried to poison

EMCO belongs to Bulgarian arms trader Emilian Gebrev. He and his plants have been targeted repeatedly in operations attributed to Russian military intelligence over his ammunition deliveries to Ukraine. Gebrev, his son, and a colleague survived a Novichok poisoning attempt in 2015. In 2020 prosecutors charged three Russians whom investigators identified as officers of Russian military intelligence, the GRU.

Explore further

Italy joins Bulgaria in resisting EU sanctions on Patriarch Kirill

In 2024 Bulgaria issued arrest warrants for six Russians over EMCO depots destroyed between 2011 and 2020, which held rounds bound for Ukraine and Georgia. Prosecutors said they had grounds to suspect links between those blasts, the poisoning, and the 2014 explosions in Vrbětice, Czechia, that killed two. Moscow denies all of it. Bulgaria supplied Ukraine with weapons until this year's government moved to stop the transfers.

A month earlier, another EMCO site

Explosions and fire hit another EMCO depot on 10 August. Demerdzhiev said at the time that the preliminary version pointed away from external factors.

Founded in 1992, EMCO produces, repairs, and modernizes ammunition and military equipment. The Telegraph reported in late August, citing Western intelligence sources, that Russia had launched a fresh wave of attacks on European defense plants using local criminal groups.

Germany's authorities suspect Russian intelligence behind an arson attack on a defense firm last week, Estonia investigated a suspected arson at a military robot maker supplying Ukraine in August, and Czech police arrested four suspects over a fire at a plant making drones and thermal optics for Ukraine.