German security services can now name two suspects in the drone attack on Leipzig/Halle airport with high probability, one of them attributed to Russian military intelligence, Welt am Sonntag reported, citing secret investigation files it obtained. The paper says that evidence is what allowed Berlin to blame Russia publicly a week and a half ago. Russia has denied any involvement.

The two men

The main suspects are a Belarusian citizen, Andrei Ka., and a Russian, Oleg Le., according to security sources cited by the paper. German investigators believe Le. was responsible for the preparation and logistics of the attack, and attribute him to the GRU, Russia's military intelligence agency.

Le. entered Germany through Türkiye, landing at Berlin Brandenburg airport, and later left from the same airport for Serbia. He is now back in Russia. Investigators knew at the point of entry that he was tied to the GRU's circle, and he was not surveilled afterward.

Explore further

A drone beside a Ukrainian cargo plane is costing Russia its last consulate in Germany

What was on the drone

The attack used three drones at Leipzig/Halle airport on the evening of 4 August, and two were destroyed at launch for reasons still unclear. The third landed beside a Ukrainian transport aircraft and sat there for hours. About 1.8 kg of Semtex, built into a vegetable can, failed to fire because a detonator tore loose. The Antonov it reached held 25,000 liters of kerosene, and investigators estimate a detonation would have destroyed parts of the airport.

How the trail was found

Forensic technicians recovered glove remains with DNA traces from the antenna used to fly the drone, and those traces were already on file in Finland and Lithuania, where Ka. has a record for ordinary criminal offenses, including theft in Finland. Polish prosecutors separately link him to a hardware-store fire in Łódź in the summer of 2024 that they treat as sabotage directed from Russia, which fits the pattern European authorities have documented since 2022: Russian services hiring residents, often migrants, to burn warehouses and malls. The Leipzig explosives are thought to have crossed from Bulgaria through Serbia in truck cavities and gone into buried caches, and police found several suspected hiding places after examining the suspects' rental-car data.

Explore further

Germany suspects Russian intelligence behind arson attack as hybrid warfare threat grows across Europe

What Berlin has done about it

German Foreign Minister Johann Wadephul and Interior Minister Alexander Dobrindt blamed Russia at a joint press conference on 1 September, ordering the closure of Russia's last consulate in the country and scrapping the agreement behind Moscow's cultural center in Berlin. Russia's embassy claims more than 150 of its mission staff and their families must now leave Germany, and Moscow answered by closing the German consulate in St Petersburg and the Goethe institutes.

Four days after the attribution, German investigators suspected Russian intelligence behind an arson attack on a defense company.

Romania's domestic intelligence service says it prevented a Russia-coordinated sabotage operation on its soil, Militarnyi and Radio Svoboda reported. For months, it watched a Russian citizen who was filming military sites across the country—including, it says, Ukraine's Antonov cargo planes.

A wave of arson, drone incursions, and covert surveillance blamed on Russian handlers has spread across the continent, aimed at the logistics that keep Ukraine armed.

What the suspect was told to film

The Romanian Intelligence Service (SRI) announced on Tuesday that it had prevented the plot with national and international partners. The man had been under SRI monitoring since February 2026, part of a wider investigation into sabotage attempts on Romanian soil.

An intermediary instructed him to make photos and videos of targets of strategic military interest, SRI said. The list ran from NATO-used bases and communications nodes to defense institutions, critical infrastructure, and Ukraine's Antonov cargo planes.

SRI says the pattern matches saboteur networks run by Russian entities across Europe. It points to similar cases foiled in Romania in 2024 and 2025. The service added that Russia keeps leaning on people from vulnerable groups to carry out this work.

The Leipzig link

The case recalls an incident in Germany. On 4 August, workers found a drone rigged with explosives and a detonator beside an An-124 Ruslan at Leipzig airport. The Ruslan is a giant Antonov cargo plane. Ukraine's Antonov fleet moves oversized loads few other planes can carry, a standing target for a Kremlin trying to slow Western support without firing a shot.

Germany's government blamed Russia, and the attempt sharpened tensions between Berlin and Moscow. Russia denies any role in Europe's sabotage wave and has not addressed Romania's findings.

The disclosure comes days after Russian Shahed attack drones struck the Orlivka ferry crossing in Odesa Oblast, overnight on 1 September. The crossing sits on the Ukrainian-Romanian border.

An explosives-laden drone aimed at a Ukrainian cargo aircraft at Leipzig/Halle Airport was part of a Russian state operation, Interior Minister Alexander Dobrindt said on 1 September.

Germany has moved from suspecting foreign sabotage to formally blaming Russia for the Leipzig attack. The finding has prompted diplomatic and security measures against Moscow while the criminal investigation continues.

Police investigations, the attack pattern, and intelligence findings established Russian responsibility, Dobrindt said. The drones' configuration, components, explosives, and detonation systems resembled those used in other Russian hybrid operations—covert sabotage and disruption below the threshold of open war—and in Russia's war against Ukraine, Foreign Minister Johann Wadephul said.

The first drone, carrying explosives, was found near a Ukrainian cargo aircraft on the evening of 4 August and defused. Investigators believe a DHL freighter may have collided with a second drone while aborting its landing after the airport closed; that drone was never recovered. A third drone was found on 14 August in a field at Kabelsketal, where investigators subsequently discovered roughly 50 grams of suspected military explosive.

Leipzig/Halle is an international freight hub used by Ukrainian Antonov aircraft and NATO's strategic airlift program, through which allies charter heavy transport aircraft to move oversized military cargo.

Berlin will close the Bonn consulate on 18 September, end the operating agreement for the Russian House, a Moscow-backed cultural center, tighten entry controls for Russian nationals, seek to add more targets to EU sanctions lists, and pressure Russia's shadow fleet—opaquely owned tankers used to move Russian oil outside Western restrictions. Wadephul also summoned the Russian ambassador. Russia's Berlin embassy will remain open.

Russian Foreign Ministry spokesperson Maria Zakharova told Interfax that Moscow would respond to Germany's “anti-Russian action,” without specifying how.

NATO Secretary General Mark Rutte said the alliance stood in full solidarity with Germany, and European Commission President Ursula von der Leyen described Berlin's measures as a strong response.

Dobrindt said Germany expects further Russian hybrid attacks. The Leipzig incident follows a widening campaign of suspected Russian sabotage across Europe, including a 2024 incendiary-device attack at the same airport that Western security officials suspected Russian intelligence organized.

How the Leipzig attack unfolded

Euromaidan Press reported on 12 August, citing Die Zeit, that footage showed an explosives-laden quadcopter striking the wing of a parked Ukrainian Antonov An-124 before falling without detonating. The article also noted that a US Defense Department official told CNN that Washington assessed the drone belonged to Russian intelligence.

On 25 August, EP reported, citing Tagesschau’s NDR/WDR/SZ investigation, that investigators had expanded the case to three drones and found the third with suspected military explosive nearby in Kabelsketal, 10 days after the original attempt.