Leipzig drone bomb fits wider Russian sabotage pattern, officials say

German federal police believe a drone that struck a Ukrainian aircraft's wing at Leipzig Airport on 4 August was carrying an improvised bomb: a sealed tin can packed with explosives and fitted with a metal plate stamped with seven circular indentations. The device fell to the tarmac intact instead of detonating, according to an investigative file reviewed by the Axel Springer Global Reporters Network, leaving investigators with a rare chance to examine a bomb from an attempted attack rather than just its aftermath.

The device closely resembles explosives recovered from hidden caches in Lithuania. In August 2024, investigators in Kaunas found a plastic bag with two tin cans labelled as corn at a cemetery grave, acting on a tip from Poland about a Ukrainian man allegedly working for Russian intelligence, according to files from the Lithuanian Criminal Police Bureau. Forensic tests found the cans held a combined 968 grams of explosives, about 700 grams of TNT equivalent each. More explosive-filled cans were found at other Lithuanian sites in January and June 2025, four fitted with metal plates bearing the same circular-indentation pattern, which Lithuania's Forensic Science Service said were highly likely made on the same machine.

Two Western security officials, speaking anonymously, said the resemblance between the devices fits other evidence, including travel records and suspected logistics routes, linking the cases to a broader Russian intelligence operation. Three senior German and European security officials said the campaign is driven mainly by Russia's GRU military intelligence service, centred on Unit 29155, which they linked to destabilisation operations in European countries.

German authorities suspect Oleg Levushkin, a dual Latvian-Russian national, of helping prepare the Leipzig attack. A senior German security official and investigative files reviewed by the Axel Springer Global Reporters Network describe him as a GRU-linked logistics operative with longstanding ties to senior Russian military intelligence figures. Investigators believe he travelled via Turkey to Berlin Brandenburg Airport in late July and rented a car there on 27 July, according to location data in German investigation files; they believe the explosives entered Germany via Bulgaria and Serbia.

In Serbia, two men named by Montenegrin outlet Vijesti as Danilo B. and Slobodan Đ. were arrested on 11 June near Subotica, close to the Hungarian border, and German media have described them as one-off Russian agents suspected of planning sabotage in Germany. A court in Subotica has extended their detention to 9 December while German investigators examine possible links between the pair and suspects in the Leipzig case, Vijesti reported. Prosecutors in Subotica are separately investigating seven people suspected of acquiring and storing explosives, explosive devices and drones in Serbia for transport to European Union countries.

The device found at Leipzig also matches DNA traces previously identified in connection with a fire at a DHL logistics centre in Leipzig on 20 July 2024, German newspaper Bild has reported, according to Vijesti. The German government has said it holds Russia responsible for the Leipzig airport attack attempt, which Moscow has denied. The Russian embassy in Berlin said it "firmly rejects the baseless allegations" of Russian involvement in the Leipzig incident or other sabotage activities.