Suspected Russian spy behind drone attack in Leipzig

German security authorities have identified with a high degree of probability a Belarusian citizen and a Russian national linked to the country’s military intelligence services as the main suspects in the August drone attack on the Leipzig-Halle airport, according to two senior German security officials and confidential documents seen by Welt. 

Welt, which like POLITICO is part of the Axel Springer Global Reporters Network, has reviewed confidential investigative files that have not previously been made public and spoke with four senior security officials from different federal and state agencies. The officials, like others cited in the article, were granted anonymity because they were not authorized to speak publicly. 

German agencies involved in the investigation include the Federal Office for the Protection of the Constitution, the Federal Criminal Police Office, the Federal Intelligence Service and other German agencies. 

Due to suspected links to other sabotage cases in Europe, the German authorities are coordinating with investigators in Lithuania, Poland, Latvia and Finland. They are also in contact with the U.S. Federal Bureau of Investigation, according to the confidential documents.

Welt is not naming the suspects in line with German privacy law. Based on the evidence against them, Foreign Minister Johann Wadephul and Interior Minister Alexander Dobrindt held Russia responsible for the attack during a joint press conference on Sept. 1. Russia has denied any involvement.

Airport attack

The Leipzig-Halle airport was attacked by an explosive-laden drone on the evening of Aug. 4. The drone was discovered near a Ukrainian Antonov cargo aircraft and safely defused. Investigators found debris from two additional drones near the airport.

German security authorities believe the Russian suspect to be affiliated with the GRU, Russia’s military intelligence service, and to have been responsible for planning and the logistics of the attack, according to classified documents reviewed by WELT and one of the senior security officials. 

The Russian suspect entered Germany via Turkey through the Berlin-Brandenburg Airport. He later departed from the airport bound for Serbia, and is now back in Russia. Investigators were already aware at the time of his entry that the Russian was associated with the GRU. Nevertheless, he was not put under surveillance after his arrival, according to a high-ranking German security official, because the agencies had limited resources and did not expect him to be planning an imminent attack. 

The Belarusian suspect entered the Schengen Area, the border-free travel zone encompassing 29 European countries, via Latvia on July 28, about a week before the incident. Authorities believe he is a “disposable agent” — a criminal hired to carry out acts of sabotage. The Russian national is said to have organized the explosives and directed the Belarusian suspect, according to a senior German federal security official. 

Some 1.8 kilograms of the explosive Semtex was to be used across all three drones — about 600 grams per drone — according to the high-ranking German security official. The Antonov aircraft, which was the target of the attack, was fueled with approximately 25,000 liters of jet fuel.

Two of the senior security officials, both directly involved in the investigation, said that if the charge had detonated, it would have triggered a massive explosion and destroyed parts of the airport. Previously unseen surveillance camera footage obtained by Welt shows the drone lying right next to the Antonov aircraft. According to authorities, the explosive was concealed inside a food can. The explosion did not occur because a detonator broke off.

One day after the attempted attack, police officers found an antenna structure secured with tape in a tree near the airport. It is believed to have been used to control the drones, according to the confidential documents. On the structure, forensic technicians found remnants of a glove with traces of DNA previously recorded in Finland and Lithuania. The Belarusian suspect has a criminal record in those countries, according to one of the senior security officials (in Finland, for example, he was charged with theft, among other offenses).

The Polish authorities also believe the suspect was involved in a fire at a home improvement store in the city of Łódź in the summer of 2024, according to a senior security official. (The Łódź public prosecutor’s office has likewise classified the incident as sabotage.) German investigators view the fact that he was also involved in the Leipzig attack as further evidence of Russian involvement.

According to the high-ranking German security official, the explosives used in Leipzig were transported to Germany via Bulgaria and Serbia. Investigators believe they were transported in hidden compartments in trucks and subsequently cached underground. Police found several possible hiding places near Leipzig airport after analyzing data from a rental car used by the suspects.

The confidential police documents also refer to a concrete slab with two handles that was discovered near a pedestrian bridge south of the airport, in the city of Schkeuditz. Authorities believe it had provided access to a hidden storage site. Shortly thereafter, police found another suspected hideout north of the bridge; both storage sites were empty. Investigators also located a hideout in the city of Merseburg, part of the Halle-Leipzig area. According to the police documents, the Russian suspect may have temporarily stored the explosives there.

An examination of the drone that landed on the airport runway revealed it to be a homemade device made from readily available parts, some of which were manufactured using a 3D printer. The four motors were a Chinese brand that is also sold in Russian online stores specializing in “combat technologies.” The food can filled with Semtex was attached to the drone with a mount, according to the classified police documents. 

Alexander Dinger is head of investigations at WELT, a publication owned by Axel Springer, POLITICO’s parent company, He focuses on national security and police investigations. Ibrahim Naber is a foreign correspondent for WELT who has been reporting from Ukrainian frontline regions since 2022. Lennart Pfahler is an investigative reporter at WELT, focusing on national security and extremism.

The Axel Springer Global Reporters Network harnesses the resources of the company’s newsrooms to publish ambitious scoops, investigations, interviews, opinion pieces and analysis. It allows journalists — including those from POLITICO, Business Insider, WELT, BILD, The Telegraph, Onet and Fakt — to collaborate on major stories for an international audience of hundreds of millions across platforms: online, print, TV and audio.