U.S. intelligence links Leipzig drone attack to Putin-ordered sabotage campaign

German investigators trace drone communications to servers used by the GRU

U.S. intelligence agencies say the failed early-August drone attack on an Antonov cargo plane at Leipzig-Halle Airport was one of the opening shots in a stepped-up Russian sabotage campaign ordered directly by Russian President Vladimir Putin, according to European officials briefed on the findings. The cargo plane was used to carry military assistance to Ukraine. German officials say Russian military-intelligence agents piloted at least three explosive-packed drones positioned around the airport; one struck the Antonov freighter without detonating, another collided with a different plane, and a third exploded near the airport perimeter. Investigators said the attack, had it worked as planned, could have caused mayhem and casualties at one of Europe’s most important air-cargo airports.

European officials briefed on the findings said the escalation came as Ukrainian forces, with European support, had largely fought the Russian army to a standstill on the ground over the past year, inflicting heavy losses and preventing significant territorial gains. Kyiv was increasingly hitting targets deep inside Russia, including refineries and warehouses of Russia’s largest e-commerce firm. The officials said there was growing frustration in Moscow because neither the fighting nor negotiations with Washington were getting Ukraine to agree to the concessions Putin wanted.

Thomas Graham, a former senior U.S. official now involved in informal talks with the Kremlin, said, “The Kremlin is disappointed that the talks with the United States have not led to the rapid normalization of relations they had hoped for.” Investigators said the broader campaign sought to position agents, explosives and weapons across Europe to strike targets supporting Ukraine and sow chaos that could strengthen political opposition to military aid for Kyiv.

Aides to Chancellor Friedrich Merz said Berlin would have considered invoking NATO’s Article 5 collective-defense provision if the Leipzig attack had caused large numbers of casualties. Article 5 commits alliance members to assist an ally subjected to an armed attack, though a response could range from diplomatic support to a military strike. The provision has been invoked only once before, after the Sept. 11, 2001 terrorist attacks.

Since the Leipzig attack, European countries have seen a sharp uptick in so-called gray-zone assaults. Arsonists struck drone manufacturers in Estonia and Poland in August, Slovak authorities said they thwarted a planned arson attack on a Ukrainian drone factory, and Poland, Lithuania and Bulgaria have all reported sabotage attacks on Starlink stations. A series of drone attacks on commercial ships has occurred in the Black Sea near the waters of NATO members Bulgaria and Romania.

European leaders have publicly warned about the risks and privately debated how best to respond. Merz said, “Russia is waging a war on Europe; not just on Ukraine, but also against us.” Secretary of State Marco Rubio warned that the escalation could spill into NATO countries and “quickly turn what is a war between two countries into a much broader and far more dangerous regional conflict.” Russia has denied involvement in sabotage operations in Europe, and Putin responded to Berlin’s accusations by asking, “Where is the evidence?” The Kremlin did not respond to a request for comment.

CIA Director John Ratcliffe traveled to Moscow in late August to revive negotiations and warn Russia against escalating its attacks on European allies. Afterward, he personally warned European intelligence counterparts and selected political leaders that Moscow was intensifying sabotage operations, according to people who received the warnings. The CIA did not respond to a request for comment.

Earlier this month, President Trump said he had reached a deal with Putin to provide diesel fuel to the U.S. and global markets to ease prices. Last week, he halted sanctions that were set to be imposed on Russia under a bipartisan bill, drawing criticism from members of Congress. Trump said in a social-media post Sunday his decision on Russia was aimed at keeping Russia at the bargaining table and out of the war with Iran. The White House did not respond to a request for comment.

Western officials said Russia’s clandestine attacks were being led by a branch of Russian military intelligence, or GRU, known as the Special Tasks Service, or SSD. The SSD was formed in 2023 by merging some of Russia’s most lethal clandestine units under a mandate to wage covert warfare against Europe. It is commanded by Col. Gen. Andrey Averyanov, a veteran of clandestine warfare whose operatives have been linked to assassinations, poisonings and bombings across Europe, according to Western officials.

Western intelligence officials said they had traced the Leipzig attack to Col. Denis Smolyaninov, one of Averyanov’s department chiefs who is under European Union and British sanctions for directing Russian covert operations in Europe. Western intelligence had previously identified Smolyaninov as one of the commanders behind a plot to smuggle incendiary devices into the DHL parcel network. Investigators believed the operation was ultimately intended to bring down civilian airliners flying to Britain and North America.

The Leipzig operation involved at least three drones packed with military-grade Semtex explosives and positioned in bushes and beneath trees outside the airport perimeter, investigators said. The drones carried German 5G mobile-phone cards and could be piloted remotely over the internet. German cyberintelligence officials traced their communications to servers previously used by the GRU. Investigators said they had uncovered networks smuggling explosives, drones and weapons into the European Union, along with safe houses and concealed underground caches near airports, arms manufacturers and other potential targets.

German investigators believe the Leipzig operation’s ground logistics were coordinated by Oleg Levushkin, a former Russian military officer recruited by the GRU following a criminal conviction. Levushkin directed several Belarusian operatives who transported explosives across borders, assembled the drones and positioned them for the attack, according to investigators and intelligence officials. The network used Serbia as a logistics hub to move modified drones and explosive devices toward Germany. Military-grade Semtex was smuggled in resealed food cans fitted with detonators, and added steel plates turned the devices into fragmentation bombs designed to scatter deadly shrapnel, investigators said.

Serbian authorities arrested seven suspects, including a dual Russian-Serbian citizen, accusing them of belonging to an organized group that procured and stored explosives and drones before shipping them into European Union countries, Serbian prosecutors said. Two days before the Leipzig attack, Levushkin and at least one Belarusian accomplice flew from Germany to Serbia and onward to Russia.

After the failed attack, a Kremlin official serving as a back channel to the German government contacted his counterpart in Berlin and warned that Leipzig would not be the last attack, according to officials familiar with the exchange.

MSI previously reported that Germany had formally accused Russia of orchestrating the failed Leipzig drone plot and vowed retaliation. The new intelligence findings place that plot within a broader campaign and add operational detail about the GRU unit and its European logistics network; Russia continues to deny involvement.