Adversary Intelligence — 2026-08-14

DNA Links Leipzig Airport Drone Attack on NATO An-124 to Suspected GRU Parcel Bomb Campaign

BLUFForensic linkage to the 2024 GRU parcel-bomb campaign marks NATO's SALIS airlift network as a persistent Russian target set, though German prosecutors are unlikely to name a suspect within 90 days.

German investigators recovered a DNA trace from the explosive drone that struck a parked Antonov An-124 at Leipzig/Halle Airport on the night of August 4-5, matching a trace registered after the July 2024 DHL logistics center firebombing at the same airport, according to Bild and Die Zeit reporting cited by AeroTime, Euronews and ORF.at 123. The trace has not been matched to a named individual but returned a hit in the European DNA database registered in Lithuania 12, where five men, citizens of Lithuania, Russia and Ukraine, have stood trial at Vilnius Regional Court since April 17 over four parcels mailed from Vilnius in July 2024, part of the campaign that Eurojust and Lithuanian prosecutors have linked to Russia's GRU 12. CCTV reviewed by investigators shows the purpose-built drone, fitted with a release mechanism, two SIM cards and roughly 600 grams of Semtex packed in a sealed tin, striking the aircraft's wing near the fuel tank around 7:30pm before falling to the ground with its detonator unexploded; an airport employee recovered the device about four hours later near the south runway 123. Germany's federal prosecutor took over the case on August 6 and is investigating attempted explosion and endangerment of air traffic 1, while the Russian embassy in Berlin has called the incident a "provocation directed against Moscow" 2.

Analysis
The forensic link converts Leipzig from a discrete sabotage incident into a second data point in an ongoing GRU-linked parcel and drone campaign against NATO logistics nodes, raising the likelihood that SALIS airlift infrastructure remains a live target through the fall shipping season, though a shared DNA trace could also reflect reuse of the same bomb-making cell's equipment or personnel pool rather than centralized GRU tasking. Federal prosecutors are unlikely to publicly identify or charge a named suspect within the next 90 days, since the DNA hit remains unmatched to an identity and Berlin has so far declined even to attribute the attack to a state actor, leaving SALIS partner nations to fund airfield security upgrades without a named actor to justify escalation. Confidence is low, given Bild's original account anchors the reporting, with Euronews, ORF.at and AeroTime relaying its findings without independent verification.

4 sources

DNA links drone attack on An-124 in Leipzig to suspected GRU plot - AeroTime
Explosive drone at Leipzig airport: Whose DNA was found on the device? - Euronews
Bericht: DNA-Spur bei Sprengdrohne in Leipzig - ORF.at
DNA-Spur bei Drohne auf Flughafen Leipzig gefunden - Bild