Adversary Intelligence — 2026-09-13

German Intelligence Links GRU to Foiled Drone Bomb Plot at Leipzig Airport Targeting Ukrainian Cargo Aircraft

BLUFGermany's naming of a GRU officer and a linked Belarusian operative makes a formal indictment likely within 90 days, converting political attribution into a judicial record Moscow cannot easily dismiss.

German investigators have identified two suspects in the August 4 drone-bomb attempt on a Ukrainian An-124 at Leipzig/Halle airport, citing secret investigation files obtained by Welt am Sonntag 12: Russian national Oleg Le., attributed to the GRU military intelligence agency and believed to have organized logistics, and Belarusian national Andrei Ka., suspected of carrying out the attack 34. Le. entered Germany via Turkey and departed through Berlin-Brandenburg airport for Serbia before returning to Russia; investigators knew of his GRU ties on entry but did not place him under surveillance 45. DNA on glove remains at the drone's antenna control site matched traces on file in Finland and Lithuania tied to Ka., whom Polish authorities separately link to a 2024 hardware-store fire in Łódź treated as sabotage 36. About 1.8 kg of Semtex, packed in a vegetable can, failed to detonate against the fueled Antonov after a detonator tore loose; German officials cited these findings as the basis for publicly blaming Russia on September 1 and closing Russia's Bonn consulate and Berlin cultural center, prompting Moscow to shutter Germany's St. Petersburg consulate and the Goethe-Institutes 23.

Analysis
An arrest warrant or indictment against Le. or Ka. is likely within the next 90 days, now that Berlin has moved from a diffuse "Russian services" attribution to a named, prosecutable GRU officer. DNA linkage, travel records, and the political momentum from the September 1 attribution and consulate closures all point the Federal Prosecutor General toward formalizing the case. Moderate confidence reflects reliance on a single leaked-document source not yet corroborated by court filings. Neither suspect is in German custody, so any warrant would be symbolic rather than enable extradition, but it would lock the GRU attribution into a judicial record Moscow cannot dispute through diplomatic channels alone.
10 sources
  1. Germany Identifies Russian Agent Behind Drone Attack, WamS Says - Bloomberg
  2. Drohnenvorfall in Leipzig: Ermittlungen führen offenbar direkt zum russischen Militärgeheimdienst GRU - Tagesspiegel
  3. A Russian intelligence operative and a Belarusian petty criminal: Germany names the Leipzig bomb-drone suspects - Euromaidan Press
  4. Mutmaßlicher Leipzig-Attentäter wohl wieder nach Moskau geflohen - t-online.de
  5. German security officials reportedly suspect Russian GRU agent helped plan failed Leipzig airport attack - The Times of Israel
  6. Drone attack on Leipzig: clues apparently point to Russian intelligence service - Euronews
  7. Sabotage: Deutsche Behörden identifizieren russische Agenten hinter Drohnenangriff von Leipzig - Welt am Sonntag
  8. German intelligence services identify organizers of attempted explosion in Leipzig - DW - Ukrinform
  9. Drohne mit Sprengstoff am Flughafen Leipzig: Was wir zum mutmasslichen Anschlag wissen - Neue Zürcher Zeitung
  10. Ermittler identifizieren mutmasslichen GRU-Logistiker hinter Drohnenanschlag auf Leipzig - Welt am Sonntag (Die Welt)

View in full brief →

UNCLASSIFIED // OPEN SOURCE