German investigators have identified two men over the explosives-laden drones found at Leipzig/Halle airport, are looking for at least four people in total.
One is a Belarusian citizen holding a Russian passport, tied to the case by DNA recovered from one of the drones, from the inside of the tin packed with explosives and from a signal-amplifying antenna found near the airport. His genetic profile matched records held in Lithuania and Finland, where he had been prosecuted over other offences. He entered the Schengen area on an Italian tourist visa issued in Minsk in late April.
The second man was born in Russia and travels on a Latvian passport. Investigators describe his role as logistician and instructor and say he has links to Russian intelligence services. He landed at Berlin Brandenburg airport in late July, drove a rental car towards Leipzig and flew out two days before the drone was found on the apron. Investigators established the movements and mobile numbers of the group by radio direction finding.
The Federal Prosecutor General took the case from Dresden prosecutors on 6 August 2026 and is investigating two offences: attempted causing of an explosion under section 308 of the criminal code, read with sections 22 and 23, and dangerous interference with air traffic under section 315, paragraph 1, number 4. That release named no suspect, no state and no intelligence service. It said the intent had been to cause an explosion on the airport grounds on the evening of 4 August "by means of a drone fitted with professional explosive and a detonator". No arrest has been announced in the four weeks since.
Federal police specialists removed the detonator with a bomb-disposal robot on the night of 4 August. Security accounts reported to German media put the charge at up to 800 grammes of Semtex with a PETN base, sealed inside a resealed food tin; prosecutors have not confirmed the composition. The airframe was purpose-built, with a release mechanism and two SIM cards. Flight operations stopped and close to 20 DHL freighters were diverted.
A second drone was recovered on 14 August in a field at Kabelsketal on the western edge of the airport, and about 50 grammes of suspected hexogen were found nearby the following day. The antenna at Kursdorf, north of the airport, was taped to a tree with electronic components suspected of being drone control equipment, alongside a patch of scorched ground and charred metal fragments near where residents reported a loud bang. A third aircraft is believed to have struck the engines of a DHL freighter during a go-around on the night of 4 August and to have been destroyed; one later security assessment reported by German media put that collision down to a bird, and no wreckage has been produced either way.
Bild and Die Zeit reported on 11 August that a DNA trace from the failed drone also matched material recovered after the arson attack of 20 July 2024 on the DHL logistics centre at the same airport. That 2024 parcel ignited on the ground rather than in the air because the cargo aircraft carrying it was delayed. Five men went on trial at Vilnius Regional Court on 17 April 2026 over the 2024 parcel campaign, in which four packages were despatched from Vilnius through DHL and DPD to addresses in Poland and the United Kingdom. Lithuanian prosecutors describe the five as couriers and intermediaries rather than organisers, say the operation was directed by Russian citizens linked to the GRU and say those organisers are outside Lithuanian jurisdiction. Five more suspects are wanted on international warrants.
Leipzig/Halle carries Antonov Airlines and is the hub for NATO's Strategic Airlift International Solution, which guarantees nine member states access to An-124 outsized-cargo lift. The drone on the apron sat beside a Ukrainian An-124 loaded with military supplies. The airport recorded 18 drone incidents between January and August 2026.
The expulsions
Alexander Dobrindt, Germany's interior minister, said on 1 September 2026 that police investigations, the pattern of the offences and intelligence findings together established Russian responsibility, and that the device carried "components, explosives and detonator that are known to us from other Russian hybrid operations". Johann Wadephul, the foreign minister, said the Russian leadership had "decided deliberately to do significant damage again" to relations between the two states, and ordered Russia's consulate-general in Bonn closed from 18 September. The German government also ordered the Russia House cultural centre in Berlin closed by terminating its lease, proposed adding named Russians to the EU hybrid-threats sanctions list, tightened entry controls on Russian nationals and said it would press harder on shadow-fleet tankers.
The Russian embassy cancelled all remaining consular appointments and shut the Bonn post on 1 September, 17 days early, telling applicants the closure was a direct result of the German eviction order. Bonn held the last Russian consulate-general on German territory, so Russian citizens in Germany now travel to the embassy in Berlin.
Bernd Finke, the German chargé d'affaires, was summoned to the Russian foreign ministry on 2 September and left about an hour later. The ministry said Russia resolutely rejects what it called completely trumped-up accusations, that the closures were a step towards the final destruction of bilateral relations and that the German actions "will receive a strong response". Deputy Foreign Minister Alexander Grushko said Russia would respond as it deems necessary and that the process would be very swift. Sergey Nechayev, the Russian ambassador in Berlin, called the German measures an unprecedented escalation. Maria Zakharova, the foreign ministry spokeswoman, called the German findings a "far-fetched and contrived pretext". President Vladimir Putin said "the proof has been planted" and said the German government was deflecting from domestic political problems.
The European response
Kaja Kallas, the EU high representative for foreign affairs, told a meeting of EU foreign ministers on 2 September: "It is clear that it has all the hallmarks of state-sponsored terrorism." Ursula von der Leyen said Leipzig marks a new escalation on European soil directly attributed to Russia, and that every loophole Russia exploits is one the EU must close. Mark Rutte, the NATO secretary general, said Russia's attempts to intimidate the alliance are futile and will fail. Jean-Noël Barrot, the French foreign minister, said: "We won't allow an act of such gravity without consequences." France, Belgium, Portugal, the Netherlands and the EU summoned Russian ambassadors.
The European External Action Service has proposed visa bans and asset freezes on 1,600 Russian individuals and companies in the defence sector, for adoption next month, alongside a 12-month rollover of about 3,000 existing listings that Slovakia alone opposes while seeking the removal of Russian businessmen from the lists. Curbs on Schengen tourist visas for Russians are under discussion and Mediterranean member states have resisted them on tourism grounds. Belgium has blocked earlier attempts to use frozen Russian assets for Ukraine, citing exposure to retaliation. José Manuel Albares, Spain's foreign minister, said the southern land borders of the EU matter as much as the eastern ones.
Rearmament
German government sources told t-online that Ukraine will receive further anti-aircraft missiles for IRIS-T systems in September and several thousand strike drones after that, and that intelligence cooperation with the Ukrainian government will be deepened. The two governments are coordinating on protection of critical infrastructure from drones, action against Russia's shadow fleet and further sanctions. Oleksii Makeiev, Ukraine's ambassador in Berlin, welcomed the announcement.
The German cabinet approved a bill on 13 August 2026 giving the foreign intelligence service, the BND, powers to hack foreign systems, disable hostile servers and sabotage supply chains and drone and weapons factories abroad, and giving the domestic service, the BfV, powers to block and reroute data, alter transmissions, corrupt stored data, disable equipment and spread false information to extremists inside Germany. Dobrindt said the bill involved "expanding the technical capabilities of the intelligence services and granting them active, operational powers". The reform was prompted by a Federal Constitutional Court ruling requiring intelligence powers to be calibrated to their intrusiveness, and civil liberties groups have said they will challenge it on the ground that the court allowed the services lower thresholds than the police partly because they had no such powers.
Jänschwalde and Bergheim
Explosive devices described by investigators as rocket-like objects with a propellant charge were found at the substation serving the Jänschwalde lignite power station in Brandenburg on the morning of 1 September 2026. More than a dozen were recovered and one made contact with the high-voltage lines. That evening a deliberate short circuit was caused at the Bergheim substation near Cologne, where cable was thrown across overhead lines; six launch devices designed to lift wire onto the conductors with a pyrotechnic charge were found in a nearby cornfield. Five lignite units totalling 4,200 megawatts went offline, and two were back by the following afternoon.
Herbert Reul, interior minister of North Rhine-Westphalia, said: "Critical infrastructure is the Achilles' heel of our society. Perhaps we haven't taken this issue seriously enough." Jan Redmann, Brandenburg's interior minister, said investigators could not rule out the possibility that foreign powers were behind it. Police in both states are treating left-wing extremists as an equally open line of inquiry. No suspect has been named in either case.
Airspace
Between 19 and 23 drones entered Polish airspace on the night of 9 to 10 September 2025, the largest single violation of NATO airspace since the alliance was founded. Polish F-16s, Dutch F-35s, German Patriot batteries, Italian airborne early-warning aircraft and a Belgian tanker took part in the response, and at least four drones were shot down. Poland invoked Article 4 of the North Atlantic Treaty. Deputy Prime Minister Radoslaw Sikorski called it "an attack not only on the territory of Poland".
NATO launched Operation Eastern Sentry on 12 September 2025 with Danish F-16s and a frigate, French Rafales, German Eurofighters, Italian F-35s and an air defence missile system stationed in Estonia, British Eurofighters and a Spanish Eurofighter. Rutte said drones had violated allied airspace in Romania, Estonia, Latvia and Lithuania. The mission has no stated end date.
Three Russian MiG-31 fighters flew for close to 12 minutes inside Estonian airspace near Vaindloo island on 19 September 2025, without flight plans, transponders or radio contact. Estonia said it was the fourth violation of its airspace that year and invoked Article 4 in turn.
Copenhagen airport closed for roughly three hours on 22 September 2025 after drone sightings, and Aalborg closed days later. Oslo Gardermoen shut twice inside three days. Munich closed twice between 2 and 4 October 2025, disrupting about 3,000 passengers. Brussels and Liege airports closed on 4 November 2025.
Romania's defence ministry recorded 23 airspace violations by Russian drones in 2026 by 17 August, four drones shot down over Romanian territory, 27 finds of drones or drone fragments on the ground and 54 Russian attacks on targets near the Romanian border. Two Spanish F-18s scrambled from Mihail Kogalniceanu air base on 25 August 2026 after a drone crossed near Vylkove. A count published by Newsweek on 25 August putting the 2026 figure at 26, within a total of 43 since February 2022, could not be reconciled with the ministry's own tally.
144 incidents, and what survived investigation
The International Institute for Strategic Studies published "Russia's UAV Campaign Over Europe" on 2 July 2026, covering 144 incidents in 13 countries, 12 of them NATO members plus Ireland, between August 2024 and February 2026. It assessed as highly likely that Russia ran a coordinated drone campaign using vessels linked to its shadow fleet, and named the Hav Dolphin, IMO 9073854, which docked at Hull during the British sightings of November 2024 and was investigated by German and Dutch authorities over incursions in the spring of 2025, and the Seasons I, IMO 9308950, which passed eastbound through the Dover Strait near US and British military sites during the same November 2024 period.
No launch was observed, no command traffic was intercepted, no wreckage was recovered and no forensic link ties any drone to any ship, the same report said, and its authors wrote that there is no smoking gun. Belgian military intelligence judged about 42 of 250 reported sightings over military barracks to be genuine, out of 558 reports filed between September 2025 and January 2026, and Theo Francken, the defence minister, acknowledged that footage he had shared showed a police helicopter searching for a reported drone. Copenhagen police closed a nine-month investigation without confirming any drone activity at the airport, although the Danish armed forces separately concluded from soldiers' observations that drones had overflown military sites. German searches of the Hav Dolphin found nothing.
Swedish forces jammed a drone launched from the Russian signals-intelligence ship Zhigulevsk near the French carrier Charles de Gaulle in the Oresund in February 2026. Pal Jonson, Sweden's defence minister, said the drone could be of Russian origin.
Undersea cables and the shadow fleet
NATO defence ministers counted 11 damaged Baltic Sea cables in roughly 15 months when they launched the Baltic Sentry patrol mission on 14 January 2025. The Chinese carrier NewNew Polar Bear severed the Balticconnector gas pipeline and two telecoms cables on 8 October 2023. The Chinese bulk carrier Yi Peng 3 was linked to two fibre-optic cuts about 100 nautical miles apart in November 2024. The Cook Islands-flagged tanker Eagle S, part of Russia's shadow fleet, was linked to the severing of the Estlink 2 power cable and four telecoms lines in December 2024.
A Finnish court dismissed the case against the Eagle S captain and crew in October 2025 after prosecutors failed to prove intent. A Swedish inquiry found no conclusive evidence that Yi Peng 3 dragged its anchor deliberately, and a Swedish prosecutor ruled the Vezhen cable breach of January 2025 accidental. Norwegian police detained the Norwegian-flagged, Russian-crewed Silver Dania at Tromso on 30 January 2025 at Latvia's request over damage to a fibre-optic cable between Latvia and Sweden, and released it without charge. Finnish police seized the cargo ship Fitburg on 31 December 2025 over damage to the Elisa cable between Helsinki and Estonia and arrested two of its 14 crew; that investigation continues.
Arson, parcel bombs and rail sabotage
Six men were sentenced at the Old Bailey on 24 October 2025 over an arson attack on two east London warehouses storing Ukrainian humanitarian supplies, in the first prosecution brought under the National Security Act 2023. Dylan Earl received 23 years, Jake Reeves 13, Nii Mensah 10, Ashton Evans and Jakeem Rose nine each and Ugnius Asmena eight. Counter Terrorism Policing said Earl reached Wagner Group handlers through Telegram accounts and that the fire caused about £1 million of damage. A parallel arson attack hit the same logistics company's warehouse in Madrid.
Incendiary devices were placed inside DHL and other parcel shipments in Germany, Poland and the United Kingdom in 2024, including a depot fire in Birmingham. Lithuanian authorities said Russian military intelligence directed the plot, which Western officials assessed was a rehearsal for igniting devices aboard cargo aircraft bound for North America. Eurojust said on 6 March 2026 that 22 suspects had been identified as acting for Russian military intelligence in the parcel investigation, recruited from Russia, Latvia, Estonia, Lithuania and Ukraine through online messaging, often in precarious financial positions and paid in cryptocurrency.
A C-4 device destroyed a section of the Warsaw to Lublin and Hrubieszow railway near Mika, about 100 km south-east of Warsaw, at about 21:00 on 16 November 2025. The damage went unnoticed until a following train reported track irregularities at 07:40 the next morning. A metal bracket was wedged into the track assembly near Pulawy the same weekend, bringing down overhead wires above a passenger train carrying 473 people. Prime Minister Donald Tusk called the sequence perhaps the most serious national security situation in Poland since the start of the full-scale war in Ukraine. Polish prosecutors accused two Ukrainian nationals, Oleksandr K., previously convicted of sabotage by a court in Lviv, and Yevhenii I., a resident of the Russian-occupied part of Donetsk region, of acting for Russia's Federal Security Service. Both crossed into Belarus within hours. Interpol issued red notices in December 2025, Poland has sought their extradition from Belarus and prepared European arrest warrants, and neither man is in custody. Poland deployed 10,000 soldiers to guard railways and transport hubs under Operation Horyzont from 21 November 2025.
Poland formally accused Russian intelligence on 11 May 2025 of ordering the May 2024 fire that destroyed the Marywilska shopping centre in Warsaw, and named two Ukrainian nationals as accused participants. Lithuanian prosecutors said on 17 March 2025 that Russian military intelligence organised the May 2024 arson at an IKEA warehouse in Vilnius, and moved to try the case as a terrorist act. Lithuanian prosecutors charged six more people on 16 January 2026 over a 2024 attempt to burn a factory supplying radio-wave scanners to Ukrainian forces, defendants holding Spanish, Colombian, Cuban, Russian and Belarusian citizenship who were paid between €5,000 and €10,000. Saulius Briginas of the criminal police bureau said the operation was coordinated from Russia by people linked to the GRU.
Five weapons plants supplying Ukraine burned between March and August 2026: Archer at Pardubice in the Czech Republic on 20 March, electrical installations feeding MBDA and KNDS sites in the Cher department of France on the night of 6 and 7 April, the EMCO shell plant near Belitsa in Bulgaria on 10 August, KNDS Ammo Italy at Colleferro on 13 August and Milrem Robotics in Tallinn on 15 August. Czech police have charged six people with terrorism offences. Estonian prosecutors said the Tallinn fire was deliberate and premeditated and three suspects were detained in Latvia. Guido Crosetto, Italy's defence minister, said it did not appear to anyone that the Colleferro blast could be anything other than an internal problem. French investigators have made no attribution. No government has attributed any of the five to Russia.
US and German intelligence services disrupted a Russian plot in 2024 to kill Armin Papperger, chief executive of Rheinmetall, Germany's largest ammunition producer.
Recruitment and prosecutions
Poland's Internal Security Agency opened 48 espionage investigations in 2025 against 21 in 2024, and has charged 82 people with espionage over two years. Between 1991 and 2023 the agency recorded 69 such investigations in total. It said Russia is moving away from cheap Telegram-recruited operatives toward more professional sabotage units.
Poland has detained 32 people since February 2022 on suspicion of acting for foreign intelligence services, including Polish, Russian, Ukrainian, Belarusian and Colombian nationals. A Czech court sentenced a Colombian national to eight years in June 2025 for arson at a bus depot and for planning an attack on a shopping mall.
A court in Stuttgart convicted Yevhen B., a 30-year-old Ukrainian citizen, in August 2026 of espionage and conspiracy to commit arson, and sentenced him to one year and three months, which he had already served on remand. Prosecutors had asked for between two years nine months and four years three months. The court found he had scouted sabotage targets and shipped GPS trackers from Germany to Ukraine in March 2025 to map delivery routes for incendiary devices designed to ignite in transit. Two younger co-defendants were acquitted. Patrick Heinemann, writing in Legal Tribune Online, said a diplomatic response requires only sufficient probability of Russian responsibility while a conviction requires proof to the criminal standard, and that German security agencies have concluded the throwaway-recruit model makes convicting the principals close to impossible.
The Netherlands raised its national threat assessment in April 2026 to the highest level in 80 years, citing Russia and China. Norway's police security service said in February 2026 that Russia may target Norwegian military sites and supply routes to Ukraine. Estonia and Lithuania published annual assessments in 2026 built on the same finding.
Law and accountability
Sabotage of civilian infrastructure, arson against humanitarian supplies and attempted killings on the territory of another state breach the prohibition on the use of force in Article 2, paragraph 4 of the UN Charter and, where committed by state agents, engage state responsibility under customary international law. Damage to submarine cables outside territorial waters is separately criminalised by Article 113 of the UN Convention on the Law of the Sea, which obliges flag states to prosecute. Deliberate interference with civil aviation navigation engages the Montreal Convention of 1971.
Every conviction secured in the United Kingdom, Poland, Lithuania, Czechia and Germany has been of a proxy hired through a messaging app or a criminal intermediary. No serving officer of Russia's military intelligence directorate has been convicted in a European court for any of the incidents above.
Citizens in EU states can press their governments to list named Russian intelligence officers under the EU hybrid-threats sanctions regime, adopted on 8 October 2024, which allows designation of individuals rather than only entities and which as of September 2026 carries 80 individuals and 20 entities. Cable and pipeline owners can bring civil claims in flag-state and coastal-state courts, as Finland did against the Eagle S owner before the criminal case collapsed. National prosecutors can charge sabotage as terrorism, as Lithuania and Czechia have done, which raises sentences and unlocks cross-border evidence-sharing under EU judicial cooperation instruments. Member states issuing Schengen tourist visas to Russian nationals can publish their refusal rates and the checks applied, which Italy has not done for the visa granted in Minsk in April to a man whose DNA German investigators say they recovered from a bomb.
