Late on a Tuesday night, security teams at Germany’s Leipzig Airport scrambled to respond to an alarming discovery: a small quadcopter drone carrying explosives, spotted floating near several Ukrainian Antonov cargo planes parked on the tarmac. The discovery triggered an immediate lockdown of one runway, with a specialized bomb disposal robot deployed to safely disarm the device, while aviation authorities launched a full investigation into the incident.
The Ukrainian cargo planes parked nearby carried bold national symbols: their blue and yellow striped livery matching Ukraine’s flag, and one aircraft bore the message “Be Brave Like Kherson,” a tribute to the embattled southern Ukrainian frontline city. Separately, a DHL cargo jet approaching Leipzig reported colliding with an unidentified object mid-climb shortly after the drone was found, and investigators are still working to confirm if this incident involved a second unexplained device.
Germany’s interior minister has sounded the alarm over what he calls a “new level of danger,” noting the attack may have links to foreign actors. While no conclusive evidence currently ties the drone directly to the Kremlin, and Moscow has repeatedly denied any involvement in such hostile acts across Europe, experts point to a well-documented pattern of Russian-linked hybrid operations on the continent that make Moscow a key suspect.
The BBC has obtained exclusive access to court documents connected to a 2024 cross-border terror plot that offers chilling context for the current incident. In that case, prosecutors in Lithuania and Poland are currently trying more than a dozen men linked to a Russian military intelligence network that smuggled explosives and drone components across the European Union. According to the case files, the network hid 6kg of TNT-equivalent RDX explosive in tins of sweetcorn and chopped tomatoes, concealed detonators inside consumer headphones, and transported drone parts purpose-built to carry explosive payloads. Smugglers moved these materials across the Baltic region via secret drop-offs in forests, cemeteries, and roadside locations, before delivering finished drone kits to safe houses in Germany.
One charged defendant, Ukrainian national Vladyslav D., who has pleaded not guilty to all charges, detailed to investigators how he carried out multiple smuggling trips in 2024 for a handler he knew only as “Warrior,” receiving more than $2,000 in cryptocurrency for his work. His assignments included retrieving hidden explosives and drone parts from pre-coordinated drop spots, including a bag of waterlogged headphones on the edge of a Lithuanian forest and drone propellers buried under plastic flowers in a cemetery, before transporting the materials to Germany for final delivery. The intended targets for these 2024 shipments were never identified.
To date, nearly two dozen suspects have been charged with terrorism offenses in connection with the 2024 plot, but key handlers remain at large, believed to be hiding in Russia. Authorities have not confirmed whether the entire network was dismantled or if all cached explosive and drone materials were recovered. While there is still no definitive link between the 2024 network and the 2026 Leipzig drone discovery, German media reports confirm the explosive found on the drone was Semtex, a plastic explosive that contains RDX – the same explosive material seized from the 2024 smuggling ring.
Explosives experts note that even a small drone-carried bomb would be unlikely to cause catastrophic damage to an aircraft unless fitted with fragmentation, but security analysts agree the primary goal of such an incident is not physical destruction, but psychological intimidation. As one of Ukraine’s largest military backers in Europe, Germany has long been a target of Russian hybrid operations designed to undermine public and political support for Kyiv.
Andrei Soldatov, a leading expert on Russian intelligence agencies, explained that the incident sends a deliberate message to European governments: “You get something like that into one of the biggest European airports and you send the message that, ‘Guys, we can do that. Remember. You hint to the adversary that you might cause a really big problem: that tomorrow might be more serious.’” Soldatov added that the operation aligns with Russia’s current strategy, as Moscow faces mounting pressure from Ukraine’s long-range drone campaign and repeated setbacks on the battlefield that have humiliated the Kremlin.
John Lough, a Russia analyst at the New Eurasian Strategies Centre, called the incident a clear case of Russian interference, designed to erode European support for Ukraine by highlighting the risk of escalation and intimidating German authorities. Lough warned that shifting battlefield dynamics that have favored Ukraine have raised the risk of a sharp increase in such hybrid attacks across the continent in the coming months. “I think it’s a dangerous moment,” he added.
As investigations continue, NATO and Antonov Airlines, the Ukrainian cargo firm that operates the planes parked at Leipzig, have both declined to comment on potential targets or direct links, noting that German authorities are still piecing together the full details of the incident.