Germany Names Two Suspects in Leipzig Airport Drone-Bomb Plot as Both Remain at Large

The two men behind a drone-borne bomb that came within a broken detonator of destroying part of Germany's most strategically exposed cargo airport have names, passports and a trail of DNA stretching from a Finnish police database to a tree outside Leipzig. Neither is in custody.

GERMANY NAMES TWO SUSPECTS IN LEIPZIG AIRPORT DRONE-BOMB PLOT AS BOTH REMAIN AT LARGE

Berlin, Germany - German investigators have identified a Russian citizen linked to Moscow's military intelligence service as the planner of the failed drone-bomb attack at Leipzig/Halle airport and a Belarusian national as the hired operative who carried it out, according to confidential investigative documents reviewed by Welt am Sonntag and shared with The Telegraph. The naming of the two suspects, reported on 12 September 2026, came more than five weeks after a Semtex-laden drone was found beside a Ukrainian cargo aircraft at the airport in Schkeuditz, Saxony, and defused. Both men are believed to have left Europe, and investigators are sceptical that either will ever stand trial.

The Men Behind the Plot

The suspect who planned the operation is Oleg Le, a Russian citizen understood to be linked to the GRU, Russia's military intelligence directorate, and responsible for the attack's logistics. The second suspect is Andrei Ka, a Belarusian citizen who acted as a so-called "disposable agent" - a criminal recruited to carry out acts of sabotage, in the assessment of the officials who spoke to Welt am Sonntag.

Le entered Germany via Turkey, arriving through Berlin-Brandenburg airport. He later departed from Berlin bound for Serbia. He is now back in Russia. Investigators already knew on his entry that he was associated with the GRU, yet he was not placed under surveillance after arriving.

Ka entered the Schengen Area via Latvia on 28 July, roughly a week before the incident. Earlier German reporting by Sueddeutsche Zeitung, NDR and WDR on 2 September had described the logistics man as a Russian-born man holding a Latvian passport and the second suspect as a Belarusian man who also carries a Russian passport. Ka is reported to have entered Germany on an Italian tourist visa issued in late April at an Italian diplomatic mission in Minsk.

Both suspects were previously known to police. Ka has criminal records in several countries; in Finland he is listed, among other charges, for theft. That prior record would prove central to the investigation.

A Drone, a Tin of Semtex, and a Broken Detonator

The attempt unfolded on the evening of 4 August 2026 at Leipzig/Halle airport, a freight hub in Schkeuditz, Saxony. An explosives-laden drone was found near a Ukrainian Antonov cargo aircraft and safely defused. The explosive, roughly 1.8 kilograms of Semtex, had been hidden inside a tin and mounted on the drone.

The Antonov was filled with approximately 25,000 litres of jet fuel. Sources familiar with the investigation believe that had the charge detonated, it would have triggered a massive explosion and destroyed parts of the airport. It did not explode because a detonator broke off; the BBC reported the detonator was apparently faulty.

Investigators found debris from two additional drones near the airport. A second drone forced a DHL cargo plane to abort its landing. A third device, found on 14 August near the airport's western edge, tested positive for hexogen, a military-grade explosive, and also failed to detonate. Experts at the Federal Criminal Police Office, the BKA, believe more drones may have been used than first thought; three devices have been found, complete or in parts.

The drone that landed on the runway was a homemade device assembled from readily available parts, some manufactured using a 3D printer. Its four motors were a Chinese brand also sold in Russian online stores specialising in "combat technologies". The tin of Semtex was attached with a mount.

The Evidence Trail: A Glove, a Tree, and a Database Match

One day after the attempt, police found an antenna-like structure taped in a tree near the airport, believed to have been used to control the phone-steered drones. Forensic technicians found remnants of a glove on the structure carrying DNA traces already recorded in Finland and Lithuania. The database match pointed to Ka.

DNA material was also found on one of the drones and on the inside of the explosives-filled tin can. The physical evidence, according to the documents reviewed by Welt am Sonntag, ties the disposable agent directly to the device.

Polish authorities believe Ka was involved in a fire at a home improvement shop in the city of Lodz in 2024, which local prosecutors classified as sabotage. Polish prosecutors say evidence in that case also points to Russia; Ka's involvement in Leipzig is treated as further evidence of Russian involvement.

The explosives used in Leipzig came via Bulgaria and Serbia. Investigators believe they were moved in hidden compartments of trucks and then hidden in underground caches. Police found several possible hiding places near the airport after analysing data from a rental car used by the suspects.

Confidential documents mention a concrete slab with two handles found near a pedestrian bridge in the town of Schkeuditz, directly south of the airport, believed to provide access to a hideout. A second suspected hideout was found north of the bridge; both storage places were empty. Investigators also located a hideout in the town of Merseburg, also in the Halle/Leipzig area, where Le may have temporarily stored the explosives.

European investigators see the method as strong evidence of a large-scale GRU operation which, like previous ones, relied on common criminals lured with offers of cash.

Why Leipzig Was the Target

Leipzig/Halle is a major hub for international freight and for support to Ukraine. Its regular users include Ukrainian Antonov transport aircraft. It is home to NATO's Strategic Airlift International Solution, known as SALIS, which operates almost every day delivering equipment to NATO battle groups along the eastern flank from Finland to Romania, and supporting EU and alliance missions.

The airport has been targeted before. In July 2024, a suspected Russian incendiary parcel caught fire at its DHL hub. Western security officials suspect that plot was organised by Russian intelligence.

Berlin Concludes Russia Was Responsible

On 1 September, the German government concluded that Russia was responsible. Interior Minister Alexander Dobrindt said the attempt fits the "known pattern of Russian hybrid operations in Europe" and that police investigations, the pattern and intelligence findings together "prove a Russian responsibility for the attempted attack at Leipzig airport".

Dobrindt said the device pointed to "a high degree of technical expertise" and painstaking planning, with the operation left to "low-level" agents. He raised Germany's threat level from "general" to "high", calling the situation a "new level of danger" and a "professional hybrid threat scenario".

Foreign Minister Johann Wadephul ordered the closure of the Russian consulate in Bonn, effective 18 September, and the termination of the Russian House cultural centre in Berlin. He announced tighter entry controls for Russian nationals and more pressure on Moscow's shadow tanker fleet, and summoned Russia's ambassador, Sergei Nechayev.

Germany is planning a comprehensive anti-drone shield: expanded federal police mobile drone-defence units, vehicles and helicopters deployable to protect airspace over Frankfurt, Munich and Berlin, plus legal changes letting critical infrastructure operators detect and defend against drone sabotage. A national cyber shield and wider use of AI, biometric facial recognition and video surveillance at transport hubs are planned. Germany is doubling its anti-drone police force to 300 personnel. The airport has suspended visitor programmes and closed its observation deck while investigations continue.

Chancellor Friedrich Merz said on 9 September that the attack "was planned in Russia for months", "was specifically targeted at Germany, and only by pure chance was major material damage and harm to people prevented." Saxony's interior minister, Armin Schuster, called the attack "state terrorism". Federal prosecutors classified the case as a "serious attack on Germany's transport and logistics infrastructure".

In mid-August the German Cabinet approved broader powers for the country's intelligence services to counter sabotage and hacking. The reform still needs parliamentary approval. CDU MP Roderich Kiesewetter said the measures so far "fall far short of what is required" and that Moscow "just laughs" when its ambassador is summoned: "From a self-proclaimed leading nation, I expect courage and resolve, not self-deterrence and appeasement."

Allies Rally Behind Germany

NATO Secretary-General Mark Rutte said he had spoken with Merz and that "NATO stands in full solidarity with Germany after the Russian hybrid attack in Leipzig." He added: "The evidence is clear."

EU Commission President Ursula von der Leyen said: "We are united in our resolve to stand against Russian aggression. We will deter anyone who seeks to undermine our freedom and security." The EU is preparing additional sanctions. EU foreign policy chief Kaja Kallas said the attempted attack had "all the hallmarks of state-sponsored terrorism".

British Prime Minister Andy Burnham said: "Russian attempts to undermine our united resolve and our willingness to support Ukraine are futile and doomed to fail."

Polish Prime Minister Donald Tusk, who has repeatedly warned of a Russian sabotage campaign against NATO countries, said Poland had been hit by new acts of sabotage including arson within the previous "dozens of hours". He spoke the day after a fire at WB Electronics, described by the Polish government as Europe's biggest drone manufacturer. Prosecutors opened an investigation into suspected "participation of foreign intelligence activities against the Republic of Poland"; the fire in Skarzysko-Kamienna destroyed warehouse facilities with damage estimated at at least 15 million zlotys, about $4 million.

German police are investigating improvised explosive and incendiary devices found at a power substation in Brandenburg, which damaged a power line and caused a temporary outage. It is not known who planted them.

Moscow Denies Everything

Vladimir Putin dismissed the allegations and claimed Germany's leadership was using the incident to distract from its own failings. "But where is the proof? Well, the proof has been planted," Putin told reporters in Kyrgyzstan at a Shanghai Cooperation Organization summit. He offered no evidence for that claim.

Russian Foreign Ministry spokeswoman Maria Zakharova called the accusations a "far-fetched and contrived pretext" and said "as usual, no convincing or serious evidence has been presented whatsoever". She said Moscow would respond in a "mirror-image" fashion to Germany's measures and told the German Press Agency that "Berlin is sponsoring terrorism".

The Russian embassy in Berlin called the allegation "absurd" and described Germany's measures as an "unprecedented escalation in Russian-German relations". Foreign Minister Sergei Lavrov said the German accusations were "by and large, the start of a real war", and told Russian state TV channel Vesti that Merz's push to make Germany Europe's leading military power meant: "He is, in effect, declaring war on us."

A Pattern Across Europe

The Associated Press has tracked roughly 200 incidents of sabotage and malign activity across Europe blamed on Russia by Western officials since the invasion of Ukraine - including plots to set fire to warehouses, drone launches, attempts to kill enemies abroad, theft of defence technology and cyberattacks on critical European infrastructure. In May, Putin responded to the AP findings by saying Moscow is not waging a sabotage campaign against Europe, and demanded that AP "name one proven fact."

The head of Germany's Federal Criminal Police Office, Holger Muench, said in December that more than a thousand suspicious drone flights were recorded over Germany in 2025, mostly targeting military sites, airports, ports and defence firms, treated as surveillance or harassment rather than attacks. The EU has imposed almost two dozen sanctions packages on Russia, targeting roughly 3,000 people and entities.

The Political Reckoning Ahead

The revelations land as Berlin weighs whether its response so far has been proportionate, and as a key state election in the eastern state of Saxony-Anhalt could put the far-right Alternative fuer Deutschland into power at state level for the first time. The AfD, Germany's biggest opposition party, wants to stop supporting Ukraine and reopen ties with Russia.

For now, the two men named in the confidential files remain beyond reach. One is in Russia. The other is on the run. The drone motors, the Semtex tin, the glove in the tree and the empty hideouts near Schkeuditz are what remain in Germany - evidence of an operation that came apart on a single faulty detonator.

By Jessica Ali, Staff Writer

This article was produced with AI-assisted research and editorial support. Sources: The Telegraph/Welt am Sonntag, Associated Press, BBC News, Deutsche Welle, Sueddeutsche Zeitung/NDR/WDR, Anadolu Agency.