An explosive device that failed to detonate after a drone struck a Ukrainian aircraft at Leipzig Airport in August has given European investigators one of their clearest views yet of what officials believe is a coordinated Russian sabotage campaign, according to investigation files reviewed by the Axel Springer Global Reporters Network and published by Politico Europe.
On 4 August a drone hit the wing of a Ukrainian aircraft at the German airport and fell onto the tarmac. Strapped beneath it was a tin can packed with explosives. The device stayed intact, allowing police to examine the bomb itself.
Tin cans and stamped plates
According to a German federal police file, the can was sealed with a metal plate stamped with seven circular indentations. Investigators had seen similar devices before. In August 2024 Lithuanian police, acting on a tip from Poland, recovered two cans labelled as sweetcorn from beneath a grave in a Kaunas cemetery. Forensic tests found each held explosives with a force roughly equivalent to 700 grams of TNT.
More explosive-filled cans were found in Lithuania in January and June 2025. Four were fitted with metal plates stamped with circular indentations, which investigators believe were meant to act as projectiles. Lithuanian forensic scientists concluded the plates were highly likely to have been made on the same machine.
The Leipzig device bore striking similarities. The resemblance alone does not prove the cases belong to one operation. But two Western security officials told the reporting network it fits other evidence, including travel records, suspected logistics routes and intelligence reporting.
Officials point to the GRU
Three senior German and European security officials said the main driver of the campaign is Russia’s GRU military intelligence service, and in particular Unit 29155, a unit Western governments have linked to destabilisation operations in Europe. German authorities say they expect further “hybrid” operations aimed at disrupting military support for Ukraine.
Gerhard Schindler, a former president of Germany’s BND foreign intelligence service, said the aim was to make people fear a direct military confrontation and question support for Ukraine.
Moscow’s denial
The Russian Embassy in Berlin rejected the allegations. “We firmly reject the baseless allegations concerning Russia’s purported involvement in the alleged ‘drone incident’ at Leipzig Airport, as well as in other ‘sabotage activities’,” a spokesperson said.
No court has ruled on the Leipzig case, and the officials quoted spoke anonymously. The findings described come from investigative files and intelligence assessments rather than a trial.
A suspect’s journey
German investigators suspect Oleg Levushkin, a dual Latvian-Russian national, of helping prepare the attack. According to a senior German security official and case files, he is regarded as a GRU-linked logistics operative rather than a low-level recruit.
Investigators believe he travelled via Turkey to Berlin Brandenburg Airport in late July and rented a car on 27 July. They believe the explosives entered Germany through Bulgaria and Serbia, hidden in long-haul lorries. On 31 July the rental car was recorded near Leipzig Airport, where investigators think he carried out reconnaissance. He has not been convicted of any offence.
Why Leipzig matters
European governments have for two years attributed a series of arson attacks, incendiary parcels and plots to Russian intelligence, often using recruits paid online. An intact bomb, linked by forensic markings to caches hundreds of miles away, offers something rarer: physical evidence that may connect incidents across borders.
For security services, the case underlines a shift from espionage to physical disruption. For Moscow, which denies any role, it is another accusation it calls unfounded. What happens next will depend on whether investigators can turn forensic links and intelligence into evidence that stands up in court.
