US intelligence saw the "handwriting" of the GRU in an attempted attack on a Ukrainian An-124 in Leipzig (Updated)

American intelligence has identified signs of the involvement of the Russian GRU in an attempted sabotage at Leipzig/Halle airport, where at the beginning of August a drone with explosives tried to attack a Ukrainian cargo An-124. The explosives and construction of the device were typical of the means used by Russian military intelligence, and the assessment itself was made by the American side together with German services.

ABC News reported this, citing a source in American intelligence familiar with the investigation into the suspected sabotage.

According to the TV channel's source, both the explosives used and the very design of the combat device mounted on the unmanned aerial vehicle indicate a connection to the GRU. The American assessment was formed in cooperation with German security and intelligence agencies.

However, the investigation has not yet been officially concluded, and German authorities have not publicly named Russia as the organizer of the operation.

Drone was supposed to put planes out of action and delay supplies to Ukraine

According to ABC News, investigators assume that the explosive drone was intended to damage or put out of action cargo aircraft at the airfield. This could have delayed logistics operations in support of Ukraine and at the same time serve as a signal to Berlin over its continued military aid to Kyiv.

Leipzig/Halle is one of the largest cargo aviation hubs in Europe. The airport is also used by the US military and other NATO countries for logistics operations, including the transport of cargo for Ukraine.

The American source also clarified the reason why the explosive device did not detonate: the trigger mechanism turned out to be disconnected. Earlier, German media reported a malfunction in the detonator, citing investigation materials.

Drone reached Ukrainian An-124

The main incident occurred in the evening of August 4. Initially, it was reported that a drone with explosives was simply found not far from the Ukrainian transport planes of Antonov Airlines.

However, subsequent analysis of surveillance camera recordings, as reported by WDR, NDR and Süddeutsche Zeitung, showed a different picture: at around 7:30 p.m., the drone flew to one of the Ukrainian An-124s and struck its wing.

After the impact, the explosive device attached to the aircraft detached, and the drone bounced off the plane and fell. It was discovered on the airport grounds a few hours later.

Nearby, a metal container with approximately 600 grams of plastic explosive was found. German investigators' earlier reports also mentioned Semtex and PETN – powerful explosives that can be used for military purposes.

The drone itself was heavily modified. It was fitted with an additional battery to increase flight range, a camera, a 5G router and two SIM cards. It had no navigational lights. Investigators suggested it might have been controlled remotely via a mobile network.

Investigation suggests use of at least three drones

Further investigation showed that the operation might have been much larger. German investigators believe several drones were used in the airport area.

Another small drone might have collided with a DHL cargo plane around midnight. Due to the airport closure, the plane was forced to abort its landing and later flew to Hanover. There, damage was found on its tail section, the causes of which are still being determined.

Yet another drone was found on August 14 in a field in Kabelsketal, directly near the western boundary of Leipzig/Halle airport. During crime scene examination, forensic specialists discovered a substance tentatively identified as about 50 grams of RDX – a powerful military-grade explosive.

This finding strengthened the version that the alleged sabotage operation involved the use of several devices at once.

Antenna, drone parts and DNA found

During searches near the airport, law enforcement officers also found an antenna attached to a tree and electronic equipment. According to the investigation, it could have been used as a signal amplifier for remote control of the drone.

At another location, burnt ground and metal fragments were discovered. Witnesses reported a powerful explosion in that area at around 7:20 p.m. on August 4 – shortly before the drone hit the An-124.

During a repeated survey of the area on August 11, law enforcement officers found the engine and rotor of yet another drone.

Forensic specialists also collected several DNA traces – on the container with explosives, on the drone itself, and near the incident site. One matched a trace from another criminal investigation; another, according to German media, may be linked to Lithuania.

Airport has repeatedly appeared in sabotage threats

According to American officials, Leipzig/Halle has previously been the target of several alleged Russian sabotage operations. Since early 2026, 18 drone incidents causing airspace disruptions have been recorded around the airport.

German investigators are also examining possible parallels with the sabotage campaign against European air logistics, in which explosive and incendiary devices were hidden in cargo parcels. In previous investigations, European intelligence services linked such activity to a network of perpetrators possibly coordinated by Russian military intelligence.

Merz speaks of hybrid attacks, Moscow denies

German Federal Chancellor Friedrich Merz has for now refrained from publicly naming the organizers of the attempted sabotage in Leipzig. He stated that German services are working intensively on the case and should present their findings soon.

At the same time, Merz noted that Germany is increasingly becoming the target of hybrid attacks.

The Russian Foreign Intelligence Service rejected accusations of Moscow's involvement. The Russian SVR stated that German politicians and European media supposedly began accusing Russia even before the conclusion of the preliminary investigation.

Germany's Federal Prosecutor's Office is investigating the case as attempted explosion and dangerous interference in air traffic. The office previously called the event a serious attack on the country's transport and logistics infrastructure.

An-124 was not carrying munitions

Earlier, German media reported that the Ukrainian An-124 at the time of the incident might have been carrying military munitions. This information was later denied by German officials and the airport operator Mitteldeutsche Flughafen.

According to them, the respective Antonov Airlines planes were empty at the time of the attack and were not transporting any weapons or munitions.

At the same time, the Ukrainian company's aircraft are based in Leipzig and perform large-size cargo transport, including within NATO logistics operations. Therefore, investigators believe the target of the operation may have been precisely the Ukrainian cargo air fleet and the logistic route for supplying aid to Ukraine.

Based on materials from: ABC News, Tagesschau, Tagesschau