Germany Links Leipzig Airport Plot to Russian Sabotage Network

European security agencies are investigating an alleged Russian sabotage network after an explosive-laden drone targeting a Ukrainian cargo aircraft was discovered at Leipzig Airport in Germany in August 2026. German authorities formally accused Russia of attempting to sabotage the airport on September 1, while Moscow denied the allegations. Investigations have linked the operation to suspected Russian military intelligence intermediaries, according to reporting by The Wall Street Journal, The Telegraph, and Welt am Sonntag.

European officials cited by The Wall Street Journal said Russian President Vladimir Putin ordered an intensified campaign of covert operations against NATO countries after Moscow became frustrated with the course of the war in Ukraine and negotiations with Washington. CIA Director John Ratcliffe reportedly warned European intelligence counterparts and politicians that Russia was increasing sabotage operations following a visit to Moscow.

The drone was intended to damage a Ukrainian Antonov An-124 transport aircraft. Investigators recovered the device and its explosives intact, enabling them to examine evidence that connected the suspected plot to other operations across Europe.

The explosive device "closely resembled bombs in Russian plots elsewhere across Europe." The Telegraph and Welt am Sonntag reported that investigators used this similarity to trace suspected links between the person assigned to carry out the attack, an intermediary believed to have managed the operation, and an alleged organizer associated with Russia's military intelligence service, the GRU.

German intelligence identified Oleg Levushkin, a motorcycle enthusiast who operated an import business dealing in tea, coffee, and spices, as an alleged intermediary. Authorities said his role involved "preparing the means of committing the crime before its actual execution," before the attack was assigned to Belarusian proxy agent Andrei Karshakou.

Further up the suspected chain of command was Denis Smolyaninov, described in the reporting as "an alleged chief planner of bomb attacks across Europe for Russia." A Lithuanian intelligence report published in December 2025 identified Smolyaninov as leading the Ukraine department of the GRU and associated him with covert sabotage campaigns organized through Telegram.

The report said Smolyaninov "specialised in psychological operations, and was associated with covert sabotage campaigns organized in Europe using the messaging app Telegram." The findings describe a recruitment model in which people with limited knowledge of an operation's sponsors or broader objectives can be assigned individual tasks.

The International Institute for Strategic Studies has described this approach as an "intelligence-operative gig economy." According to the reporting, recruiters use Telegram and cryptocurrency payments to attract people for activities ranging from putting up anti-NATO posters to installing surveillance cameras and carrying out arson.

Some recruits may believe they are accepting ordinary informal work or participating in unrelated criminal activity rather than assisting a state-directed operation. The reporting also described how the use of intermediaries can distance suspected organizers from people conducting attacks, complicating efforts to establish responsibility.

A Guardian report cited in the article described a case involving three men arrested in Poland. "Last May, Polish authorities arrested a Pole and two Belarusians on suspicion of planning sabotage acts for the Russians inside Poland. All three men had previously fought in Ukraine on the side of Kyiv." The case illustrated how individuals previously aligned with Ukraine could become suspects in alleged Russian-linked operations.

Reports of suspected sabotage have also increased elsewhere in Europe. In August 2026, arson attacks targeted drone manufacturing facilities in Estonia and Poland, while Slovak authorities said they had foiled a planned arson attack against a factory producing Ukrainian drones.

In subsequent weeks, Poland, Lithuania, and Bulgaria reported sabotage targeting Starlink ground stations. The incidents added to European concerns about the vulnerability of military-support infrastructure, communications systems, and facilities connected to Ukraine.

The recruitment strategy reflects an older intelligence principle described in the ancient Indian statecraft text Arthashastra, which categorizes different kinds of "wandering spies." The text emphasizes separation between intelligence organizations and their operatives: "Neither the institutes of espionage nor they (the wandering spies) shall know each other." The article connects this principle to the Soviet-era practice of using multiple intermediaries to conceal links between state officials and people carrying out covert operations.