European Critical Infrastructure Faces a Widening Russian Sabotage Campaign

A quadcopter carrying a professional plastic explosive charge struck a parked Antonov Airlines An-124 freighter at Leipzig/Halle Airport in eastern Germany at around 19:30 on 4 August 2026. The device hit the aircraft wing, bounced off and fell onto the apron without detonating, and the explosive charge separated from the airframe on impact. No detection system registered the flight. An airport bus driver found the device on the ground roughly four hours later, close to the south runway.

Federal police closed part of the airfield overnight into 5 August and deployed a bomb disposal robot that removed the detonator. Several flights were diverted, including one passenger service. A separate cargo aircraft climbing away from the airport struck an unidentified object during the same night and made an unscheduled landing in Hanover, where inspectors found minor damage. Flight operations returned to normal on 6 August, and the airport operator said at that stage that no additional security measures had been introduced.

The Federal Prosecutor's Office in Karlsruhe took the case over from the Dresden prosecutors on 6 August, citing the particular significance of the file. It is investigating attempted causing of an explosion and dangerous interference with air traffic, and it described the events as a serious attack on German transport and logistics infrastructure capable of affecting national security. Investigators confirmed that the drone carried professional explosives and a detonator. German reporting indicates that the detonator failed and that only this technical fault prevented a blast close to a fuel tank.

The airframe was not a commercial model. German media reports describe a purpose-built quadcopter without navigation lights, fitted with a release mechanism, a mobile router and two SIM cards, which would have allowed an operator to fly it over a cellular link from almost anywhere. Counter-drone systems tuned to conventional radio control protocols struggle to separate that kind of traffic from ordinary mobile phone signals. An antenna recovered from a tree near the airport is believed to have boosted the control link.

The choice of target is not incidental. Antonov Airlines lost its base at Hostomel in the first days of the Russian invasion of Ukraine and moved its heavy-lift fleet to Leipzig/Halle, which has served as its main operating base since 2022. The airport also hosts Antonov Logistics SALIS, the contractor for the NATO Strategic Airlift International Solution, which gives nine participating nations guaranteed access to An-124 outsized cargo capacity under a contract running to the end of 2026. According to a confidential police report cited by German broadcasters and the Sueddeutsche Zeitung, one of the Antonov aircraft parked that night had carried military ammunition flown in from France, cargo that had already been transferred to another flight.

Leipzig/Halle is the second-largest cargo airport in Germany and the fourth-largest in Europe, handling close to 1.4 million tonnes of freight in 2024. It is the main European hub of DHL Aviation, a base for AeroLogic and Amazon Air, and it hosts military installations used by NATO and EU aircraft. A successful detonation next to a fuelled widebody freighter would have combined a mass casualty risk with the loss of scarce outsized airlift capacity that cannot be replaced at short notice.

No suspect has been named. Interior Minister Alexander Dobrindt called the case a hybrid attack scenario and a new level of danger, and said foreign powers could not be ruled out, without naming Russia. Bild and Die Zeit reported on 10 August that DNA recovered from the drone returned a hit in the European database registered in Lithuania and matched traces secured after the incendiary attack of 20 July 2024 on the DHL logistics centre at the same airport. Later reporting on 11 August questioned that match, and German authorities have not commented on it. United States intelligence assessments cited by the Wall Street Journal point to Russian responsibility and to explosives of military origin. The Kremlin denies any involvement.

Berlin has moved faster on counter-drone capability than on attribution. On 9 August the interior ministry and the digital affairs ministry announced a research centre for drone security at Cochstedt, which opened on 18 August. The national drone defence centre is to recruit 150 additional staff and open four new bases. German police recorded more than 1,000 suspicious drone flights during 2025, and two drones were observed over the Mechernich military site in North Rhine-Westphalia at around 10:00 on 7 August, three days after the Leipzig events.

The Leipzig case sits inside a wider pattern that European services attribute to Russian intelligence and its recruited proxies. The International Institute for Strategic Studies recorded a 246 percent rise in sabotage against European critical infrastructure between 2023 and 2024, and its open-source database shows a campaign that relies on low-cost operations run through third-country nationals rather than on staff intelligence officers. That model keeps attribution slow and legal responses fragmented across national jurisdictions.

Rail has been a recurring target. Over the weekend of 15 to 17 November 2025 an improvised charge destroyed a section of the Warsaw to Lublin line near Mika, a corridor used to move supplies towards Ukraine, and a metal brace was fixed across the track near Pulawy with overhead power lines brought down. Prime Minister Donald Tusk described the events as an unprecedented act of sabotage and said two Ukrainian nationals working for Russian services had been identified before they left for Belarus. Poland closed the last Russian consulate in the country in response.

The parcel bomb campaign of July 2024 remains the closest precedent for an attack on air freight. Four devices built around magnesium-based incendiary charges and timers hidden in massage cushions were mailed from Vilnius on 19 July 2024. One ignited at the DHL centre at Leipzig/Halle the following day shortly before loading onto a flight to Britain, one detonated on a DPD truck crossing Poland, one burned in a DHL warehouse in Birmingham and one failed. Lithuanian prosecutors charged fifteen people in September 2025 and described the operation as organised by individuals tied to Russian military intelligence. Five defendants have been on trial at Vilnius Regional Court since 17 April 2026 and all deny the charges.

At sea, the Baltic has recorded repeated damage to power and telecommunications links. The tanker Eagle S cut the Estlink 2 power cable and three data cables between Finland and Estonia on 25 December 2024, and a Finnish court dismissed the case against the crew in October 2025 for lack of proven intent. Finnish authorities boarded the cargo vessel Fitburg on 31 December 2025 over further damage to Finland to Estonia links, and a telecommunications cable between Sventoji in Lithuania and Liepaja in Latvia was damaged on 2 January 2026. Sweden has investigated suspected interference with more than 30 telecommunications towers along the E22 highway.

Other operations have moved beyond infrastructure into cyber intrusion and violence against individuals. Denmark publicly blamed Russia in December 2025 for cyberattacks that burst pipes at a water utility and disrupted election websites. On 13 July 2026 the European Union named the 16th Centre of the Russian Federal Security Service as the controller of several cyber threat groups and linked it to disruptive operations against Polish critical infrastructure, including combined heat and power plants. Lithuania convicted a teenager in November 2025 over the arson of an IKEA store carried out in Russian interests, and Poland charged a Russian national in December 2025 with directing sabotage from the Moscow region. The earlier plot to kill Rheinmetall chief executive Armin Papperger showed that the campaign also targets the people who run Europe's defence supply chains.

European governments spent the summer of 2026 warning of further escalation. Lithuanian President Gitanas Nauseda said on 15 July that intelligence pointed to a possible provocation against energy or transport infrastructure in the Baltic states or Poland. Polish Defence Minister Wladyslaw Kosiniak-Kamysz warned on 21 July that Russia may deploy captured Ukrainian drones against NATO members or to stage a false flag operation, and Lithuania's defence minister repeated that warning on 6 August. Jamming and spoofing radiating from Kaliningrad now degrades civil satellite navigation across several states, which raises operating costs for aviation and shipping in the region.

For shippers, the practical consequences are insurance, screening and routing rather than immediate capacity loss.