Phoenix 24
The battlefield is moving beyond Ukraine.
Leipzig, August 2026
Germany is confronting a growing series of security incidents involving airports, companies, cargo vessels and defense executives, raising concern that the country is becoming a central target of hybrid warfare. The latest alarm followed the discovery of a drone carrying explosives and a detonator at Leipzig/Halle Airport, one of Europe’s most important cargo and military logistics hubs. German Interior Minister Alexander Dobrindt described the incident as evidence of a new threat environment involving methods designed to operate below the threshold of conventional war. Investigators have not identified those responsible, and no government has been formally accused.
The drone was found near an operational area used by cargo aircraft, including planes connected to Ukrainian and NATO logistics. Its explosive charge reportedly failed to detonate because part of the mechanism became detached, preventing an incident that could have caused extensive damage. German federal prosecutors took control of the investigation because of the potential implications for national transport infrastructure and internal security. Authorities are examining the device, its flight path and any electronic signals that could help determine who launched or controlled it.
Leipzig/Halle Airport occupies a strategic position within European freight networks and serves as a major center for international cargo operations. The site has also supported military transportation involving the Bundeswehr, the United States and NATO partners requiring access to Ukrainian Antonov aircraft capable of carrying oversized equipment. Its commercial and defense functions make it valuable to Germany while also increasing its exposure to espionage, disruption and sabotage. Airport security officials have recorded numerous unauthorized drone incidents in recent years, some of which forced temporary suspensions of flight operations.
The latest discovery follows a suspected sabotage operation at the same airport in 2024, when incendiary devices were concealed inside parcels sent through major logistics companies. One package ignited at a sorting facility before being loaded onto an aircraft, potentially preventing a fire during flight. German and European investigators later examined possible links between the operation and individuals allegedly connected to Russian intelligence. The case demonstrated how ordinary commercial systems could be exploited to attack critical infrastructure without deploying conventional military forces.
Security specialists have warned that hybrid operations against Germany have gradually intensified since Russia’s annexation of Crimea in 2014. The initial phase was characterized largely by cyberattacks, disinformation campaigns and attempts to manipulate public opinion. After Russia’s full-scale invasion of Ukraine in 2022, suspected operations expanded to include sabotage, covert recruitment, aggressive espionage and drone activity near military and civilian installations. The objective of such tactics can be to create uncertainty, increase security costs and weaken public confidence without openly declaring responsibility.
Several recent incidents involving German commercial interests have reinforced this concern. In the Black Sea, the cargo ship Emil, operated by a Hamburg-based shipping company, was reportedly struck by Russian drones, forcing the crew to evacuate after a fire broke out. Russia acknowledged attacks against cargo vessels in the region but claimed that the ships were carrying military supplies for Ukraine, an assertion that has not been independently verified. At nearly the same time, Russian missile attacks in Ukraine destroyed warehouses belonging to German companies, including Bosch, Liqui Moly and Puma.
The destruction of Liqui Moly’s central warehouse in Kyiv carried particular industrial significance because the company produces motor oils, lubricants and other materials used in machinery and transportation. The brand belongs to the Würth Group and operates within supply chains extending well beyond Ukraine. Attacks on civilian commercial facilities can generate financial losses, interrupt distribution and increase insurance and security costs for European companies working in the country. They also blur the distinction between military targets and the broader economic infrastructure supporting Ukrainian society.
German authorities are separately investigating alleged espionage directed against the chief executive of drone manufacturer Donaustahl. Reports indicate that suspected Russian agents may have monitored the executive for months, prompting officials to examine whether preparations for an attack were underway. The executive has received personal protection, while several suspects have been detained in Germany, Spain and near the border between Serbia and Hungary. Investigators are assessing whether those involved acted on behalf of a foreign intelligence service.
The case recalls a reported plot against Rheinmetall chief executive Armin Papperger in 2024. Western intelligence agencies warned German authorities about an alleged Russian plan targeting the head of one of Europe’s largest defense manufacturers, allowing security services to intervene before any attack occurred. Rheinmetall has become an important supplier of weapons and ammunition to Ukraine, making its leadership and facilities potential targets for hostile intelligence operations. These incidents have led German companies in strategic sectors to strengthen physical security, cybersecurity and protection for senior personnel.
Despite widespread suspicion concerning Russian involvement, German officials have remained cautious about publicly assigning responsibility for the Leipzig drone. Establishing legal attribution requires physical evidence, intercepted communications, technical data or verified links between operators and a foreign state. A premature accusation could have major diplomatic and military consequences, particularly because Germany is a member of NATO. If a member believes its territorial integrity or security is threatened, it may request consultations under Article 4 of the North Atlantic Treaty, although this does not automatically activate collective military action.
Hybrid warfare is designed to exploit precisely this uncertainty. Sabotage, cyber operations, disinformation, espionage and attacks on infrastructure can produce strategic damage while making direct attribution difficult. Germany’s immediate challenge is therefore not only identifying those responsible for individual incidents, but also protecting airports, companies and transportation networks against methods that continuously evolve. The explosive drone in Leipzig has transformed that challenge from an abstract warning into a visible national security concern.
Phoenix24: claridad en la zona gris. / Phoenix24: clarity in the grey zone.