Loading story…
Germany has attributed an August drone incident in Leipzig to Russia, reinforcing concerns that Moscow is intensifying deniable operations on NATO territory. Public reporting linked the incident to an explosive-drone discovery at Leipzig/Halle Airport; related German investigations have also examined alleged Russian-linked reconnaissance of parcel-bomb routes and a suspected weapons cache intended for covert violence.
The incident fits a broader Russian hybrid campaign combining sabotage, cyber activity, drone incursions, disinformation, election interference, and pressure on European defense and Ukraine-support supply chains. Intelligence assessments judge further hostile activity and significant cyber operations in NATO countries likely, with ambiguous attacks intended to test alliance cohesion and complicate an Article 5 response, while an imminent conventional Russian invasion of NATO remains unlikely.
TTPs, infrastructure, and targeting history in one profile.
20 events from the most recent confirmed update back to the earliest known activity.
NATO stated that it did not see an imminent direct Russian attack despite increased Russian hybrid activity and reported airspace violations involving Poland and Romania.
German Chancellor Friedrich Merz said Germany was preparing a coordinated response with NATO and European Union partners concerning the Leipzig/Halle Airport incident.
CIA Director John Ratcliffe visited Moscow and met Russian intelligence counterparts; the Kremlin confirmed that President Vladimir Putin was briefed afterward. Reported accounts said Ratcliffe warned against escalation or attacks on NATO territory, particularly the Baltic states.
A German court convicted a Ukrainian national for participating in a Russian state-initiated operation that sent GPS-equipped test parcels through European logistics networks to map routes for future sabotage.
German authorities reportedly discovered a quadcopter carrying PETN and Semtex near Ukrainian Antonov cargo aircraft at Leipzig/Halle Airport. Additional drones and suspected military explosives were subsequently reported nearby, while U.S. intelligence sources saw characteristics associated with Russian GRU tradecraft.
German investigators reportedly disclosed a professionally prepared firearms and ammunition cache outside Berlin assessed as intended for operatives conducting violent missions on Russia's behalf. Authorities sought the extradition from Romania of a suspect connected to the case.
The pro-Russian Server Killers group claimed responsibility for a major DDoS attack against Norway's national digital public-services infrastructure, though most services remained operational. The available reporting did not establish direct Russian intelligence control of the group.
The Matryoshka influence operation was identified as impersonating established media brands and spreading fabricated allegations targeting Germany's September Saxony-Anhalt regional elections.
Germany attributed the August drone incident in Leipzig to Russia. The reporting did not identify the responsible Russian unit or disclose evidence supporting the attribution.
NATO formally condemned Russia for persistent malicious cyber operations targeting allied critical infrastructure and government entities.
The United Kingdom seized a sanctioned vessel accused of directly or indirectly supplying prohibited Russian oil.
A Russian drone reportedly crossed into Romania and crashed near Galați.
The Russian-flagged tanker Saga was reportedly detected loitering above a subsea cable network near Crete; no cable damage was confirmed.
Moldova experienced another reported drone incident amid drone-related spillover beyond NATO territory.
Latvia's Defense Ministry described a Russia-backed campaign falsely claiming that Latvia, Lithuania, and Estonia allowed their territory and airspace to support Ukrainian attacks on Russia.
A Russia-linked fuel tanker reportedly drifted near Italian islands, prompting security concerns over its fuel load.
Moldova experienced drone incidents that demonstrated spillover from the conflict affecting states outside NATO.
Storm-1516 reportedly used fake videos alleging ballot manipulation to target Robert Habeck and Friedrich Merz during Germany's federal election.
Germany announced primarily diplomatic measures in response to the Russia-attributed attempted Leipzig/Halle Airport drone attack, including closing the Russian consulate general in Bonn.
The European Union and NATO pledged to increase pressure on Russia following what the report characterized as a new escalation in Germany.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
5 references tracked. Mallory keeps watching after this page renders.
cfr.org
Open sourceeuronews.al
Open sourcesmallwarsjournal.com
Open sourcesilobreaker.com
Open sourcekrypt3ia.wordpress.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
German authorities are expanding counter-drone defenses after investigators thwarted an apparent attack near Leipzig Airport involving a mobile-phone-controlled drone carrying **Semtex**. The device was found in a secure airport area near a Ukrainian **Antonov** cargo aircraft, and investigators said a faulty detonator likely prevented an explosion. Prosecutors are treating the case as attempted causing of an explosive detonation and dangerous interference with air traffic, while Germany’s Federal Prosecutor has taken over the investigation. Authorities are also examining a second suspected drone-related incident involving a **DHL** cargo plane that landed safely with nose damage. U.S. intelligence linked the Leipzig incident to the Russian government, placing it within a broader sabotage and hybrid-threat campaign against European civilian and critical infrastructure. In response, Interior Minister Alexander Dobrindt ordered the Federal Police to expand counter-drone units from four to eight locations nationwide, while the Interior Ministry issued an urgent tender for airport drone-detection systems and moved to enlarge the drone-defense test center in **Cochstedt** near Magdeburg. Investigators are also reviewing a possible connection to the 2024 package explosion at DHL’s Leipzig logistics hub after reports of a DNA match with evidence from that earlier case.
Aug 13, 2026
Slovak authorities disrupted a planned arson attack against a Skyeton drone-manufacturing facility near Prešov that produces unmanned systems for Ukraine’s military. In Germany, authorities investigated suspected sabotage using improvised devices intended to short-circuit a substation connected to the Jänschwalde power complex, while Berlin publicly attributed a drone attack on Leipzig/Halle Airport to Russia and raised its threat assessment. The incidents indicate an escalation in suspected Russia-linked hybrid activity targeting European defense production, logistics, airports, and energy infrastructure supporting Ukraine. Russia is increasingly assessed to be using locally recruited criminal proxies—reportedly including recruits found via Telegram—as expulsions of intelligence personnel restrict operations conducted under diplomatic cover; affected organizations should incorporate physical-security, insider-risk, reconnaissance, and proxy-recruitment indicators into security programs.
Sep 23, 2026
Germany publicly accused Russia of orchestrating a cyberattack against Deutsche Flugsicherung, the state-owned air traffic control authority, and conducting a coordinated disinformation campaign aimed at influencing the upcoming federal election. The German Foreign Ministry stated it had clear evidence linking the August 2024 cyberattack to APT28 (Fancy Bear), a group associated with Russia’s GRU military intelligence, and attributed the election interference to the Storm 1516 threat actor. In response, Germany summoned the Russian ambassador, announced plans for countermeasures in coordination with EU partners, and supported new sanctions targeting those involved in hybrid attacks. The Russian embassy has denied the allegations, while European officials have warned of a broader campaign of Russian cyber operations targeting critical infrastructure and political processes across the continent. These developments come amid heightened concern over nation-state cyber threats in Europe, with both France and Germany reporting recent attacks attributed to foreign actors. The French Ministry of Interior is investigating a suspected nation-state breach of its email servers, though details remain limited. European authorities have documented a surge in nation-state-backed cyberattacks, with the EU Agency for Cybersecurity reporting 46 such incidents between July 2024 and July 2025. Officials across Europe have condemned Russia’s use of hybrid tactics, including cyberattacks and disinformation, as part of a broader strategy to destabilize Western democracies.
Jun 29, 2026