German investigators have found parallels between last week's attempted drone attack on a Ukrainian aircraft and a series of sabotage attacks on air cargo in 2024, with traces leading to Russia's military intelligence service.
Last week's attempted drone attack on a Ukrainian aircraft at Leipzig/Halle Airport has a number of parallels with the spectacular series of attacks on air cargo in July 2024. According to research conducted by WDR, NDR, and Süddeutsche Zeitung (SZ), the network responsible for sending incendiary packages at that time was simultaneously transporting drone components across Europe, including to Germany.
The incident occurred last week when a drone with explosives and a detonator was found near several Ukrainian transport aircraft. The explosive device, hidden in a can, did not detonate, likely due to a faulty igniter. German Interior Minister Alexander Dobrindt (CSU) stated at the time that "foreign forces" could not be ruled out as the masterminds, and security circles increasingly point to Russia.
Through access to Polish investigative files, journalists discovered that the network that placed incendiary devices in shipments in Birmingham, Warsaw, and Leipzig in July 2024 was simultaneously transporting drone components across Europe. Even then, cans played a crucial role, just as in the current case in Leipzig, where a can filled with highly explosive material was attached to the drone.
The central figure in this network is a young Ukrainian who, according to investigators, acted on the orders of the Russian military intelligence service GRU. He admitted to the transport but denied knowing he was working for Russian intelligence. His contact on Telegram, a person under the name "Warrior," guided him through a series of tasks across Europe. Investigators have identified more than 20 suspects in this broader sabotage network, and Germany's Federal Office for the Protection of the Constitution refers to such individuals without intelligence training as "disposable agents."
According to Polish investigative documents, in the summer of 2024, the young man dug up several cans of corn, drone propellers, and a stand made of plastic pipes in Kaunas, Lithuania, including at a cemetery location. He transported these parts to Lodz in Poland, where he left them in bushes. For this first task, he received $2,000.
Just a few days later, on July 12, 2024, he returned to the cemetery in Kaunas, dug up a new stand and propeller, and headed to Germany. Despite a check at the Polish-German border, he passed without any issues. "I think they had no suspicions," he messaged his contact "Warrior," who briefly replied to the news of the check: "Shit."
He eventually left the equipment in a hotel room in Düsseldorf and then received a new task to pick up a bag with additional propellers from a bush next to railway tracks in the same city and return it to Poland. This route indicates the existence of a broader network of ground helpers in Germany. Two of the ten defendants in the air cargo case were in Frankfurt am Main in the days before the attack, and then in Berlin, at a hotel used as a refugee reception center. German investigators conducted searches and interrogations in 2024 and 2025 but found no evidence of criminal offenses.
While numerous perpetrators have been arrested, the search for the organizers continues. Polish investigators suspect that behind the Telegram profile "Warrior" is Aleksej K., a person associated with the GRU. The trail led investigators to Krasnodar in Russia. Aleksej K. is also suspected of involvement in setting fire to an IKEA store in Lithuania.
The young Ukrainian is currently on trial in Poland along with four other defendants in the DHL case. In Lithuania, charges have been filed against five individuals. Moscow has so far rejected all allegations of involvement in these attacks.
