A core suspect, Oleg Levushkin, a Russian-Latvian citizen, is identified as the organizer of the Leipzig/Halle Airport drone attack, with investigators tying the sabotage to Russia’s GRU Unit 29155 and other Western intelligence materials.

Intelligence from Germany, Lithuania, and Poland, along with Western secret services, links Levushkin and co-plotter Karshakov to the operation and notes parallels with other alleged Russian sabotage efforts in Europe.

German security services associate the Leipzig plan with the GRU and emphasize the unit’s suspected role in Europe-wide sabotage intended to sow insecurity and undermine support for Ukraine.

Explosives were reportedly transported into Germany hidden in truck cavities and stored briefly along the route; Levushkin’s GRU ties were known at entry, but he was not placed under surveillance.

In early August, police recovered two additional drones and a makeshift antenna system at Leipzig, with DNA on a glove tied to Karšaku in Finnish and Lithuanian criminal databases.

On August 4–5, an explosive-laden drone struck a parked Ukrainian Antonov An-124, which carried about 25,000 liters of jet fuel, creating a serious risk of major damage to the airport.

A drone carrying explosives was found on the airport grounds near a Ukrainian cargo plane on the night of August 4–5, prompting a temporary airport closure; a second drone appeared roughly ten days later.

A major near-miss involved a drone and a Semtex-filled canister on a flight wing, with investigators noting the target aircraft carried around 25,000 liters of kerosene and potential blast effects on the airport.

Investigations identify two suspects, Oleg L. and Andrey K., with DNA on a drone component and explosives, and show cross-border movement: one left Germany two days before the attack, another entered the Schengen Area via a Minsk-issued visa.

Investigators compare the Leipzig device with similar tin-can, metal-plate bombs found in Lithuania and across the region, suggesting a shared pattern and cross-border operational network.

Lithuanian and Polish intelligence report similar bomb containers and munitions circulating across Lithuania, Poland, and Germany, connected to the same operational network and multiple drone-explosive devices.

Examining the explosive device reveals similarities to Lithuanian finds, reinforcing cross-border links between suspects and intelligence assessments.