The Perpetrators and Their Journeys

Leipzig remains an open wound in the history of Germany’s drone defense, which is still in its infancy: Now, further details have emerged about the failed drone attack on the airport and the Ukrainian Antonovs. Interestingly, these details include the names of the two suspects and a more detailed description of the drone used. Among them were:

• Oleg L. – a Russian citizen, reportedly linked to the GRU military intelligence service and responsible for the planning and logistics of the attack.
• Andrei K. – a citizen of Belarus, assessed as a “disposable” agent who is said to have carried out the operation.

Oleg L. entered Germany via Turkey and Berlin-Brandenburg Airport; authorities were already aware of his connections to the GRU but did not place him under surveillance. After the operation, he left the same airport bound for Serbia and is now back in Russia. His accomplice, Andrei K., on the other hand, entered the Schengen Area via Latvia around July 28.

The military-grade explosives for the drones—a total of about 1.8 kg of Semtex, hidden in tin cans—were reportedly smuggled into Germany via Bulgaria and Serbia, concealed in cavities inside trucks.

The known target was a Ukrainian Antonov cargo plane that had been refueled with approximately 25,000 liters of kerosene. One of the drones crashed next to the runway and remained there for hours until it was discovered; the detonator had failed upon impact with the wing.

German authorities blamed Russia for the incident, citing the drone’s configuration, the explosive material, and intelligence information pointing to a known pattern of Russian hybrid operations involving low-level agents. According to the Federal Criminal Police Office (BKA), the FPV drone was a modified 10-inch racing quadcopter assembled from commercially available parts as well as specially milled and 3D-printed components. It was not controlled via a conventional radio remote control.

Instead, it used the standard cellular network: a 4G module connected to a commercial hotspot, along with two SIM cards. An operator could control it in real time from any location with a good internet connection using a laptop, a joystick, and a live camera feed. This approach is difficult to disrupt without interfering with civilian cellular service.

The pattern—Semtex in tin cans, trucks, underground hiding places, an organizer linked to the GRU leaving Germany for Serbia—fits a well-known hybrid logistics model: the state’s trail remains in Moscow, the material is transported through the Balkans bordering the EU, and disposable agents are deployed within the Schengen Area. The fact that Leipzig Airport was so unprotected—effectively without any drone defense—is perhaps the lesser oversight compared to how the GRU was able to send an operative through the Balkans to Germany without being detected.