BERLIN — If the explosive had actually detonated, investigators might not have gotten their clearest look yet at what European officials believe is a wider Russian campaign of attacks.
On Aug. 4, a drone struck the wing of a Ukrainian aircraft at Germany’s Leipzig Airport and fell onto the tarmac. Strapped beneath it was a tin can packed with explosives. The device remained intact.
That gave investigators something unusually valuable: the bomb itself. The can was sealed with a metal plate stamped with seven circular indentations, according to an investigative file from German federal police reviewed by the Axel Springer Global Reporters Network.
It wasn’t the first time such an improvised explosive had been discovered on European soil. Almost two years earlier, on Aug. 20, 2024, police investigators arrived at a cemetery in Kaunas, Lithuania, with a bomb disposal team. They had received a highly sensitive tip from Poland concerning explosives and a Ukrainian man alleged to have deposited them there for Russian intelligence, according to investigation files from the Lithuanian Criminal Police Bureau.
At a weathered grave, beneath artificial flowers and concrete slabs, officers recovered a plastic bag containing two tin cans. According to their labels, they contained corn. Forensic analysis, however, found they contained 968 grams of explosives, around 700 grams of TNT equivalent per can — roughly the lethal force of four hand grenades.
In January and June 2025, investigators unearthed more explosive-filled cans at various locations in Lithuania. Four were fitted with metal plates stamped with circular indentations. Investigators say they were intended to act as projectiles in an explosion. Forensic examinations found that the plates were highly likely to have been manufactured by the same machine, according to a report by the Forensic Science Service of the Police Department of Lithuania.
The device attached to the drone in Leipzig bore striking similarities to those recovered from the Lithuanian caches, including the explosive-filled tin can and the stamped metal plate.
The resemblance alone does not establish that the devices belonged to the same operation. But two Western security officials, who were granted anonymity to discuss security matters, say it fits with other evidence — including travel records, suspected logistics routes and intelligence reporting — linking the cases to a broader Russian intelligence mission.
The resemblance is one element of a pattern that German and European officials believe points to an escalating campaign of sabotage and violence across Europe, planned and coordinated by Russian intelligence officers.
According to three senior German and European security officials, the main driver of the campaign is Russia’s GRU military intelligence service. At its core, they say, is Unit 29155 — a military intelligence outfit linked to destabilization operations in European countries.
German authorities say they expect further “hybrid” operations as Russian President Vladimir Putin seeks to disrupt military support for Ukraine and raise the political cost of backing Kyiv.
“The population is supposed to fear a direct military confrontation and therefore question the purpose of supporting Ukraine,” said Gerhard Schindler, former president of Germany’s BND Federal Intelligence Service. “That is why he will increase both the military pressure on Ukraine and the hybrid pressure on the West.”
In response to an inquiry, the Russian Embassy in Berlin denied any Russian involvement in acts of sabotage in Europe. “We firmly reject the baseless allegations concerning Russia’s purported involvement in the alleged ‘drone incident’ at Leipzig Airport, as well as in other ‘sabotage activities,’” a spokesperson said.
Russian connection
One of the clearest trails leads to Oleg Levushkin, a dual Latvian-Russian national whom German authorities suspect of helping prepare the Leipzig attack. According to a senior German security official and investigative files reviewed by the Axel Springer Global Reporters Network, Levushkin is not a low-level recruit but a GRU-linked logistics operative with longstanding ties to senior figures in Russian military intelligence.
On social media, Levushkin offers glimpses of a seemingly ordinary life: motorcycle trips to Crimea and the Hungarian-Serbian border, a visit to Volgograd’s Motherland Calls statue, and time spent fishing, skiing and travelling across Europe with his family. The Axel Springer Global Reporters Network reviewed his profiles on the social media sites VKontakte and Odnoklassniki.
According to one German intelligence official and documents related to the case, investigators believe Levushkin traveled via Turkey to Berlin Brandenburg Airport in late July to prepare the Leipzig operation. He rented a car there on July 27, according to location data mentioned in German investigation files. Investigators believe the explosives entered Germany via Bulgaria and Serbia in the cavities of long-haul trucks, according to the senior official from Germany.
On July 31, the rental car was recorded near Leipzig Airport, where investigators believe he was carrying out reconnaissance ahead of the attempted attack, according to documents from the investigation. Levushkin did not reply to a request for comment.
Levushkin’s alleged links reach into the upper ranks of Russian military intelligence. According to reporting by German media as well as the London-based non-profit Dossier Center, he has maintained a close relationship for roughly two decades with GRU Colonel Denis Smoljaninov.
A December 2025 report by the State Security Department of Lithuania says Smoljaninov is “the head of the GRU’s Ukraine department, specializes in psychological operations and is linked to covert sabotage campaigns organized in Europe using the social network Telegram.”
According to the 2025 intelligence report, Smoljaninov also coordinated the activities of the Russian-linked private military company Longifolia, registered in Panama. European investigators suspect several shareholders in the company of involvement in an operation where incendiary devices were sent to Poland and Britain, according to Lithuanian investigation files. One of the parcels caught fire on July 20, 2024 while being transferred at Leipzig Airport. Another ignited two days later in Birmingham, England.
Lithuanian intelligence explicitly attributes the parcel operation to the GRU, and in particular to Unit 29155. A November 2025 dossier by Lithuania’s State Security Department reviewed by the Axel Springer Global Reporters Network describes the unit as being “tasked with carrying out killings, operations to destroy infrastructure, disrupting the activities of institutions that run counter to Russia’s interests, and terrorist attacks in Western countries.”
Its agents, the November 2025 dossier says, are “trained in handling explosives and firearms [and] can identify human sources and build agent networks.”
Unit 29155 has previously been linked by Western governments and investigators to a series of operations across Europe, including explosions at ammunition depots in Bulgaria and the Czech Republic and the 2018 poisoning of former Russian spy Sergei Skripal in Britain, according to the dossier. The Lithuanian dossier also links the unit to more recent arson attacks, including at an Ikea store in Vilnius and a post office in Bucharest.
The Russian government’s press service did not respond to a request for comment about GRU Unit 29155 and Smoljaninov.
German officials have blamed the GRU for a failed incendiary attack on a defense company in Munich in September, while Estonia’s intelligence service said this week in a public statement that an August arson attack on defense company Milrem Robotics had been commissioned by Russian intelligence.
European security authorities interviewed by the Axel Springer Global Reporters Network expect such operations to increase in the coming months, with defense companies, critical infrastructure and people involved in supporting Ukraine among the potential targets.
The Kremlin views its relationship with Europe as a “systemic conflict,” said Omar Haijawi-Pirchner, the former head of Austria’s domestic intelligence service. Like others interviewed for this article, he said he expects an increase in drone incursions and hybrid attacks.
“We believe that Russia is currently under remarkably high pressure — probably higher than at any previous point during the war and at any time during Vladimir Putin’s tenure,” said a senior NATO official who was granted anonymity to discuss security matters.
“From the Kremlin’s point of view, the best option available to them seems to be to intensify the hybrid campaign they are waging against the West,” the official added.
Lennart Pfahler is an investigative reporter at WELT. Ibrahim Naber is a foreign correspondent for WELT. Alexander Dinger is head of investigations at WELT. Richard Holmes is forensic investigations editor at the Telegraph.
The Axel Springer Global Reporters Network harnesses the resources of the company’s newsrooms to publish ambitious scoops, investigations, interviews, opinion pieces and analysis. It allows journalists — including those from POLITICO, Business Insider, WELT, BILD, The Telegraph, Onet and Fakt — to collaborate on major stories for an international audience of hundreds of millions across platforms: online, print, TV and audio.