Across Europe, a pattern of fires, buried explosives, and a drone that failed to detonate is slowly resolving into a single, deliberate shape — a Russian intelligence campaign designed not merely to destroy, but to frighten. Investigators tracing a failed August 2024 attack on a Ukrainian aircraft at Leipzig Airport have linked its unexploded device to caches found in Lithuanian graves, and both to GRU Unit 29155, a covert arm of Russian military intelligence with a history of poisonings, arson, and sabotage stretching from Bulgaria to Britain. The operative at the center of the German investi
Documents link Leipzig drone attack to broader Russian sabotage campaign across Europe
The population is supposed to fear direct military confrontation
Mark
So the Leipzig drone attack—that's the thread that unravels this whole thing?
Mimi
It's the piece that didn't break. If the explosives had detonated, investigators might never have connected it to the Lithuanian caches. The intact device gave them something concrete to match against.
Luke
But matching two tin cans with stamped plates—that's suggestive, not conclusive. The report says the resemblance "alone does not establish" they belong to the same operation. What's the actual chain of evidence?
Mimi
Travel records, suspected logistics routes, intelligence reporting. Two Western security officials say it all points to a coordinated Russian mission.
Luke
Two unnamed officials. That's the foundation here—attribution based on anonymity. What about Levushkin himself? Has he been charged?
Mark
The article says he didn't reply to a request for comment. So he's not denying it, but he's also not confirming anything.
Mimi
German authorities believe he traveled to Berlin in late July, rented a car on the 27th, and was near Leipzig Airport on the 31st conducting reconnaissance. That's location data from investigation files.
Luke
Location data shows someone was there. It doesn't show what they were doing or why. And Smoljaninov—the GRU colonel—the connection to Levushkin is described as a "close relationship for roughly two decades." That's a long time. Does proximity to someone in Russian intelligence automatically make you part of a sabotage campaign?
Mark
What about the incendiary parcels? Those seem more concrete.
Mimi
One caught fire at Leipzig Airport on July 20, 2024. Another ignited in Birmingham two days later. Lithuanian intelligence explicitly attributes that operation to Unit 29155.
Luke
Lithuanian intelligence attributes it. But on what basis? The article doesn't explain the forensic or investigative reasoning behind that attribution.
Mark
So we know these things happened—the drone, the parcels, the arson attacks. We know they're similar in some ways. But the leap from "similar" to "coordinated Russian campaign" depends on intelligence assessments we can't fully verify.
Mimi
That's fair. But the pattern is there. Explosions at ammunition depots in Bulgaria and the Czech Republic. The Skripal poisoning in 2018. Arson at an Ikea in Vilnius, a post office in Bucharest. Unit 29155 has a documented history.
Luke
A documented history of being blamed for things. That's different from a documented history of doing them. And the forward look—security officials expect operations to increase. That's a prediction, not evidence of what's already happened.
Mark
But if the pattern is real, if Unit 29155 is actually behind this, then the warning matters.
Mimi
It does. And the strategic intent is clear from what Schindler said—Russia wants to make Europeans fear direct confrontation and question supporting Ukraine. That's not speculation. That's stated doctrine.
Luke
Stated by one former intelligence official. The Kremlin hasn't confirmed any of this. The Russian Embassy denied involvement. We're reading one side of a contested claim.
Il Polso
- A drone carrying explosives struck a Ukrainian aircraft at Leipzig Airport and fell intact — its undetonated device becoming the most consequential piece of forensic evidence in a continent-wide investigation.
- Forensic matching between the Leipzig device and explosive caches buried in Lithuanian graves has convinced Western security officials they are looking at a single, coordinated Russian operation rather than scattered acts of opportunism.
- German authorities have traced the suspected logistics of the Leipzig attack to Oleg Levushkin, a GRU-linked operative whose travel records, rental car data, and intelligence connections place him near the airport days before the strike.
- Unit 29155 — the GRU division now attributed with the campaign — has been linked to the Skripal poisoning, ammunition depot explosions in Eastern Europe, arson attacks on an Ikea in Vilnius and a post office in Bucharest, and incendiary parcels that caught fire in Leipzig and Birmingham.
- European security officials warn that attacks on defense companies and critical infrastructure will intensify, with the explicit strategic goal of raising the political cost of Western support for Ukraine high enough to erode public will.
Across Europe, a pattern of fires, buried explosives, and a drone that failed to detonate is slowly resolving into a single, deliberate shape — a Russian intelligence campaign designed not merely to destroy, but to frighten. Investigators tracing a failed August 2024 attack on a Ukrainian aircraft at Leipzig Airport have linked its unexploded device to caches found in Lithuanian graves, and both to GRU Unit 29155, a covert arm of Russian military intelligence with a history of poisonings, arson, and sabotage stretching from Bulgaria to Britain. The operative at the center of the German investigation, Oleg Levushkin, embodies the paradox of modern hybrid warfare: an ordinary-seeming life of motorcycle trips and family vacations concealing decades of quiet service to the architecture of destabilization. What is unfolding is not a series of isolated incidents but a strategic campaign to make Western populations afraid enough to question why they are supporting Ukraine at all.
On August 4th, a drone carrying explosives struck a Ukrainian aircraft at Leipzig Airport and fell to the tarmac without detonating. The intact device — a tin can packed with explosives, its metal plate stamped with seven circular indentations — would become the most valuable piece of evidence investigators had yet found in what they now believe is a coordinated Russian sabotage campaign spreading across Europe.
Nearly a year earlier, Lithuanian police acting on a Polish tip had excavated a cemetery grave in Kaunas and found two tin cans labeled as corn, each holding nearly a kilogram of high explosives. More caches followed in early 2025. Four of those cans bore stamped metal plates that forensic analysis suggested came from the same machine as the Leipzig device — the same tin, the same signature, the same origin.
Two Western security officials say the physical similarities align with travel records, suspected supply routes, and intelligence reporting that ties these incidents to a single Russian operation. European authorities now attribute the campaign to GRU Unit 29155, a covert unit previously linked to the Skripal poisoning, ammunition depot explosions in Bulgaria and the Czech Republic, and arson attacks from Vilnius to Bucharest.
The clearest human thread leads to Oleg Levushkin, a dual Latvian-Russian national suspected by German authorities of preparing the Leipzig attack. His social media presents an ordinary life — motorcycle trips, family holidays, visits to monuments across Europe. But German investigation files show him traveling through Turkey to Berlin in late July 2024, renting a car on July 27th, and appearing near Leipzig Airport on July 31st, where investigators believe he was conducting reconnaissance. The explosives, officials say, entered Germany hidden in cavities inside long-haul trucks routed through Bulgaria and Serbia.
Levushkin's alleged connections reach into the senior ranks of Russian military intelligence. For roughly two decades, he has maintained ties to GRU Colonel Denis Smoljaninov, identified in a Lithuanian intelligence report as the head of the GRU's Ukraine department and a coordinator of covert sabotage campaigns organized via Telegram. Smoljaninov is also linked to a private military company suspected of involvement in the incendiary parcel operation — one parcel caught fire at Leipzig Airport in July 2024, another ignited two days later in Birmingham.
German officials have separately blamed the GRU for a failed incendiary attack on a Munich defense company. Estonia's intelligence service attributed an August arson at defense firm Milrem Robotics to Russian intelligence. The strategic logic, as former BND chief Gerhard Schindler explained it, is not simply destruction — it is fear. Russia wants Western populations to dread direct confrontation and therefore question the purpose of supporting Ukraine. Security officials across Europe expect drone incursions, arson, and hybrid attacks to intensify in the months ahead, with defense companies, critical infrastructure, and individuals connected to Ukrainian support as the most likely targets.
On August 4th, a drone carrying explosives struck a Ukrainian aircraft at Leipzig Airport in Germany and fell intact onto the tarmac. The tin can packed with explosives remained sealed, its metal plate stamped with seven circular indentations. That intact device would become the most valuable piece of evidence investigators had yet obtained in what they now believe is a coordinated Russian intelligence campaign of sabotage spreading across Europe.
Nearly two years earlier, on August 20, 2024, police in Kaunas, Lithuania, acting on a sensitive tip from Poland, excavated a cemetery grave and found two tin cans labeled as containing corn. Forensic analysis revealed they held 968 grams of explosives—roughly 700 grams of TNT equivalent per can, with the destructive force of four hand grenades. In January and June 2025, investigators uncovered more caches in Lithuania. Four of those cans bore metal plates stamped with circular indentations, forensic examination suggesting they were manufactured by the same machine. The resemblance between the Leipzig drone's device and the Lithuanian caches was striking: the same type of tin can, the same stamped metal plate, the same signature.
Two Western security officials, speaking on condition of anonymity, say the physical similarities align with other evidence—travel records, suspected supply routes, and intelligence reporting—that links these separate incidents to a single Russian intelligence operation. German and European officials now believe they are looking at an escalating campaign of sabotage and violence coordinated by Russia's GRU military intelligence service, specifically a unit known as Unit 29155, which has been linked to destabilization operations across the continent.
The clearest trail leads to Oleg Levushkin, a dual Latvian-Russian national whom German authorities suspect of preparing the Leipzig attack. Levushkin is not a low-level operative but a GRU-linked logistics specialist with long-standing connections to senior figures in Russian military intelligence. His social media profiles show a seemingly ordinary life—motorcycle trips to Crimea and the Hungarian-Serbian border, visits to Russian monuments, family vacations across Europe. But according to German investigation files, Levushkin traveled through Turkey to Berlin Brandenburg Airport in late July. He rented a car on July 27. Location data places that rental car near Leipzig Airport on July 31, where investigators believe he was conducting reconnaissance. German officials say the explosives entered Germany via Bulgaria and Serbia, hidden in cavities within long-haul trucks.
Levushkin's alleged connections reach into the upper echelons of Russian military intelligence. For roughly two decades, he has maintained a close relationship with GRU Colonel Denis Smoljaninov, according to German media reporting and the London-based Dossier Center. A December 2025 Lithuanian intelligence report identifies Smoljaninov as the head of the GRU's Ukraine department, a specialist in psychological operations, and a coordinator of covert sabotage campaigns organized across Europe using Telegram. The same report links Smoljaninov to the coordination of Longifolia, a Russian-linked private military company registered in Panama. European investigators suspect shareholders in that company of involvement in an operation that sent incendiary devices to Poland and Britain. One parcel caught fire on July 20, 2024, while being transferred at Leipzig Airport. Another ignited two days later in Birmingham, England.
Lithuanian intelligence explicitly attributes the parcel operation to the GRU's Unit 29155. A November 2025 Lithuanian State Security Department dossier describes the unit as tasked with killings, infrastructure destruction, disruption of institutions opposing Russian interests, and terrorist attacks in Western countries. Its agents are trained in explosives and firearms and skilled at identifying human sources and building agent networks. Unit 29155 has previously been linked by Western governments to explosions at ammunition depots in Bulgaria and the Czech Republic, the 2018 poisoning of former Russian spy Sergei Skripal in Britain, and more recent arson attacks including at an Ikea store in Vilnius and a post office in Bucharest.
German officials have blamed the GRU for a failed incendiary attack on a Munich defense company in September. Estonia's intelligence service stated this week that an August arson attack on defense company Milrem Robotics was commissioned by Russian intelligence. European security authorities expect such operations to intensify in coming months, with defense companies, critical infrastructure, and individuals involved in supporting Ukraine as likely targets. Gerhard Schindler, former president of Germany's BND Federal Intelligence Service, explained the strategic intent: the population is meant to fear direct military confrontation and therefore question the purpose of supporting Ukraine. That is why Russia will increase both military pressure on Ukraine and hybrid pressure on the West. The Russian Embassy in Berlin denied any involvement in sabotage activities. The Kremlin views its relationship with Europe as a systemic conflict, according to Omar Haijawi-Pirchner, former head of Austria's domestic intelligence service, who like others interviewed expects an increase in drone incursions and hybrid attacks.
Citazioni salienti
The population is supposed to fear a direct military confrontation and therefore question the purpose of supporting Ukraine. That is why he will increase both the military pressure on Ukraine and the hybrid pressure on the West.— Gerhard Schindler, former president of Germany's BND Federal Intelligence Service
We firmly reject the baseless allegations concerning Russia's purported involvement in the alleged 'drone incident' at Leipzig Airport, as well as in other 'sabotage activities.'— Russian Embassy in Berlin spokesperson
Vuoi la storia completa?
Leggi l'originale su politico.eu ↗