Moscow Retaliated for Leipzig by Closing Consulate in St. Petersburg. Investigation Trail Leads to Northern Serbia

German investigators are examining a lead in the drone attack on Leipzig/Halle airport that points to northern Serbia. The Prosecutor's Office in Subotica as of August 31 is investigating seven people who, according to it, procured and stored explosives, detonators and drones in Serbia and transported them to predetermined locations in European Union countries. German investigators are also examining whether two Serbs detained in June at the Hungarian border have any connection to a person involved in the Leipzig case — though no one has publicly demonstrated a direct link so far. ZDF ↗ Moscow has since responded — Lavrov speaks of the "beginning of real war" and Berlin is preparing a defense plan. Moscow escalated its retaliation shortly after — closing the German consulate in St. Petersburg and all Goethe-Institutes. A sabotage series meanwhile continues on German territory: 21 devices were defused in Saxony near high-voltage power lines and police are searching for a suspect who is fleeing on a bicycle.

What Was Found in Kanjiža and Why Orbán Treated It as a Crisis

On April 5, Serbian President Aleksandar Vučić announced that the army and police had found two backpacks with explosives near the gas pipeline to Hungary. The discovery lay directly at the Balkan Stream — the branch through which Russian gas flows from Turkey through Bulgaria and Serbia to Hungary. Then-Hungarian Prime Minister Viktor Orbán called an extraordinary meeting in response and spoke of an attempt to interrupt supplies. Euronews ↗ France 24 ↗

According to German ZDF, the Serbian military intelligence service secured not only explosives in Kanjiža but also material for their preparation and two metal canisters. At the time it looked like an isolated incident just days before Hungarian elections, which each side interpreted in its own way. According to ZDF, the same prosecutor's office today handles it as part of a larger case file. ZDF ↗

Two Men, Two Cars and a Question No One Has Yet Answered

On June 11, Serbian security forces stopped two separately traveling cars at the Hungarian border. At the wheel were Danilo B., who holds both Serbian and Russian citizenship, and a Serbian citizen listed as S. Đ. The cars contained modified drone components, remote control transmitters, and two metal containers with explosives. From the next day, both have been in custody. t-online ↗

Serbian authorities so far officially prosecute them only for illegal possession of weapons, ammunition and explosives. One is also under investigation for document forgery. No official confirmation from Serbia that they would have any connection to planning an attack in Germany or terrorism has been heard. N1 ↗

According to investigative circles cited by ZDF, the secured components show similarities to the drone found in Leipzig, and German investigators are examining possible personal connections between the two and the person involved in the Leipzig case. This is precisely the point where caution is warranted: similarity of components is not proof of connection, and the station says so plainly — whether the two men or the seized items have any direct connection to Leipzig has not been publicly proven. ZDF ↗

The Chain That Also Leads to Lithuania and Łódź

The attempted attack itself took place on August 4-5 at Leipzig/Halle airport. A drone with explosives hit the wing of a Ukrainian Antonov An-124 near a fuel tank but did not detonate. What exactly the aircraft had on board at that moment remains disputed: part of German media reported ammunition from France intended for the next flight, while WDR, NDR and Süddeutsche Zeitung stated that cargo from the aircraft was unloaded the day before. On September 1, the German government identified Russia as responsible and announced countermeasures, citing police investigation and intelligence findings. NPR ↗

The trail, however, branches not just to the south. Investigators found DNA on the drone that matches a sample from an arson attack on a DHL logistics center in Leipzig on July 20, 2024 — and that leads to Lithuania, where a trial of those charged with package bombs has been underway since spring. The Lithuanian prosecutor's office claims those acts were organized and coordinated by citizens of the Russian Federation connected to military intelligence. One of the suspects in the German case is also linked to an arson attack on a shop in Polish Łódź in July 2024, and he was to enter Schengen on an Italian tourist visa issued in late April in Minsk. Euronews ↗ t-online ↗

Moscow answered German accusations in the language of war. Russian foreign ministry chief Sergey Lavrov called the accusations about the drone incident in Leipzig the "beginning of real war" and said that Merz is effectively declaring war on Russia. This is Moscow's first direct response to what the German government announced on September 1, and rhetorically moves it from a sabotage case to the level of an interstate conflict. It is not documented by anything new in the investigation — it is a statement, not a finding. (Klix.ba ↗, Kyiv Independent ↗, Lietuvos Rytas ↗)

Germany is meanwhile preparing a defensive response. According to Serbian Kurir, Berlin is preparing a plan with special units deployed across the country and with a so-called Cyberdome, i.e., a layer against drones and cyberattacks. Lithuanian LRT writes that Germany is running out of diplomatic means and attacks will increase according to it. (Kurir ↗, LRT ↗)

Moscow retaliated by closing the consulate and all Goethe-Institutes. The Russian Foreign Ministry ordered the closure of the German general consulate in St. Petersburg no later than September 18 and all Goethe-Institutes in Russia, whose employees must leave the country by September 13. It is a direct retaliation for the German sanctions catalog announced after the Leipzig incident, which included the closure of the Russian House in Berlin and the Russian general consulate in Bonn. Putin called German measures a "serious mistake" and spoke of falsified evidence; Russia continues to categorically deny any connection to the drone. Lithuanian 15min calculates from those deadlines that Moscow gave Germany eleven days to close operations. (ORF ↗, Tagesspiegel ↗, FAZ ↗, 15min ↗)

Saxony discovered 21 explosive devices near power lines and the perpetrator is fleeing. Police in western Germany conducted an extensive operation and are searching for a man who, according to Luxembourg Times, is fleeing on a bicycle; Polish Wirtualna Polska reports of discovered detonation devices. Sabotage has thus ceased to be a one-time airport incident and has become a series targeting the power grid. (Digi24 ↗, Luxembourg Times ↗, Wirtualna Polska ↗)

Read also: Berlin Accuses Moscow of Sabotage After Leipzig Incident

Why This Matters for Slovakia

The gas pipeline near which the explosives backpacks lay is not distant infrastructure for Slovakia. Balkan Stream is a continuation of TurkStream, and it was through that route that Slovakia began purchasing Russian gas after transit through Ukraine stopped. Kanjiža lies on the same line, just a few hundred kilometers lower. TurkStream is now the only route through which Russian gas still flows into the European Union. Pipeline Technology Journal ↗ ta3 ↗

The second thing is the method of operation that German media, citing security sources, describe. It is not supposed to be about sent officers but about people hired for one task — to procure material, transport it, store it at an agreed location. This is precisely why such a model is cheap and hard to prove: when someone gets caught, the link is missing that would show who paid them. Slovakia is on the same route and in the same space of free movement. N1 ↗

Limits of This View

Most of the specifics come from German media citing security circles, not from indictment. The Serbian side has so far confirmed nothing beyond weapons paragraphs, and the names of suspects in German texts are listed only by initials, which prevents independent verification. Sources also differ on what explosive was on the drone — some mention pentrite, some semtex — so the text only states it was plastic explosive.

The question also remains open whether Serbian authorities will actually investigate the case to the end. Belgrade has not imposed sanctions on Moscow and at the same time is negotiating EU membership — this fork may suit it to show activity while letting the matter fade. And finally: even if all three trails — Kanjiža, Leipzig, Lithuania — were confirmed, they would prove a network of suppliers, not an order. That link in the chain is still missing.

What hotinfo Is Monitoring

Illustration photo: cargo apron at Leipzig/Halle airport. Author Molch-Entertainment, Wikimedia Commons, CC BY-SA 3.0 DE.