Key actors — tap for context
GRU
The Main Directorate of the General Staff of the Armed Forces of the Russian Federation, i.e. Russian military intelligence. It is also responsible for operations abroad.
Why here: The German files link to it the man who allegedly prepared the logistics for the Leipzig attack.
More info →
Leipzig/Halle
A German airport in Saxony, one of Europe's largest cargo hubs and a logistics point for supplies to Ukraine.
Why here: The site of the attempted attack on 4 August 2026.
More info →Welt am Sonntag
A Sunday newspaper published by Axel Springer, a sister publication of the daily Die Welt.
Why here: It obtained the classified investigative files from which the names and the route of both suspects originate.
MAD
Militärischer Abschirmdienst, Germany's military counterintelligence service. It protects the Bundeswehr from espionage and sabotage.
Why here: On 14 September it published its 2025 annual report, which describes a sharp rise in the threat of sabotage carried out by hired agents.
Skyeton
A Ukrainian group that manufactures the Raybird long-range reconnaissance drone systems.
Why here: The plant in Haniska pri Prešove, where they are produced under its brand, was allegedly the target of an arson attack.
More info →Haniska pri Prešove
A village in the Prešov district with an industrial park.
Why here: It contains the production hall that, according to the indictment, was the target of the planned attack.
ÚBOK
The Bureau for the Fight against Organized Crime, the Slovak police's anti-crime unit.
Why here: It intervened on 22 August, before the attack could take place.
Vladimír Bednár
A Slovak security analyst.
Why here: He explained why the seized incendiary mixture is not a sign of an amateur attack and how the recruitment methods for perpetrators have changed.
Semtex
A plastic explosive originally manufactured in Czechoslovakia, used both in industry and in explosive devices.
Why here: According to investigative materials, the attackers in Leipzig had approximately 1.8 kilograms prepared.
More info →
Antonov An-124
One of the largest cargo aircraft in the world, operated by the Ukrainian company Antonov Airlines.
Why here: The target of the drone in Leipzig, carrying approximately 25,000 liters of fuel at the time of the incident.
More info →What they knew about him and why he wasn't surveilled anyway
In line with the presumption of innocence, German media identify the suspects only in abbreviated form. According to investigators, Russian citizen Oleg L. was in charge of preparation and logistics; he traveled to Germany via Turkey and landed at Berlin Brandenburg Airport. He later flew from the same airport to Serbia. t-online ↗The key sentence in the file states that investigators were aware of his link to the intelligence service at the time of entry, but he was not placed under surveillance. One senior German security official explained this to Welt am Sonntag with two reasons: the authorities' resources were limited, and they did not expect the man to be preparing an imminent attack. Telex ↗
Investigators were led to the suspects by a trace found on an antenna device that was allegedly used to control the drone. According to the files, technicians found remnants of a glove with traces of DNA on it. The explosive is believed to have been transported into Germany via Bulgaria and Serbia, hidden in cavities of freight trucks, and then concealed in underground caches. airliners.de ↗
The investigative materials also change the picture of the attack itself. According to them, the attackers had approximately 1.8 kilograms of plastic explosive prepared, hidden inside a vegetable can. The drone reached the fueled Ukrainian Antonov, and according to the files the charge failed to detonate only because the detonator became detached from it. Investigators found the wreckage of two additional drones near the airport. forum24 ↗
The second man was allegedly hired for a single task
The second suspect, Belarusian citizen Andrei K., entered the Schengen area via Latvia on 28 July, according to Welt — roughly a week before the attack. The files describe him as a man hired solely to carry out the operation, allegedly directed by Oleg L. himself. Welt ↗ According to the investigative materials, the same genetic trace found on the antenna had previously been recorded in Finland and Lithuania, where the man is on record for ordinary criminal offenses. Telex ↗The difference between the two men matters more than their names. One is linked to the intelligence service and left Germany without obstruction; the other has a criminal record in Finland and Lithuania and remains in the file as the operative who carried out the act. SITA ↗
Counterintelligence speaks of a sharp rise in the same threat
On 14 September, Germany's military counterintelligence service MAD published its 2025 annual report, according to which the potential threat of sabotage carried out by so-called low-level agents has grown significantly. These are people hired for individual tasks who are not permanently attached to an intelligence service and can be used for surveillance, espionage, and sabotage alike. This is not a new category — German services already warned against the recruitment of such people in a joint public campaign last year. Bundeswehr ↗ What is new is the scale the report attributes to them. On this particular topic, the report deliberately withholds comparative figures so as not to give the adversary a basis for drawing conclusions. finanzen.net ↗According to the same report, Germany is a priority target of Russian intelligence activities due to its position in Europe and NATO, the expansion of the Bundeswehr, and the introduction of new weapons systems. Aktuality.sk ↗
Near Prešov, the same pattern ended differently
Eighteen days after the Leipzig incident, police in Slovakia intervened in a case that looks similar. On 22 August, the anti-crime unit ÚBOK detained a group that, according to the indictment, was preparing to set fire to a hall in an industrial park in Haniska pri Prešove, where Raybird reconnaissance drones are manufactured under the brand of the Ukrainian group Skyeton. At the time, around seventy employees may have been in the hall. Refresher ↗According to media reports, the main perpetrator, a Latvian citizen, testified during interrogation that he received instructions from several people via Telegram, one of whom communicated in Russian. He was allegedly supposed to smash windows, pour flammable liquid, ignite it, and film the burning building. He was reportedly given the GPS coordinates of the hall a day in advance and was to pick up equipment at a location where another foreigner had previously hidden it. According to Denník N, another person charged is a Ukrainian citizen whose task was allegedly to drive the perpetrator to Poland immediately after the act; he has been held in custody together with the Latvian since 27 August. ta3 ↗ Denník N ↗
Caution is warranted here, as Denník N itself pointed out: not all of the accused's statements are necessarily true. The claim that he was threatened with harm to his family comes from his own testimony, and the court has not yet ruled on guilt. Denník N ↗ Noviny.sk ↗
The case also has a procedural sequel. On 1 September, the District Court in Prešov released one of the suspects, finding that there was not even an indication that he knew of the planned attack. Six days later, the regional court overturned that decision in full and placed the man in pretrial detention on grounds of flight risk and to prevent further offenses, for the particularly serious crime of general endangerment at the preparation stage. The file also includes another Latvian citizen — this 26-year-old man was detained by German authorities in Hamburg on the basis of a European arrest warrant, and Slovak authorities are taking steps toward his extradition. Pravda ↗
The difference from Leipzig is a single one, but a significant one: in Slovakia, police intervened before anything happened, acting on information from the Slovak Information Service and Military Intelligence. Pravda ↗ Security analyst Vladimír Bednár noted to Aktuality.sk that an incendiary mixture of polystyrene and gasoline is not a hallmark of amateurs but a commonly used method that makes firefighting more difficult and increases damage, particularly to electronics. Aktuality.sk ↗
Also read: Police thwarted a napalm attack on a Slovak drone factory
Also read: Moscow retaliated for Leipzig by closing the German consulate in Saint Petersburg
Limits of this account
Almost everything specific in the German part of this story comes from a single source — the investigative files obtained by Welt am Sonntag — rather than from an indictment. The BfV declined to comment on the matter, and surnames are shortened to initials, so neither the suspects' identities nor exactly what the authorities knew about them on the day of arrival can be independently verified. Russia denies any involvement in the incident and calls the German accusations unsubstantiated. HVG ↗Moreover, the similarity between the two files is not proof of a connection. In the Slovak case, no one has officially named who ordered the attack, and Bednár points out that claims of responsibility always need to be verified — in the Czech case from March, he notes, verification showed that the group which claimed responsibility was real, so it was not a false flag. What the two files have in common so far is a shared modus operandi, not a proven order. Aktuality.sk ↗
What hotinfo is following
- Germany's Federal Prosecutor filed formal charges in the Leipzig case and named the service the suspects allegedly worked for.
- The Latvian detained in Hamburg was extradited to Slovakia and joined the defendants in the Presov case.
- The regional court in Presov ruled on the appeals against the custody of the two people charged in August.
- Slovak authorities publicly named who commissioned the attack on the plant in Haniska.
- The German parliament or an oversight body examined whether surveillance failed in the case of a man with a known GRU link.
*Illustrative photo: An Antonov An-124-100M Ruslan operated by Antonov Airlines. Author Md Shaifuzzaman Ayon, Wikimedia Commons, CC BY-SA 4.0.*
