German investigators now count three drones around the failed 4–5 August attack on a Ukrainian cargo plane at Leipzig airport, Tagesschau reported on 25 August. Officers found the third machine and a suspected military explosive in a field near the runways. Security circles assume Russian intelligence services helped plan the attempt, and Russia denies any role.

A third drone and about 50 grams of suspected hexogen

Investigators found the third drone on the early evening of 14 August in a field in Kabelsketal, security circles told NDR, WDR, and the newspaper Süddeutsche Zeitung (SZ). The area borders the airport's western edge in Saxony-Anhalt. Forensic technicians from Germany's Federal Criminal Police Office (BKA) arrived that day, and the next day they reportedly found a substance at the site. First assessments put it at about 50 grams of hexogen, a military explosive known internationally as RDX. The perpetrators may have had a far larger attack in mind than what has become public, according to Tagesschau. 

The target was a Ukrainian plane

The drone found on the tarmac was meant to hit a Ukrainian Antonov cargo aircraft that moves military goods, according to the investigation cited by the public broadcasters NDR and WDR and SZ. The bomb never went off, because its detonator was apparently defective. The plane had been apparently loaded with ammunition the previous day. Leipzig/Halle carries military freight for the German armed forces and NATO allies, and Ukraine's Antonov Airlines uses it as a base, Euronews reported the same day.

Explore further

A bomb-laden drone hit a Ukrainian An-124 in Germany, then lay unnoticed for hours

The first drone turned up on the airport grounds at around 23:42 on 4 August. Shortly afterward, at about 00:03, a second drone reportedly collided with a cargo plane of the delivery company DHL. That aircraft had broken off its landing because the first find shut the airport, and it probably hit the drone at fence height at several hundred kilometers per hour. Neither that drone nor parts of it have turned up, NDR, WDR, and SZ reported. The German broadcasters placed the damage on the tail unit, while Bild gave a different account, putting the collision about six kilometers out with minor damage to the nose, Euronews said.

Camera footage analyzed after the attempt showed a quadcopter carrying Semtex plastic explosive fly into the wing of a parked An-124 Ruslan without detonating, and Washington assessed that the drone belonged to Russian intelligence. The same airport saw a parcel ignite in July 2024, before crews could load it onto a DHL cargo plane, in what security services treated as a suspected Moscow-linked arson plot.

State-protection officers at the BKA work under orders from Federal Prosecutor General Jens Rommel to establish how the attack was meant to run and who is responsible. Investigators are following several leads, among them recovered DNA. Germany ranks among Ukraine's biggest military backers, and its authorities suspect Russia of orchestrating many of the drone incidents as part of a campaign of sabotage, espionage, and disinformation, Euronews said.

Polish officers have detained a Ukrainian accused of trying to murder a figure from Ukraine's weapons sector on Moscow's orders, Reuters reported. Investigators say his homemade explosive failed to detonate, and he fled to Poland, where officers detained him. The case is the latest in a run of Russian-directed plots targeting people tied to Ukraine across Europe.

A car bomb that failed

The suspect, named only as Serhii P. under Polish privacy rules, allegedly went after a figure in Ukraine's weapons sector in Irpin, a town in Kyiv Oblast just northwest of the capital. The ABW, Poland's Internal Security Agency, said he planted an improvised explosive device under a car used by the potential victim. The device was meant to be set off remotely with a cellphone, but it "did not detonate due to a malfunction," the agency said.

The suspect, a 63-year-old Ukrainian, fled to Poland after the attempt collapsed and was arrested in Warsaw on 5 August 2026, the Ukrainian outlet NV says. Polish authorities announced the arrest on 20 August and said it kept him from using Poland as a hideout while he dodged investigators. Prosecutors charged him with trying to kill with a bomb and with holding explosives without a permit. The charges carry a floor of 15 years behind bars and a ceiling of life, they said.

Explore further

Ukraine detains organizer of defense industry event struck by Russian missile that killed 10, charged with negligence

The ABW framed the case as proof that Russian intelligence runs operations far beyond its own borders, using people who move between countries to do the work. For years, Kyiv and Western capitals have said Moscow enlists people — Ukrainians among them — to run sabotage and spying missions, a charge Russia keeps rejecting.

A pattern across Europe

The plot fits a wider Russian campaign. Weeks earlier, Warsaw detained a Russian man whom Moscow had allegedly recruited to murder a Ukrainian-American in the same city. 

Earlier this year, Ukrainian investigators recently exposed a coordinated scheme to kill a Russian dissident and Ukraine supporter in Lithuania, German prosecutors filed sabotage charges against a Ukrainian and a Latvian, and an earlier plot targeted the chief of German arms-maker Rheinmetall.

Poland and the Baltic States have been named prime targets for Russian sabotage over their backing for Kyiv.

A deliberately set fire at a Tallinn building used by Milrem Robotics did not disrupt its deliveries of military ground robots to Ukraine, CEO Kuldar Väärsi told Reuters on 19 August 2026. Estonian prosecutors said three suspects had been detained in Latvia.

The Milrem arson case fits in a broader pattern of suspected or confirmed sabotage against Ukraine’s military supply chain. Similar attacks throughout Europe have hit plants making drones, thermal optics, and other equipment for the front. Milrem supplies unmanned ground vehicles (UGVs) that help Ukrainian units move supplies and evacuate wounded without putting drawing upon valuable manpower.

The fire broke out overnight on 15 August in Tallinn’s Lasnamäe district after a resident reported suspicious activity. Nobody was injured, and Milrem has not disclosed what was damaged.

Milrem says it is one of only two foreign suppliers with unmanned ground vehicle (UGV) fleets in active Ukrainian service and expects more than 200 of its systems to be operating there by year-end.

The Netherlands is funding more than 150 additional Milrem vehicles for Ukraine. In June, Milrem and VDL Defentec opened a Dutch production line to support the delivery of more than 100 THeMIS UGVs. Väärsi the fire had not affected production, supply chains, or delivery schedules for this year or next.

Unmanned ground vehicles (UGVs) are tracked or wheeled machines with no crew aboard. ArmyInform reported that Ukrainian troops use them to carry ammunition, fuel, and food along exposed routes. A Ukrainian commander identified only as Nazar told ArmyInform that frontline units still rely mainly on UGVs for logistics, although some robots carry explosives.

Three suspects detained as investigators examine possible Russian role

State Prosecutor Gardi Anderson said prosecutors suspect all three detainees of taking part in the arson. Latvian authorities are holding them while the two countries arrange their transfer to Estonia. An Estonian court approved prosecutors’ requests to place two in pretrial detention. A decision on the third remained pending.

Estonian Prime Minister Kristen Michal said investigators were examining whether the fire was the result of sabotage and whether Russia was involved. Authorities have not disclosed the suspects’ alleged motive, whether anyone directed them, or released evidence connecting the attack to Moscow.

Arson has hit other European suppliers to Ukraine

In March, a fire destroyed nearly all of the production capacity at a Czech plant that makes drones and thermal optics for Ukraine. Authorities detained four suspects while investigating possible terrorism and Russian involvement.

Lithuania also charged six people over an attempt to burn a factory supplying radio-wave scanners to Ukraine. Investigators said Russia-based organizers with GRU links coordinated the operation and connected the network to attempted attacks elsewhere in Europe.

Russia has denied Western accusations that it conducts sabotage in Europe.

Estonia is investigating whether Russia was behind a suspected arson attack at a Tallinn building used by Milrem Robotics, Prime Minister Kristen Michal said on 18 August.

Officials have not released evidence yet connecting Moscow to the fire.

The fire hit a site used by a defense contractor that makes unmanned ground vehicles, including THeMIS vehicles used in Ukraine. The Estonian investigation into the Milrem fire comes amid suspected or confirmed arson plots against other European factories supplying Ukraine.

Estonian prosecutors said the fire, which began overnight into 15 August, may have been deliberately set. A resident reported suspicious activity nearby. Investigators identified suspects and asked a court to detain them. No one was injured, and Milrem CEO Kuldar Väärsi told the Estonian outlet Postimees that it was too early to assess the damage.

The company executive said the site was not an office building but declined to identify its contents or what was damaged, including whether unmanned ground vehicles were inside. The company has not said whether production or deliveries were affected.

Milrem’s THeMIS vehicles have operated in Ukraine since 2022. By 2023, the company had delivered 15 of the vehicles to Ukrainian forces and border guards. A Dutch-funded order for more than 150 additional vehicles followed in 2025. A new Dutch production line began making them in June 2026 and handed over its first vehicles for Ukraine.

Other factories supplying Ukraine have faced arson

In March, a fire damaged a Czech facility belonging to LPP Holding, which had supplied hundreds of AI-guided drones to Ukraine. Czech authorities investigated possible terrorism and later detained a fourth suspect.

In January, Lithuania charged six people over an attempt to burn a factory supplying radio-wave scanners to Ukraine. Investigators said Russia-based organizers with GRU links coordinated the operation and connected the network to attempted attacks elsewhere in Europe.

Estonia has traced earlier attacks to Russian intelligence

Estonia has also uncovered Russian-directed attacks on its own territory. In 2024, Estonia’s security service detained 10 people over a Russian-coordinated operation that included damaging cars belonging to then-Interior Minister Lauri Läänemets and a journalist and defacing monuments. Officials said the operation sought to spread fear and tension. Journalists from The Insider, Re:Baltica, and Delfi reported how the GRU recruited Baltic residents for vandalism and arson.

In 2025, an Estonian court found that a Moldovan national working for the GRU burned a supermarket as a trial run before firebombing a Ukrainian restaurant in Tallinn. His cousin filmed the second attack.

Those cases explain why investigators are examining a possible Russian role in the Milrem fire, but they do not establish who caused it.

Russia may expand hybrid attacks against Poland and the Baltic states, including infrastructure sabotage or false-flag attacks, Bloomberg reported on 12 August, citing an unnamed European intelligence official. 

The warnings come amid concern that Moscow wants to intimidate Ukraine’s supporters. The CIA warning follows Russian threats, incursions, alleged sabotage plots, and disinformation against Poland and the Baltic states. Most Western military aid reaches Ukraine through Poland, while the Baltic states rank among Kyiv’s strongest supporters. Sabotage of transport, energy, or communications can slow aid delivery and test NATO while hiding Russia’s role.

Separately, a European government official told Bloomberg that the CIA had warned countries in the region of a possible future Russian attack. The CIA declined to comment.

The same official said Russia might instead be creating the impression of an impending attack to sow fear as part of an information operation. The official saw no signs that Moscow was preparing a conventional attack or invasion.

Moscow tests NATO’s eastern flank

Poland and Lithuania had already raised similar concerns. In July, Poland said it had credible intelligence that Russia was planning new provocations. Lithuania later warned that Moscow might rebuild captured Ukrainian drones for false-flag strikes on critical infrastructure.

In September 2025, between 19 and 23 Russian drones entered Polish airspace, shutting down airports and damaging buildings. Poland closed four airports as NATO aircraft responded.

Meanwhile, five people are on trial in Lithuania over attacks allegedly organized for Russian military intelligence in 2024, Bloomberg reported. Lithuania has reinforced infrastructure sites and deployed troops since June.

These warnings and incidents place the CIA alert within a wider pattern of pressure on NATO’s eastern flank and Ukraine’s supporters. 

How Russia strikes without starting a war

Bloomberg cited several recent unexplained drone incidents in Germany alongside the CIA warning. Citing Die Zeit, Euromaidan Press reported that an explosive-laden drone struck the wing of a parked Ukrainian An-124 at Leipzig-Halle airport and failed to detonate. A US Defense Department official in Europe told CNN that Washington assessed the drone belonged to Russian intelligence. 

Bloomberg also reported that a cargo plane hit an unidentified object and that drones appeared over a military base the following day. It did not connect either incident to Russia.

More broadly, Russian hybrid operations have grown sharply since the full-scale invasion. CSIS found that attacks in Europe tripled from 2023 to 2024, after quadrupling the previous year. Separately, the US Helsinki Commission mapped nearly 150 operations in NATO territory attributed to or suspected of Russia between February 2022 and November 2024.

Retired Lt. Gen. Ben Hodges told Euromaidan Press in February that attacks on ports, railways, and cables can probe routes needed for NATO reinforcements. Their deniability raises the political cost of responding.

By hiding its role, Moscow can disrupt support for Ukraine and test NATO without openly starting a war. 

German security services believe Russia was preparing to assassinate the head of a company that supplies drones to Ukraine, according to Die Zeit. Two suspected agents who surveilled him have been arrested, and officials warn the case marks a deadlier turn in Russian operations inside Germany.

Surveillance of a drone-maker

Investigators say the target is Stefan Thumann, head of the Bavarian startup Donaustahl, which makes reconnaissance and kamikaze drones for Ukraine. In December 2025, a recruit filmed his home and photographed the nameplate, focusing on the man rather than the company, security services believe. Thumann has been outspoken against Moscow, posting that "Russia doesn't want peace. It wants the destruction of the West."

Two arrests

A foreign intelligence service flagged Thumann as high-risk in December 2025. Bavarian police arrested Serhii N., a former bricklayer from Kharkiv with no intelligence training, then released him before analyzing his phones. The devices later showed contact with Russian intelligence and attempts to trail his father, investigators found. He fled to Spain, and a Romanian woman, Alla S., continued the surveillance. Both were arrested in March 2026, in Spain and North Rhine-Westphalia.

Explore further

Fourth suspect arrested in arson attack on Czech factory that made drones and thermal optics for Ukraine

Russia recruits such disposable agents online, paying people from precarious backgrounds for surveillance, arson, and sabotage, and discarding them afterward. Ukraine's own SBU security service has reported dozens of cases in 2026 of Russia recruiting Ukrainians at home for arson and sabotage, often by forging Ukrainian security summonses to pose as their own government.

The BfV, Germany's domestic intelligence service, classifies the case as a suspected planned assassination. A federal investigating judge was not convinced, so the arrest warrant cites only suspected intelligence-agent activity. Lawyers for both suspects declined to comment.

Explore further

A French factory that makes drones for Ukraine was firebombed with Molotov cocktails

A widening threat

A second German arms company is reportedly in Russian intelligence's sights, investigators say. On 11 June, Serbian officers stopped a truck of concealed explosives apparently bound for Bavaria, home to Donaustahl, Quantum Systems, and Helsing. 

The threat has precedent: agents had Rheinmetall chief Armin Papperger watched in 2024, and an FSB killing struck a Georgian exile in Berlin in 2019. It fits a broader Russian sabotage campaign across Europe. 

Thumann, now under guard, still taunts Moscow: 

"You won't break me."