While cyberattacks, sabotage attempts, and disinformation operations, for which Russia is held responsible, have repeatedly come to the fore in Germany in recent years, the discovery of an explosive-laden drone (UAV) at Leipzig-Halle Airport on August 4, in particular, has escalated Berlin's accusations against Moscow to a new level.

German authorities claim that Russia has resorted not only to cyberattack and disinformation methods but also to sabotage activities that could target critical infrastructure and military facilities.

While statements by government members and officials regarding various incidents have drawn attention to Russian intelligence activities in Germany, in some cases, the Russian connection has not yet been proven.

The information systems of the German Federal Parliament (Bundestag) were targeted by a large-scale cyberattack in May 2015. A significant portion of the Parliament's IT infrastructure was rendered unusable for days due to the attack.

The German government later announced in subsequent years that the APT28 group, affiliated with the Russian military intelligence service GRU, was behind the attack.

It was claimed that after Russia launched the war in Ukraine in 2022, Germany also became the target of extensive disinformation operations.

In the alleged coordinated disinformation campaign starting from May 2022, fake news was published by imitating the websites of German media organizations such as Spiegel, Frankfurter Allgemeine Zeitung, Bild, Welt, Süddeutsche Zeitung, and Tagesspiegel.

It was argued that attempts were made to influence public opinion on issues such as Ukraine, energy prices, migration, and trust in the German government, using fake accounts, manipulated videos, and altered versions of real political statements via social media.

The arrest of two German-Russian dual citizens in Germany in April 2024 on suspicion of preparing sabotage on behalf of Russian intelligence showed that accusations against Moscow had escalated to the dimension of physical attack preparations.

It was alleged that the suspects planned actions that could target Germany's military support to Ukraine and conducted reconnaissance at military facilities and the US military training center in Grafenwöhr.

A package catching fire at the DHL cargo center at Leipzig-Halle Airport in July 2024 brought the sabotage discussions in Germany to a new dimension.

While a self-igniting fire device was found inside the package, similar packages causing fires in the UK and Poland led to the assessment that the incidents could be part of a coordinated sabotage operation.

German security authorities focused on the possibility that "low-level agents" used by Russian intelligence could be behind the incidents.

The administrative information systems of the German Air Traffic Control (DFS) were also subjected to a cyberattack in August 2024.

While it was stated that the attack did not directly affect air traffic, German authorities attributed the attack to the GRU-linked APT28 group.

It was claimed that the incident was part of a broader Russian cyber espionage campaign targeting government institutions and companies in Germany.

The German government announced that the cyberattack targeting the leadership of the ruling coalition partner Social Democratic Party (SPD) was also carried out by APT28.

The Federal Public Prosecutor's Office filed charges against three German-Russian citizens, accusing them of acting on behalf of Russian intelligence.

The defendants were charged with preparing explosive and arson attacks targeting industrial facilities and military infrastructure.

In the investigation, it was alleged that the main suspect discussed sabotage actions in Germany with a person stated to be a member of Russian intelligence.

German authorities also drew attention to a Russia-linked disinformation network called "Storm-1516".

It was stated that the operation used fake news websites, artificially generated images, false witness testimonies, and so-called investigative journalism content.

The German government linked the campaign to Russia, stating that the operation aimed to influence the 2025 Bundestag elections and weaken Germany's political stability.

One of the latest and most striking links in the chain of Russia accusations in Germany occurred at Leipzig/Halle Airport.

On August 4, 2026, an explosive-laden UAV was reportedly found near the airport, in an area where Ukrainian cargo planes are located.

The German government announced on September 1 that Russia was behind the incident.

Berlin stated that the incident bore similarities in method and organization to Russia's previous hybrid operations.

This statement stood out as one of the most serious recent examples where Germany directly held Russia responsible for an attempted physical attack on its territory.

The German Federal Office for the Protection of the Constitution warns that Russia is simultaneously employing methods of sabotage, cyberattacks, espionage, political influence operations, and disinformation against Germany.

According to the agency, critical infrastructure, economy, politics, society, science, the military, and digital infrastructure are among the targets of Russia-sourced activities.