Deep beneath dense undergrowth, beneath a bridge near Merseburg in Saxony-Anhalt, investigators found a hole in the damp earth. The location, close to the Saale and only a few kilometres from Leipzig/Halle airport, is secluded enough to escape the attention of the occasional dog walker. Storks nest nearby.
It is also, according to an investigation by DIE ZEIT, one of the locations that may have played a role in an attempted attack on Germany that authorities now regard as a potentially unprecedented escalation.
The concealed hole appears to have been deliberately dug and covered with a plate. Beneath it, investigators found remnants of a cable. They suspect it may have served as an intermediate storage site for explosives and components used to construct drones.
The discovery forms part of a growing body of evidence surrounding the attempted attack on 4 August, when a drone carrying explosives struck the wing of a parked cargo aircraft at Leipzig/Halle airport.
What initially appeared to be an isolated incident has since developed into a far more serious investigation. The German government now says Russia was responsible for what it describes as a hybrid attack.
Federal Interior Minister Alexander Dobrindt said on Tuesday, during a joint announcement with Foreign Minister Johann Wadephul, that the means used in the attack were known from other Russian hybrid operations and from Russia’s war against Ukraine. He said individuals had acted “on behalf of Russian state agencies”.
“The German government therefore concludes that Russia is responsible for the hybrid attack in Leipzig on 4 August,” Dobrindt said.
The assertion marks a significant escalation in Berlin’s assessment of the threat. According to the reporting published by DIE ZEIT, investigators believe the operation points towards Moscow, although the investigation remains incomplete.
The attack itself came close to producing a much more serious outcome.
At 19.29 on 4 August, the drone flew over the airport and was recorded by an airport surveillance camera. It approached the apron where Ukrainian Antonov cargo aircraft have been parked since 2022. The aircraft fleet moved its base there following Russia’s invasion of Ukraine, while Nato and the German armed forces also use the planes to transport weapons towards Ukraine.
The drone remained undetected for hours. It was only spotted by a bus driver at around 23.40, after which airport operations were suspended.
Near the drone, investigators found a tin containing explosives. The material was a mixture of RDX and PETN, commonly known as Semtex.
Investigators believe the drone was probably controlled through a relay station established in Kursdorf, a strategically positioned village between the airport’s northern and southern runways. There they found an antenna system attached to a tree with adhesive tape. Its range extended for more than ten kilometres and it apparently served to relay the drone’s video signal.
Another incident initially appeared to suggest that a second drone had collided with a DHL cargo aircraft that same evening. Investigators have since abandoned that theory, according to DIE ZEIT. Although the aircraft was damaged, subsequent examinations found only organic traces, believed to have come from a bird. Investigators now rule out a drone collision.
But the investigation soon uncovered another drone.
Days later, a second drone was discovered in a field at Kabelsketal, immediately west of Leipzig airport. Investigators also found a burn mark there and traces of a military explosive. The site may have been the launch point for both drones.
The explosive device recovered on the airport grounds contained a triggering mechanism resembling those used on Russian drones in the war in Ukraine.
The apparent sophistication of the operation has become a central feature of the investigation. The drone itself was professionally assembled but relatively inexpensive. According to information reported by DIE ZEIT, investigators estimate the material costs at only a few hundred euros. The basic model apparently can be purchased as a kit, while a 3D printer was allegedly used to produce a mechanism for attaching the explosive-filled tin to the drone.
Investigators believe the preparation of the attack — the technology and coordination of its various elements — was carried out by professionals. The final execution, however, is believed to have been entrusted to what investigators describe as low-level agents.
That distinction could be crucial.
German investigators have traditionally viewed Russian intelligence operations in Germany as relying heavily on intermediaries. In previous cases, individuals were recruited to carry out acts such as damaging exhaust pipes or painting suspicious graffiti. Russian-linked operations have also been associated with fabricated websites, disinformation on social media, suspected surveillance drones over German military installations and the recruitment of spies targeting German defence companies.
Such activities remained largely invisible to the wider public.
Leipzig changed that.
The attempted use of a bomb-carrying drone against an airport has brought the possibility of physical attacks much closer to the centre of Germany’s security debate. According to DIE ZEIT, investigators now believe several people were involved.
Since mid-August, Germany’s Federal Prosecutor General has been investigating two suspects, according to information obtained by the newspaper. DNA traces secured during the investigation lead to Lithuania, Finland and Poland, suggesting that those involved travelled extensively.
The investigation remains classified and is far from complete. But investigators have increasingly focused on the configuration of the drones, the explosives and the triggering technology. Together, these elements have strengthened their suspicion that the operation has Russian links.
The political consequences have already begun.
German Chancellor Friedrich Merz and Dobrindt had known since mid-August that Russian agents were probably behind the attack. Shortly before that, a foreign intelligence service had provided information about suspected perpetrators and their connections to Russian intelligence services.
That information was already known when Merz said the previous week: “The German government imposes a price on the perpetrators of hybrid attacks. They will pay for it.”
The question in Berlin was therefore not simply whether Russia should be blamed, but what an appropriate response should look like.
The government decided that the response had to be stronger than its reaction to the 2019 murder of an exiled Georgian in Berlin’s Kleiner Tiergarten, carried out by a Russian intelligence agent. At the same time, officials wanted to leave room for further escalation without unnecessarily intensifying the conflict.
The government therefore rejected using Article 4 of the Nato treaty, the consultation mechanism under which an attacked member can bring the other Nato states together to discuss consequences.
Instead, Dobrindt and Wadephul announced measures including the closure of the Russian consulate-general in Bonn, the termination of the agreement covering the Russian House in Berlin and tighter entry controls for Russian citizens. Russia has announced sanctions in response.
The German government is seeking to send two messages. One is directed at Moscow: Germany believes it knows who carried out the attack and will continue supporting Ukraine. The other is directed at the German public: those responsible will not escape consequences and the attack will be investigated.
But the most difficult questions may still lie ahead.
German officials are already considering the possibility that Leipzig was not an isolated attempt. The investigation has raised questions about how many concealed depots may exist and whether further attacks have already been prepared.
DIE ZEIT reports that investigators uncovered another hiding place during the previous summer containing several firearms and ammunition. Whether it was intended for another attack remains unresolved.
That uncertainty gives the Leipzig case its wider significance.
For years, Russian activity in Germany was largely associated with espionage, influence operations, sabotage and covert recruitment. The Leipzig incident, according to the German government’s assessment, represents something different: an alleged attempt to bring an explosive attack onto German territory using a remotely controlled aircraft.
The evidence assembled by investigators is still being examined, and the full picture has yet to emerge. But the German government has already crossed an important threshold by publicly declaring Russia responsible.
The discovery beneath a quiet bridge near Merseburg now appears as one piece of a much larger investigation — one involving drones, explosives, relay stations, international travel, suspected agents and a trail that German investigators say leads towards Moscow.
The question confronting Berlin is no longer simply who was behind Leipzig.
It is whether Leipzig was the beginning.
