BERLIN—A massive cargo plane, used to carry military assistance to Ukraine and parked at an airfield in eastern Germany, was attacked by explosive-packed drones in early August. German officials say they were piloted by Russian military-intelligence agents.
One drone slammed into the Antonov freighter but failed to explode. Another collided with a different plane, and a third detonated near the airport perimeter, authorities say. Had the assault worked as planned, investigators say, the result would have been mayhem and casualties at one of Europe’s most important air-cargo airports.
U.S. intelligence agencies say the failed operation at Leipzig-Halle Airport this summer was one of the opening shots in a stepped-up campaign of sabotage and covert action against NATO countries ordered directly by Russian President Vladimir Putin , according to European officials briefed on their findings.
Russia’s intensified campaign comes as Ukrainian forces, with European support, have largely fought the Russian army to a standstill on the ground, inflicting heavy losses and preventing significant territorial gains over the past year. Kyiv is increasingly hitting targets deep inside Russia, including refineries and the warehouses of Russia’s largest e-commerce firm.
NEWSLETTER TABLE TALK
Never miss a story.
Subscribe now.
The most important news & topics every week in your inbox.
There was growing frustration in Moscow this summer, the officials said, that neither fighting on the ground nor negotiations with Washington were getting Ukraine to agree to the concessions Putin wanted .
“The Kremlin is disappointed that the talks with the United States have not led to the rapid normalization of relations they had hoped for,” said Thomas Graham, a former senior U.S. official now involved in informal talks with the Kremlin.
Aides to German Chancellor Friedrich Merz say that if the Leipzig attack had resulted in large numbers of casualties, they would have considered invoking the collective-defense provision of the North Atlantic Treaty Organization, known as Article 5, which would oblige the rest of the alliance to rally to protect Germany.
The provision—invoked only once before, after the Sept. 11, 2001, terrorist attacks—commits alliance members to assist an ally subjected to an armed attack. The response, however, could range from diplomatic support to a military strike.
Since the Leipzig attack, European countries have seen a sharp uptick in so-called gray-zone assaults . In August, arsonists struck drone manufacturers in Estonia and Poland. That same month, Slovak authorities said they thwarted a planned arson attack on a Ukrainian drone factory there.
In recent weeks, Poland, Lithuania and Bulgaria have all reported sabotage attacks on Starlink stations. There has also been a series of drone attacks on commercial ships in the Black Sea, near the waters of NATO members Bulgaria and Romania.
European leaders are publicly warning about the risks and privately debating how best to respond. “Russia is waging a war on Europe; not just on Ukraine, but also against us,” Merz said earlier this month.
The Kremlin didn’t respond to a request for comment.
Russia has denied involvement in sabotage operations in Europe. In response to Berlin’s accusations about the targeting of the Leipzig airport, Putin said in early September: “Where is the evidence?”
Secretary of State Marco Rubio warned earlier this month that the escalation could spill into NATO countries and “quickly turn what is a war between two countries into a much broader and far more dangerous regional conflict.”
Earlier this month, President Trump said he had reached a deal with Putin to provide diesel fuel to the U.S. and global markets in an effort to ease prices. Last week, he also halted sanctions that were set to be imposed on Russia under a bipartisan bill, drawing criticism from members of Congress. Trump said in a social-media post Sunday his decision on Russia was aimed at keeping them at the bargaining table and out of the war with Iran.
The White House didn’t respond to a request for comment.
CIA Director John Ratcliffe traveled to Moscow in late August in an effort to revive negotiations and to warn Russia against escalating its attacks on European allies. Afterward, Ratcliffe personally warned European intelligence counterparts and selected political leaders that Moscow was intensifying sabotage operations against their countries, according to people who received the warnings.
The CIA didn’t respond to a request for comment.
Russia’s clandestine attacks are being led by a branch of Russian military intelligence, or GRU, according to Western officials. The branch, known as the Special Tasks Service , or SSD, is an organization formed in 2023 by merging some of Russia’s most lethal clandestine units under a mandate to wage covert warfare against Europe.
The SSD is commanded by Col. Gen. Andrey Averyanov, a veteran of clandestine warfare whose operatives have been linked to assassinations, poisonings and bombings across Europe . Western intelligence has traced the Leipzig attack to one of his department chiefs, Col. Denis Smolyaninov, who is under European Union and British sanctions for directing Russian covert operations in Europe.
Western intelligence previously identified Smolyaninov as one of the commanders behind a plot to smuggle incendiary devices into the DHL parcel network. Investigators believe the operation was ultimately intended to bring down civilian airliners flying to Britain and North America.
The Leipzig operation involved at least three drones that were packed with military-grade Semtex explosives and positioned in bushes and beneath trees outside the airport perimeter, investigators said. Equipped with German 5G mobile-phone cards, the drones could be piloted remotely over the internet. German cyberintelligence officials traced the communication to servers previously used by the GRU.
The attack was part of a broader effort to position agents, explosives and weapons across Europe to strike targets supporting Ukraine and sow chaos that could strengthen political opposition to military aid for Kyiv, according to investigators and intelligence officials.
Investigators have uncovered networks smuggling explosives, drones and weapons into the EU, along with safe houses and concealed underground caches near airports, arms manufacturers and other potential targets.
German investigators believe the Leipzig operation’s ground logistics were coordinated by Oleg Levushkin, a former Russian military officer recruited by the GRU following a criminal conviction.
Levushkin directed several Belarusian operatives who transported explosives across borders, assembled the drones and positioned them for the attack, according to investigators and intelligence officials.
The network used Serbia as a logistics hub to move modified drones and explosive devices toward Germany. Military-grade Semtex was smuggled in resealed food cans fitted with detonators. Added steel plates turned the devices into fragmentation bombs designed to scatter deadly shrapnel, investigators said.
Serbian authorities subsequently arrested seven suspects, including a dual Russian-Serbian citizen, accused of belonging to an organized group that procured and stored explosives and drones before shipping them into EU countries, Serbian prosecutors said.
Two days before the Leipzig attack, Levushkin and at least one Belarusian accomplice flew from Germany to Serbia and onward to Russia.
After the failed attack, a Kremlin official serving as a back channel to the German government contacted his counterpart in Berlin, according to officials familiar with the exchange.
Leipzig, he warned, wouldn’t be the last attack.
Write to Bojan Pancevski at bojan.pancevski@wsj.com