Can Germany Contain Russia's Hybrid War on Its Soil?

The Cargo Hub That Became a Target

On August 4, 2026, German investigators found an explosive-laden drone near a Ukrainian Antonov An-124 at Leipzig/Halle Airport — the device failed to detonate, and the technical defect that saved the aircraft is not a comfort but a variable in Russia's escalating sabotage campaign against Europe. Germany's sabotage reckoning has arrived: the federal government has formally named Russia as the author of a coordinated hybrid war campaign targeting critical European infrastructure.

Hostomel Airport, March 2022: Russian forces seized it in the first hours of the invasion, destroyed the infrastructure, and grounded Ukraine's heavy-lift capacity on the spot. The calculation was straightforward — knock out the airfield, knock out the logistics. What that calculation did not account for was Leipzig/Halle, roughly 1,700 kilometres to the west, which quietly absorbed what Hostomel lost. Since 2022, Leipzig has served as the operational base for Antonov Airlines and its An-124 heavy transports, making it the de facto western terminal for Ukrainian military freight. Moscow's planners, evidently, updated their maps.

The following day, a second drone reportedly collided with a DHL cargo aircraft operating near the same airport, causing minor damage.

The airport's dual function is the point. Leipzig/Halle is simultaneously a hub for Ukrainian military logistics and one of Europe's busiest commercial cargo nodes. That overlap is not incidental to Russian targeting logic — it is the logic. A strike against a Ukrainian military transport at a civilian airport generates legal and political friction for Germany, muddies attribution, and signals to commercial operators that proximity to Ukrainian freight carries a price. The technical defect that saved the An-124 on August 4 is not a comfort. It is a variable.

Interior Minister Alexander Dobrindt said, plainly: "The federal government concludes that Russia is responsible for the hybrid attack in Leipzig." The drone components, he added, match patterns documented in Russian operations inside Ukraine.

From the Letterbox to the Substation: A Campaign in Stages

The opening move was small, almost domestic. In July 2024, incendiary packages ignited at DHL logistics centers in Leipzig and Birmingham — devices small enough to pass through a sorting facility, timed to catch in transit. No one died. The damage was contained. What the episode established, quietly, was not a capability ceiling but a baseline: someone was testing the sorting logic of European cargo infrastructure, and noting which seams held heat.

Two years later, the register had shifted. On September 1, 2026, police discovered more than ten improvised incendiary devices at a power substation near a coal-fired plant in Brandenburg. The following day, North Rhine-Westphalia authorities opened an investigation into a sabotage attack against a substation near Bergheim. Two substations, two German states, two consecutive days — not coincidence of timing but, read carefully, evidence of coordination.

The line from a letterbox in Leipzig to a substation in Brandenburg traces a methodical escalation: from low-mass devices designed for denial, through drone-mounted explosives at a civilian airport, to direct attacks on grid infrastructure.

Each step mapped a new category of German critical national infrastructure. The DHL packages probed logistics. The Leipzig drone targeted aviation and, specifically, Ukrainian military cargo. The substations targeted power. What this sequence suggests is less a series of provocations than a systematic survey — conducted at operational tempo, with enough distance between incidents to allow attribution to blur. Ask the small question first: who benefits from a German grid that flickers under pressure? The answer does not require speculation.

The Gig-Economy Soldier and the Problem of Attribution

German officials confirmed what Western intelligence services had been documenting for two years: the operatives placed near Leipzig/Halle Airport were not professionals. They were proxies — recruited through the same low-friction channels that source warehouse workers and delivery drivers, handed a task, and cut loose. Interior Minister Alexander Dobrindt noted that drone components recovered from the August 4 incident match patterns documented in Russian operations in Ukraine. The hardware is traceable. The hand that placed it is not.

This is the structural logic of the recruitment chain. An agent recruited via social media to move a package, check a location, or leave a device at a coordinate may know nothing beyond the next instruction and the promise of payment. Plausible deniability is not an accident of the operation — it is the operation. The principal is insulated by exactly as many layers as the task requires.

What remains unresolved is significant. German investigators have not publicly confirmed whether the specific agency behind the Leipzig drone plot was the GRU or the SVR — a distinction that matters for understanding whether this is military intelligence pursuing battlefield logistics targets or foreign intelligence running a broader coercion campaign. Nor is it established how far down the chain knowledge of the Russian state connection ran. The proxies may have understood they were doing something illegal. Understanding they were doing it for Moscow is a different threshold entirely.

Ask the small question first: who bears the legal burden when the principal is invisible, the agent is disposable, and the hardware alone connects the operation to a foreign power? Attribution without a named officer and a named agency produces a diplomatic note. It does not produce a prosecution.

A state running roughly 200 incidents across a continent, absorbing the diplomatic cost in controlled increments, and waiting to learn what the threshold actually is.

Berlin Names the Author of Russia's State-Sponsored Campaign

On September 1, 2026, the German government did what governments rarely do until they are certain they cannot be embarrassed by doing it: it named Russia. Interior Minister Alexander Dobrindt stood before cameras and said the words plainly — "The federal government concludes that Russia is responsible for the hybrid attack in Leipzig." The Russian ambassador was summoned to the foreign ministry the same day to receive the formal protest. That is a choreography Berlin knows well, though it has seldom deployed it at this register.

Germany's national security threat level moved from "general" to "high." The distinction matters less for what it changes operationally than for what it signals publicly — that the assessment of intent has shifted, not only the assessment of capability. Kaupo Rosin, the director general of Estonian foreign intelligence, had offered the crisper framing some days earlier: this is not hybrid war, it is state-sponsored terrorism. The German official language that followed was notably close to Rosin's. That convergence is not accidental. It marks something — a synchronized Baltic-German intelligence posture that has been building quietly inside NATO since 2022, and which is now surfacing in aligned public attribution.

NATO Secretary General Mark Rutte went further: hybrid attacks against a member state, he said, could trigger Article 5. The statement was careful — "could," not "will" — but the threshold had been named aloud, which is its own kind of pressure. Rosin's services had already documented what the Leipzig drone made visible: Russian sabotage is increasingly targeting defense industry logistics and manufacturing, the sinew that keeps Ukrainian resupply moving. The drone at Leipzig was aimed at a node, not a symbol. That distinction is the load-bearing wall.

The Consulate, the Cultural Centre, and the Intelligence Reform

The Russian consulate in Bonn closes on September 18. The operating contract for the Russian House cultural centre in Berlin has been rescinded. Both moves are legible, proportionate, and largely symbolic — the standard diplomatic register for a government that has named its adversary but is not yet prepared to treat the conflict as what it is.

Compare 2018: Britain expelled 23 Russian diplomats after Salisbury, and Sergei Skripal's poisoners were subsequently identified, publicly named, and never extradited. The expulsions produced headlines. They did not produce deterrence. The question now is whether Berlin's September response belongs to the same category — diplomatic furniture arranged to signal outrage — or whether it rests on a load-bearing wall.

The NDRefG reform bill, passed in August 2026, suggests Berlin is at least asking that question seriously. German intelligence — the BND and BfV — operated for decades under a legal framework that permitted observation and reporting but not operative intervention against foreign agents on German soil. That era has formally ended. The new powers allow the services to move from watching a proxy network to disrupting it. The gap between diplomatic expulsion and operational disruption is precisely the structural question for deterrence. Closing a consulate removes cover positions; it does not remove the capability. The real test of the NDRefG is whether German intelligence can now reach the network before the next device is placed, not after it fails to detonate.

Watch the Eighteenth of September

Approximately 200 Russian-linked security incidents have been recorded across Europe in recent years, by AP News's count. None has yet produced a mass-casualty event. That arithmetic will not hold indefinitely, and everyone in the relevant ministries knows it.

The Bonn consulate closure on September 18 is the nearest checkable marker. Watch what Moscow does with it. A quiet withdrawal, processed through diplomatic protocol, suggests the campaign's exposure has raised the operational cost enough to prompt recalibration. A manufactured counter-incident, a reciprocal expulsion dressed as principle, or a fresh kinetic action before the deadline would suggest the opposite: that Berlin's attribution produced diplomatic furniture, not deterrence.

One development would change the read entirely. A confirmed prosecution naming a Russian handler operating through a documented proxy chain would be the first time the full accountability loop closed in public. That has not happened yet. Until it does, Russia's hybrid war against Europe continues on its own terms — a state running roughly 200 incidents across a continent, absorbing the diplomatic cost in controlled increments, and waiting to learn what the threshold actually is. September 18 is not an answer. It is the next data point.