(TLP:CLEAR) Thwarted Drone Attack at German Airport Underscores the Growing Hybrid Threat from Hostile Nation States

Summary: Last week, an explosive-laden drone found at Germany’s Leipzig airport, which was almost certainly being used to target civilian cargo planes, was linked to the Russian government, according to U.S. intelligence. In brief, the physical security risk to critical infrastructure entities, including water and wastewater utilities, from hostile nation states—primarily Russia, China, and Iran—has increased in recent years.

Analyst Note: WaterISAC has frequently reported on Russia’s ongoing sabotage campaign across Europe, which accelerated following its full scale invasion of Ukraine in 2022 and has included suspicious events at European water and wastewater utilities and attempts to contaminate drinking water supplies. In February 2025, for example, unknown individual(s) attempted to contaminate the drinking water system on a German naval ship while it was docked in port. Investigators found dozens of liters of used oil had been introduced into the drinking water system; an accidental contamination was ruled out. In the end, there was no public health impact because the ship crew detected the contamination early.

In this latest incident, linked to Russia’s sabotage campaign, an airport worker found the drone in a secure section of the airport, just a few meters from a Ukrainian Antonov cargo plane. According to German investigators, it was carrying an explosive device whose detonator was faulty and never went off. The discovery of the drone prompted the airport to shut down overnight operations. Separately, authorities are investigating a second suspected drone incident, reportedly involving a collision with a DHL cargo plane while it was executing a go-around because of the closure. The aircraft landed safely afterward, although its nose was damaged. After further investigation, German authorities identified an antenna mounted on a tree to serve as a signal booster, alongside multiple DNA traces at the scene. The modified drone utilized a 5G router, two SIM cards, an auxiliary battery, and a camera, while operating without position lights. It was carrying an explosive device consisting of approximately 600 grams of Semtex. The device detached during a collision with the parked Ukrainian aircraft but failed to explode due to a defective detonator.

In addition to this incident linked to the Russian government, the Wall Street Journal reports “new U.S. intelligence assessments warn [that Russian President] Vladimir Putin could test NATO’s resolve through limited attacks ranging from sabotage and cyber operations to a small-scale incursion into alliance territory.” It adds, “Western officials have increasingly warned that Russia is conducting probing operations against NATO infrastructure, with previous incidents including drones entering Romanian airspace and Russian missiles landing in Poland.”

Furthermore, this thwarted drone attack is only the latest incursion into European airspace. From August 2024 to February 2026, suspicious drones were spotted at least 144 times in 13 countries, according to a report last month from the London-based International Institute for Strategic Studies (IISS). The report assesses that Russia likely conducted a sustained drone campaign to probe gaps in the continent’s air defenses and conducted hostile surveillance over airports, maritime ports and critical infrastructure. The report also notably warned that the drones were likely launched from Russia-linked vessels. Ultimately, given the evolving international security landscape, utilities are encouraged to prepare for potential geopolitical conflicts and associated sabotage risks.

Original Sources:

• https://www.bbc.com/news/articles/cyvlg4q48l3o
• https://www.theguardian.com/world/2026/aug/10/us-intelligence-russia-leipzig-airport-drone-bomb
• https://www.euronews.com/my-europe/2026/08/11/explosive-drone-at-leipzig-airport-whose-dna-trail-is-it

Additional Reading:

• Drone enters Bulgaria, explodes near pipeline at Romanian border
• Russian drones attack German cargo ship ‘EMIL’ in Black Sea, media reports
• (TLP:AMBER) E-ISAC Report – Russia’s Hybrid Warfare Strategy and Tactics in Europe with Implications for North America

Mitigation Recommendation:

• CISA – Be Air Aware
• ODNI – Safeguarding the U.S. Defense Industrial Base and Private Industry Against Sabotage
• Countering the Threat of Sabotage Operations to UK Interests and National Security

Related WaterISAC PIRs: 1, 2, & 4