The explosive drone found next to a Ukrainian cargo plane at Leipzig/Halle Airport this month was built the way Russia’s military intelligence directorate builds them, a US intelligence source briefed on the investigation told ABC News. The explosives and the device’s construction were “typical” of the GRU, the source said, an assessment reached together with German security and intelligence agencies.

The drone crossed the airport fence at 19:28 on August 4, flew into the wing of a parked Antonov An-124, and dropped to the apron without detonating. The US source said the triggering mechanism was disconnected. Germany has not formally named a culprit, but Chancellor Friedrich Merz said this week that investigators will present their findings soon, and that those responsible will pay.

Moscow is already objecting, and the evidence keeps piling up: German investigators have since recovered another drone and a cache of military explosive near the airport.

US Assessment Matches The Leipzig Device To A GRU Signature

The US official briefed on the investigation said both the explosives and the structure of the device were typical of those Russia’s GRU uses, an assessment made in conjunction with German security services. It sharpens earlier US reporting that the drone likely belonged to the Russian government.

That earlier assessment surfaced in the Wall Street Journal in the first week of the case, when US intelligence tied the drone to the Russian state without naming an agency, as DroneXL reported on August 9. The official who spoke to ABC News went further on both counts: the GRU specifically, and a judgment shared with the German agencies running the investigation.

The forensics were already pointing the same way. The charge combined Semtex and PETN, up to 800 grams of it according to Leipziger Volkszeitung reporting that remains single-source, packed onto a quadcopter that sat on the apron for roughly four hours before a bus driver found it feet from the An-124 it had struck. DNA recovered from the device matched a trace from the July 2024 DHL parcel fire at the same airport, a plot Western investigators attributed to the GRU, plus a profile registered in Lithuania. Same airport, same playbook.

The US source also offered the first explanation of why the bomb never went off: its triggering mechanism was disconnected. Federal police still sent a robot to pull the detonator before anyone touched the device.

Merz Promises Findings While Moscow Cries Foul

Chancellor Friedrich Merz says German agencies are working intensively on the Leipzig case and will present findings shortly. Those behind hybrid attacks on Germany will pay, he said. Russia’s foreign intelligence service, meanwhile, accused German politicians of blaming Moscow before the investigation produced results.

Merz spoke to reporters on August 25, ahead of a closed-door cabinet meeting at Neuhardenberg Castle, and said Germany had “increasingly become a target for hybrid attackers.” European officials use the term for the sabotage, arson, and disinformation operations that have spread across the continent since 2022, the campaign that pushed Brussels toward the drone wall Ursula von der Leyen pitched last October. Interior Minister Alexander Dobrindt has said many indications point to a state actor, while declining to name one.

Russia’s Foreign Intelligence Service, the SVR, got its rebuttal in early. In a statement on Monday, it accused German politicians and European media of reaching a conclusion “without even waiting for the preliminary results of the investigation.” (Concern for investigative rigor is a new look for the SVR.)

Investigators Keep Finding Hardware Around Leipzig

German investigators have kept finding hardware since August 4: a third drone in a field at Kabelsketal west of the airport on August 14, roughly 50 grams (1.8 ounces) of the military explosive hexogen at the same site, and a control device taped to a tree in Kursdorf.

NDR, WDR, and Süddeutsche Zeitung reported the finds on August 25, citing investigators, per ZDFheute’s account of their reporting. The hexogen turned up at the drone’s find site in Kabelsketal, while the control device, an antenna and electronics north of the airport in Kursdorf, sat near scorched ground and metal fragments, per Euronews. The German outlets count the Kabelsketal drone as the third device in the case, after the armed drone on the apron and the suspected mothership DroneXL covered on August 10. Federal police told ABC News that ongoing investigations rule out further comment.

The backdrop is an airport under sustained pressure. US officials told ABC News there have been 18 drone incidents disrupting air traffic at Leipzig/Halle since January 2026. The field is a major cargo hub that the US military and NATO allies use to move armaments to Ukraine, and investigators believe the armed drone was designed to disable aircraft parked on the airfield, delaying weapons shipments, and to put Germany on notice over its support for Kyiv. Nor is Leipzig alone this month: days after the bomb was found, drones circled the Bundeswehr’s Patriot repair base at Mechernich.

DroneXL’s Take

The US assessment doesn’t settle who flew a bomb into a parked An-124, but stacked on the DNA evidence and the 2024 parcel plot, it comes close enough that I’ve stopped treating attribution as the open question. The open question is what Germany does about it.

The SVR is formally right that Berlin hasn’t published its results, and I’ll grant that much. But when the DNA on the drone matches a trace from a parcel-bomb plot at the same airport two years earlier, and the US signature analysis lands on the same agency Western investigators blamed for those parcels, outrage about premature conclusions is theater. Deniability is what the GRU sells. Hallmark-level attribution is as close as sabotage cases get to a confession, short of an indictment, and this one keeps producing physical evidence: a suspected mothership, a control node taped to a tree, a cache of hexogen in the dirt. The GRU’s drone logistics have a habit of surfacing in the open lately, including the officer who ran a drone-parts pipeline out of Japan until he fled in July.

So watch what Merz attaches to the word pay. His government’s response in the three weeks DroneXL has covered this case has been genuinely fast by German standards: the federal counter-drone unit is doubling to 300 officers, and a counter-drone radar, reported to be an American EchoShield, went up on the old Leipzig tower within a week. All of it defensive. None of it a price. Merz promised findings shortly, and the federal prosecutor general holds the case, so the naming part is scheduled in all but date. Whether anything follows the naming is the part Berlin hasn’t signaled, and Germany’s record in this case so far is hardening targets, not imposing costs.

Sources: ABC News, Euronews, ZDFheute

DroneXL uses automated tools to support research and source retrieval. All reporting and editorial perspectives are by Haye Kesteloo.