Germany Raises Russian Sabotage Threat Level for Bundeswehr

Germany’s armed forces now rate the threat of Russian sabotage against their own troops and bases at the second-highest level on their internal scale, the first time the Bundeswehr has used that rating, after investigators found an apparently crashed drone and a can of explosives near a German air base in September.

The shift, first reported by public broadcaster WDR and the Süddeutsche Zeitung from a classified internal analysis, means German commanders are planning for the possibility that soldiers could be attacked on home soil. A Defense Ministry spokesperson confirmed the assessment on Wednesday, Reuters reported, and Defense News detailed the analysis.

“We are noting that we face a significant sabotage threat overall for the Bundeswehr.”
— German Defense Ministry spokesperson, as quoted by Reuters

The warning came the same day The Wall Street Journal reported that U.S. intelligence agencies view a failed August drone attack at Leipzig/Halle Airport as one of the opening moves in a broader Russian sabotage and covert campaign against NATO countries.

What the Bundeswehr sabotage assessment says

Until now, German military planners had focused their sabotage concerns on a narrower set of targets: sites where Ukrainian troops train, naval bases and shipyards. The new analysis drops that geographic framing. According to Defense News, it concludes that authorities “can no longer geographically confine specific sites deemed vulnerable” and warns of an all-around deterioration in security, with concrete hostile acts possible in the near term.

The document’s language on Moscow is blunt. It says Russia almost certainly has the capability, and very likely a growing motivation, to act against German forces, German military facilities and Ukrainian partners inside Germany. Reuters quoted the internal document as saying Russia had crossed “a previously anticipated red line of harmful intent involving kinetic and/or lethal effects” by using drones as weapons.

The analysis ties the suspected campaign to two goals: eroding German political and public support for Ukraine, and disrupting weapons deliveries and training. A spokesperson for the Bundeswehr’s Operational Command told WDR the sabotage risk is “substantial,” and the military is strengthening protection at its installations, Defense News reported. The ministry told Reuters the measures are tailored to each site and range from more guard patrols to infrared cameras and fence surveillance systems. Intelligence services expect the situation to get worse in the short term.

The incidents behind the higher threat level

German officials and reporting point to a string of events over the past several months:

Aug. 4 — Leipzig/Halle Airport, Saxony. An airport employee spotted an explosive-laden drone in a cargo area near a runway, close to a plane belonging to Ukraine’s Antonov Airlines. Specialists used a robot to defuse it, and the airport was temporarily shut, Al Jazeera reported. The Journal, citing investigators, reported that at least three drones packed with military-grade Semtex were involved: one hit the Antonov without exploding, a second struck another aircraft and a third detonated near the airport perimeter.
Sept. 1 — Berlin formally blames Moscow. Interior Minister Alexander Dobrindt said the device showed “a high degree of technical expertise” and that the attack was apparently carried out by “low-level agents” working “on behalf of Russian state entities,” Al Jazeera reported. Germany ordered a Russian consulate in Bonn closed from Sept. 18.
Mid-September — Wunstorf Air Base, Lower Saxony. An apparently crashed drone was found near the base, with a can of explosives a few meters away. Its construction resembled the Leipzig drones, though Defense News reported that investigators believe it had been near the base for about two years, predating Leipzig. Investigators suspect it was aimed at Bundeswehr aircraft rather than civilian cargo planes, according to Defense News and Reuters.
Suspected reconnaissance at air defense sites. Defense News reported suspicious drone flights over sites tied to Germany’s Arrow 3 missile defense system and over Patriot maintenance facilities. Reuters reported drone overflights of an Arrow 3 site in Saxony-Anhalt and a hidden camera found filming a railway station in Minden, in the state of North Rhine-Westphalia. German authorities suspect Russian involvement.

The distinction between Leipzig and Wunstorf matters to the military. Defense News reported that commanders viewed Leipzig as an indirect threat, since it targeted Ukrainian aircraft. Wunstorf likely targeted the Bundeswehr directly.

Russia’s alleged sabotage campaign across Europe

The Wall Street Journal reported Wednesday that European officials believe President Vladimir Putin directly ordered a stepped-up campaign against NATO countries, run by a branch of Russia’s GRU military intelligence agency known as the Special Tasks Service. Western intelligence traced the Leipzig plot to Col. Denis Smolyaninov, a GRU department chief already under EU and British sanctions, who had earlier been linked to a plot to smuggle incendiary devices into the DHL parcel network, the Journal reported.

The paper said German investigators found the Leipzig drones ran on German 5G SIM cards and were flown remotely over the internet, with control traffic traced to servers previously used by the GRU. Serbia served as a logistics hub, and Serbian authorities arrested seven suspects. Aides to Merz told the Journal that a mass-casualty outcome at Leipzig could have led Berlin to consider invoking NATO’s Article 5 collective-defense clause.

Other incidents cited by the Journal and other outlets since August include:

Arson attacks on drone manufacturers in Estonia and Poland in August, and a foiled arson plot against a Ukrainian drone factory in Slovakia the same month, according to the Journal.
Fires at several Starlink antennas in Bulgaria on Oct. 10 and a September fire at a Starlink facility in Poland, after which Poland blamed Russia and detained four suspects, Reuters reported.
An attempted arson at a Starlink base station outside Vilnius, Lithuania, early on Oct. 18. Vilmantas Vitkauskas, head of Lithuania’s National Crisis Management Centre, told reporters, according to Reuters: “We understand that this was not a routine arson attack but an act of sabotage.”
Drone attacks on commercial ships in the Black Sea near Bulgaria and Romania, the Journal reported.

The pattern did not start this year. The Associated Press has logged roughly 200 incidents of sabotage and other malign activity in Europe since 2022, Al Jazeera noted, including a March 2024 arson at an east London warehouse storing aid for Ukraine that prosecutors blamed on people working for the Russian-backed Wagner Group.

Moscow denies all of it. Putin responded to the Leipzig accusation in early September by asking, “Where is the evidence?” the Journal reported, and Russia’s ambassador in Berlin called the allegations “absurd,” according to Defense News. German Chancellor Friedrich Merz has taken the opposite view. “Russia is waging a war on Europe; not just on Ukraine, but also against us,” he said earlier this month, the Journal reported.

What it means for US troops and US-made systems in Germany

Germany hosts about 35,000 active-duty U.S. personnel, more than any other European country, Army Times reported in May, when the Pentagon announced it would withdraw 5,000 troops over six to 12 months. U.S. Army Europe and Africa is headquartered in Wiesbaden, and Ramstein Air Base is the headquarters of U.S. Air Forces in Europe.

The German assessment covers the Bundeswehr, not American forces. But some of the sites drawing suspected Russian surveillance are tied to American weapons. Patriot is a U.S.-built air defense system, and Arrow 3 is an Israeli-American interceptor. Germany moved to activate Arrow 3 in early December 2025 at Holzdorf air base, which straddles Brandenburg and Saxony-Anhalt about 40 miles south of Berlin, marking the system’s first deployment outside Israel, Defense News reported.

Investigators described Leipzig/Halle to the Journal as one of Europe’s most important air-cargo airports, and the Antonov freighter that was hit is used to carry military assistance to Ukraine. A successful attack would have meant “mayhem and casualties,” investigators told the paper.

How Germany is responding to the drone threat

Berlin moved on legal authorities before the Leipzig attack. In February, the Bundestag passed amendments to the Aviation Security Act that let the armed forces help police defend against drones, the German federal government said. Armed force is allowed only as a last resort, when the danger cannot otherwise be averted or only with considerable difficulty. The decision to deploy troops now rests with the Defense Ministry and can be delegated, and the earlier requirement to consult the Interior Ministry was dropped. Intentional, unauthorized entry onto airport grounds also became a criminal offense; before, it drew only fines.

After the Leipzig attribution, Germany closed the Bonn consulate, said the Russian House cultural center in Berlin would also close, summoned Russia’s ambassador and said it would push for more Russians to be added to EU sanctions lists, Al Jazeera reported. Poland, Italy, the U.K., Sweden and the Czech Republic publicly backed Berlin’s findings.

Dobrindt has since described a “shadow war” and called for expanded intelligence powers, Reuters reported. Merz has said Russian disinformation and hybrid attacks are the biggest threat to Germany. “My view is that our people are still underestimating this big threat to our society,” he said, according to Reuters.