Russia’s Hybrid War Against Germany: From Disinformation to State Terrorism
The Leipzig Drone Attack: A Confirmed Act of Russian Aggression
In a shocking escalation of hybrid warfare, Russia has been confirmed as the perpetrator of a drone attack on Leipzig/Halle airport in Germany on August 4, 2026. The attack involved two drones—one carrying explosives that failed to detonate near a Ukrainian Antonov-124 aircraft transporting ammunition from France, and another that struck a plane mid-flight, forcing an emergency landing in Hannover. German Chancellor Friedrich Merz condemned the attack as “state terrorism,” stating it was “planned in Russia for months” and “specifically targeted at Germany.” Fortunately, the incident resulted in minimal damage and no casualties, but authorities emphasize that it could easily have resulted in serious injury or death. Saxony’s Interior Minister Armin Schuster characterized the attack as state terrorism, while European Commission President Ursula von der Leyen vowed that Europe and NATO would increase pressure on Russia in response to this unprecedented assault on EU soil. The attack represents a significant milestone in Russia’s hybrid war against Germany, marking the first time Russian responsibility has been officially confirmed for a violent act on German territory.
The Broader Pattern: Drone Incursions Across Germany
The Leipzig attack is not an isolated incident but rather the most severe manifestation of a sustained pattern of Russian drone activity over German territory. Between September and December 2025, mysterious drones were detected near sensitive military and infrastructure sites across Germany, with the Bundeswehr recording hundreds of unexplained drone sightings over recent years. German authorities suspect many of these drones were launched from Russia’s so-called “Shadow Fleet”—cargo ships that can quickly and easily deploy drones while removing evidence before inspections. These vessels have been strongly suspected of involvement in sabotage operations, including disrupting communication lines in the Baltic Sea. A comprehensive timeline reveals escalating incidents: drones appeared near a naval communications site in Ramsloh in April 2025, over Kiel’s naval yard in September 2025, above the Arrow 3 missile-defense installation at Annaburger Heide in December 2025, and over the KNDS defense plant in Munich in July 2026. Days after the Leipzig attack, six drones flew over a military base and Patriot maintenance facility at Mechernich. While Russian responsibility has not been established in every incident, the Leipzig attack provides a confirmed case within a broader pattern of suspected surveillance and sabotage that extends across Europe, including Poland, Moldova, and Romania, where Russian drones have struck apartment buildings in NATO member states.
The Origins: From Wandel durch Handel to Hybrid Aggression
Russia’s hybrid war against Germany did not begin with drones and explosives but rather with more insidious methods rooted in decades of diplomatic and economic engagement. Germany historically pursued a cooperative relationship with Russia, guided by the policy of “change through trade” (Wandel durch Handel), which originated in the 1960s within the German Social Democratic Party. This approach emphasized economic cooperation, exemplified by the Nord Stream pipeline projects, as a means to reduce conflict risk and foster mutual understanding. However, this policy was widely criticized after Russia’s 2022 invasion of Ukraine, with European Commissioner Paolo Gentiloni acknowledging its failure. The initial phase of Russia’s hybrid campaign relied heavily on disinformation and propaganda, with Russian troll farms deliberately interfering in German politics to create internal division. The Russian-affiliated “Social Design Agency” (SDA) orchestrated the Doppelgänger disinformation network, creating fake websites that mimic legitimate news sources to spread false narratives. These operations targeted internal rifts within ruling elites, stimulated protest activity among opposition forces, and aimed to destabilize politically apathetic segments of the electorate. Russian-backed media outlets tailored disinformation campaigns for far-right, far-left, and Russian-German audiences, with the latter group—approximately 1.2 million citizens—particularly vulnerable to false information about German realities.
Political Influence: Russia’s Long-Term Investment in German Politics
Beyond disinformation, Russia invested heavily in cultivating political relationships within Germany’s major parties, creating what investigators called the “Gazprom Lobby.” This network, which included former Chancellor Gerhard Schröder, advanced Russian corporate and governmental interests, encouraging German dependence on Russian gas while fostering favorable political attitudes toward Moscow. As mainstream parties distanced themselves from Russia following the invasion of Ukraine, Moscow pivoted toward supporting more extreme political movements. The Alternative for Germany (AfD) party received direct support, including funding for trips to Moscow beginning in 2018, and several party members have been suspected of receiving payments through the Russian-backed “Voice of Europe” network. AfD politicians have repeatedly expressed pro-Russian positions, with Björn Höcke declaring Russia “a country that hopes it could possibly be a pioneer for a world of free and sovereign states without hegemonic influence” and promising to visit Moscow first if elected chancellor. The Sahra Wagenknecht Alliance (BSW) has similarly campaigned on reopening Nord Stream and ending sanctions, with both parties receiving Russian support in disinformation campaigns. The September 2026 Saxony-Anhalt elections demonstrated the effectiveness of these efforts, with AfD receiving over 43% of the vote and BSW 5.3%, meaning nearly half of voters backed parties advocating closer ties with Russia and reduced support for Ukraine. German security services have identified Russian disinformation targeting the German elections, including fake videos designed to discredit politicians across the political spectrum.
Escalation to Direct Action: Sabotage, Terrorism, and Covert Operations
Russia’s hybrid war has progressively escalated from information warfare to direct violent action. Beyond drone incursions, Russia has exploited vulnerable individuals to conduct terrorist operations within Germany, paying operatives through cryptocurrency and issuing orders remotely. Two Bulgarian nationals were arrested for attempting to sabotage a defense factory, while Germany’s Federal Criminal Police Office recorded over 165 acts of sabotage and 740 mysterious drone sightings in 2026 alone. A power plant in eastern Germany was hit by homemade rockets packed with explosives. This pattern of escalation is evident in the comprehensive timeline: from political influence and disinformation in 2018-2020, to sabotage plots and parcel bomb attacks in 2025, to military surveillance and drone escalation through 2025, and finally to direct attacks on defense industry targets and critical infrastructure in 2026. The Leipzig attack, involving military-grade material and confirmed Russian operatives, represents the culmination of this escalation. German Interior Minister Alexander Dobrindt emphasized that Leipzig is not an isolated case but must be understood “in connection with other hybrid actions.” Germany has responded by accelerating intelligence service expansion, enhancing protection against sabotage and cybersecurity threats, implementing anti-drone shields at critical airports, ending the Russia House agreement in Berlin, expelling Russian employees, and closing the Russian consulate in Bonn, while coordinating expanded sanctions with European Union partners.
The New Normal: Living with Hybrid War
Russia’s hybrid war against Germany has transformed from an unthinkable scenario to a regular, expected part of European life, representing a fundamental shift in continental security. The campaign demonstrates a sophisticated, multi-layered approach that combines disinformation to undermine democratic discourse, political influence to advance Russian interests, espionage to gather intelligence on military installations, sabotage to disrupt critical infrastructure, and now direct attacks with military-grade materials. The Leipzig drone attack, with its confirmed Russian attribution, removes any remaining ambiguity about Moscow’s willingness to conduct violent operations on German soil. This normalization of hybrid warfare presents unprecedented challenges for democratic societies, as the tools Russia employs—troll farms, fake news, political funding, drone incursions, and covert sabotage—operate in a gray zone between peace and war, often below the threshold of conventional military response. Germany’s response, including enhanced intelligence capabilities, improved physical security measures, and diplomatic consequences, represents an acknowledgment that the era of assuming Russia would respect sovereignty and international norms has ended. As European Commission President Ursula von der Leyen declared, Europe and NATO will not merely maintain pressure on Russia but will increase it. The question now facing Germany and its allies is how to defend democratic institutions against an adversary that operates simultaneously through information manipulation, political subversion, espionage, and terrorism, while avoiding escalation to conventional conflict. The Leipzig attack may prove to be a watershed moment, forcing European nations to develop comprehensive strategies to counter hybrid threats that have become an inescapable reality of modern geopolitical competition.