The attempted drone attack at Leipzig/Halle Airport was supposed to be a German security story. It is rapidly becoming a Serbian one.
On August 4, an explosives-laden drone was discovered near Ukrainian cargo aircraft at Leipzig/Halle Airport. German authorities have since concluded that individuals acting on behalf of Russian state structures were behind the attempted attack, describing it as consistent with a broader pattern of Russian hybrid operations in Europe. Moscow denies the accusation. But the most revealing part of the investigation may not be what happened at Leipzig. It may be where investigators are looking next.
According to reporting on Der Spiegel’s investigation, one of the Leipzig suspects travelled through Serbia and Istanbul toward Russia after the operation. German investigators are also examining possible connections between the Leipzig case and two men arrested in Serbia in June with explosives and modified-drone equipment. That does not establish Serbian involvement. But it creates a question that can no longer be dismissed as speculation: Why does Serbia keep appearing where the Russian sabotage story intersects with logistics, movement and recruitment?
The chronology is striking
On April 5, Serbia’s military intelligence discovered a large quantity of explosives and equipment for their preparation and use in northern Serbia, near Kanjiža. The material was found close to the Balkan Stream gas infrastructure connecting Serbia and Hungary. Serbian authorities formally classified the case as suspected attempted sabotage and launched a wider investigation.
Then, on June 11, Serbian authorities stopped two vehicles near the Hungarian border. One suspect, Danilo B., reportedly possesses Serbian and Russian citizenship; the other, Slobodan D., is Serbian. Investigators found components of a modified drone and remote-control equipment in one vehicle and explosives concealed in cans in the other. Both remain in custody. German investigators are now examining whether these men- or their associates, are connected to the Leipzig operation.
The similarities are difficult to overlook. The Leipzig drone was itself equipped with explosives, reportedly using a comparable container arrangement. But investigators have not established publicly that the Serbian equipment was used in Leipzig. That distinction matters.
More significant still, Serbian prosecutors have acknowledged a broader investigation involving an alleged organized group that acquired explosives and drones in Serbia and transported them to previously agreed locations in EU member states. Four people have been detained in that case, which reportedly involves seven suspects. This changes the question.
Serbia is no longer appearing merely as the country where an individual suspect happened to travel. Serbian territory is appearing in connection with the acquisition, storage and movement of exactly the kinds of equipment associated with Europe’s emerging sabotage threat.
The intelligence dimension
Der Spiegel, according to multiple reports, has cited Western intelligence assessments describing Serbia as a hotspot for Russian sabotage activity in Europe, including the recruitment and training of people who can subsequently be used by Russian services. One Leipzig suspect is also reportedly linked to a previous sabotage case in Łódź, Poland, and investigators are examining possible contacts with the men arrested in Serbia.
If confirmed, this would fit a broader Russian model of hybrid warfare: Moscow does not necessarily need its own officers physically crossing borders to plant explosives. It can recruit intermediaries, provide instructions, exploit criminal or personal networks and maintain enough distance to preserve deniability. That is precisely where Serbia becomes strategically important.
Serbia occupies an unusual position in Europe. It is an EU candidate but remains outside both the EU and NATO. Belgrade has condemned Russia’s invasion in international forums and maintains relations with Ukraine, but it has refused to join Western sanctions against Moscow and continues to maintain significant political, economic and security links with Russia.
Geography compounds that ambiguity.
Russia-linked networks -> Serbia -> Hungary -> EU -> target.
Northern Serbia sits immediately beside the EU’s external border. The April explosives discovery occurred near infrastructure connecting Serbia and Hungary. The June arrests occurred while the suspects were reportedly heading toward Hungary and the EU. And one Leipzig suspect reportedly used Serbia as part of his route after the attack. Individually, each fact has an innocent or alternative explanation. Together, they form a pattern worthy of counterintelligence attention.
And then there is Niš
For years, Western governments and security analysts have questioned the strategic purpose of the Russian-Serbian Humanitarian Center in Niš. Officially, its mission is humanitarian: emergency response, disaster relief, firefighting and cooperation between Serbian and Russian emergency services. The center itself describes its mandate in precisely those terms.
Yet its unusual Russian institutional footprint has repeatedly generated concerns that Moscow could exploit it for purposes beyond humanitarian cooperation. Those concerns have never publicly produced proof that the center functions as an intelligence or sabotage facility. That caveat must remain. There is currently no public evidence linking the Niš center to Leipzig. But the new investigation changes the relevance of the question.
The issue is not whether someone hid explosives inside the center. There is no evidence of that. The question is whether Russia’s broader institutional, intelligence and human networks in Serbia provide Moscow with an environment in which recruitment, communications, transportation, contacts or other forms of logistical support can occur with greater ease and deniability. That is a question of security architecture, not conspiracy.
Serbia’s continuing relationship with Moscow makes the country’s role difficult to examine in isolation from Russia’s wider European activities. Just weeks before the Leipzig investigation intensified, Belgrade again opened its doors to a Russian state operation under the humanitarian framework, allowing a Russian Il-76 firefighting aircraft and its crew to operate from Niš during Serbia’s wildfires. The mission was officially humanitarian, and there is no evidence linking it to the Leipzig case or to any covert activity. Yet its significance lies in what it demonstrates about the depth of Russia’s institutional access to Serbia.
Belgrade does not have to be intentionally participating in Russian sabotage for Serbia to become useful to Russian intelligence. A bridge does not have to belong to the person crossing it to be strategically valuable. The evidence therefore does not justify saying that Serbia was involved in the Leipzig attack. It does justify asking whether Serbia is becoming an enabling environment for the networks that make Russian hybrid warfare possible. That distinction is crucial.
If the Serbian suspects, the equipment seized near the Hungarian border, the wider Serbian explosives-and-drone network, and the Leipzig suspects ultimately prove to be part of one Russian-directed architecture, Serbia’s role will require much deeper scrutiny.
If they do not, the recurring Serbian connections will still raise an important question about the country’s vulnerability to foreign intelligence recruitment and covert logistics. Either way, the security problem remains. The question for Berlin and Brussels should therefore not simply be:
“Did Serbia help Russia attack Leipzig?”
It should be: “Why does Serbia keep appearing wherever Russia’s European shadow war intersects with logistics, movement and recruitment- and what is being done about it?”That is a question that can be investigated without accusing Belgrade of something the evidence has not yet proved. And perhaps that is precisely why it is the more dangerous question. Because Russia don`t need Serbia to be its accomplice. It only needs Serbia to remain its bridge.
More on this story: Explosives Near Pipeline in Serbia — Actors, Motives, and Political Implications
