Germany's Military Raises Russian Sabotage Threat Level Over Drone Risk
Classified analysis warns German forces could be targeted at home, after a crashed drone with a can of explosives was found near Wunstorf air base
By AXY Defense Desk ·
Key points
- Germany's military has raised its Russian sabotage threat assessment to the second-highest level on its scale.
- The classified analysis warns German forces themselves could be attacked at home, not only Ukrainian-linked sites.
- A crashed drone with a can of explosives nearby was found near Wunstorf air base in September, and investigators suspect it may have targeted military planes.
- Russia has denied involvement in sabotage and hybrid attacks and has called the Leipzig allegations absurd.
Germany's military, the Bundeswehr, has raised its assessment of the Russian sabotage threat to its second-highest level. It warns that German forces themselves could face attacks at home, not only the civilian and allied sites it had mainly worried about until now. The finding comes from a classified internal analysis that public broadcaster WDR and the Süddeutsche Zeitung reported on Oct. 21.
For ordinary readers, the change matters because it shifts where the danger is thought to lie. Until now, the military's concerns had centred on installations that train Ukrainian troops, along with naval bases and shipyards. The new analysis says authorities can no longer confine the threat to a fixed list of places. Instead, it describes an all-around deterioration in the security situation, with concrete actions possible in the near term.
That is a serious statement from a military that is used to planning around known sites. It means guards, airfields, barracks and the people who work in them may need to think about threats that do not come from a single known location.
What the new assessment says
The Bundeswehr uses a risk scale to rank threats, and the reporting says the military has now placed Russian sabotage at the second-highest of its levels. An Operational Command spokesperson told WDR that the Bundeswehr currently considers the sabotage risk "substantial" because of the increased threat. The same reporting, cited by SZ, said that this places the risk at that second-highest level of the military's assessment scale.
The spokesperson said the military is strengthening protective measures at its installations to safeguard personnel and facilities. The reporting did not give a full list of those measures, so it is not clear how many bases are affected or what new equipment or staff are involved.
The analysis assesses that Russia almost certainly has the capability to act against German forces and facilities, as well as against Ukrainian partners in Germany. It also says Moscow very likely has an increased motivation to do so. Capability and motivation are the two things security analysts look at first when they judge whether a threat is real. Here, the report says both are present.
The report also concludes that Russia's use of drones as weapons has crossed a "red line" that had been anticipated. In the report's terms, that line involves an intention to cause physical damage or potentially lethal effects. In plain language, the concern is no longer that drones are being used to spy or to cause nuisance. It is that they may be used to hurt people or to destroy things.
The Wunstorf drone and the Leipzig attack
The reassessment follows the discovery of an apparently crashed drone near Wunstorf air base in northern Germany in September. Investigators found a can containing explosives a few meters away, according to the report. They suspect the aircraft may have been aimed at military planes rather than civilian cargo aircraft, which is a central point in the new analysis.
WDR and the Süddeutsche Zeitung also reported that investigators believe the Wunstorf drone had lain near the base for about two years. That conclusion rests on technical analysis by Germany's Federal Criminal Police Office, known as the BKA. If the timing is right, it means the device was not a recent arrival, which raises questions about how long it went undetected near a sensitive site.
The drone's construction resembled an explosives-equipped drone used in a failed attack at Leipzig/Halle Airport in early August, the outlets reported. The report says the Wunstorf drone would have significantly predated the Leipzig incident, so the two cases are not the same event. Their similarity in design is one reason investigators are looking at them together.
The military analysis treats the two cases differently. Leipzig presented an indirect threat to German forces, because its apparent target was Ukrainian aircraft. Wunstorf, by contrast, likely involved the Bundeswehr itself as the target. That distinction is the heart of the new warning. A German military aircraft, not only a shipment bound for Ukraine, may have been the intended victim.
The German government has publicly attributed the Leipzig drone attack to Russia following a month-long investigation. That official attribution is important, because it means the government has already named Moscow in connection with one of the incidents that shaped the new assessment.
How the threat picture has developed
Germany has been a central hub for Western support of Ukraine since Russia's full-scale invasion in February 2022. Its territory hosts training and logistics for Ukrainian forces, and equipment and personnel pass through its airports, rail lines and ports. That makes the country a logical place for a state that wants to weaken Ukraine to try to disrupt the flow of support.
Sabotage, in this context, means covert damage or disruption carried out to hurt a country without an open declaration of war. It can include arson, cutting cables, damaging rail infrastructure or interfering with equipment. Security officials across Europe often describe these acts as part of hybrid warfare, a mix of pressure that stops short of conventional fighting but still aims to weaken a state.
The warning also follows a series of suspicious drone flights. According to WDR, drones were seen over sites associated with Germany's Arrow 3 missile-defense system and over Patriot maintenance facilities. Arrow 3 is designed to intercept ballistic missiles high above the ground. Patriot is a US-made air defense system that Germany operates. German security authorities suspect Russian involvement in those incidents and in other surveillance cases, WDR reported.
Taken together, these incidents suggest that the question is no longer confined to one kind of target. A drone that can hover over a missile-defense site or a maintenance depot can also gather information that might later be used for attacks. That is one reason the analysis describes a wider picture rather than a single threat.
Why the Bundeswehr's own bases are now in focus
For the Bundeswehr, the most sensitive part of the report is that it describes a threat aimed at its own people and equipment. That is different from a threat aimed at allied supplies passing through Germany. An attack on a German air base or on the aircraft parked there would hit the military directly, and it could cost lives.
The analysis links the suspected campaign to efforts to weaken political and public support for Ukraine in Germany. At the operational level, it assesses that Moscow seeks to disrupt equipment deliveries and training. In practical terms, that would mean slowing the flow of weapons and the instruction of Ukrainian soldiers, which would in turn weaken Ukraine's ability to defend itself.
This is why the military's concern extends beyond its own barracks. A drone attack on a cargo aircraft carrying military equipment, or on a training site used for Ukrainian troops, could disrupt support for Ukraine without ever touching a German soldier. The Wunstorf finding suggests that the target set could be wider than the military first expected.
For people who live near these sites, the stakes are practical. Air bases, shipyards and training grounds sit in towns and regions across the country. Residents may see more security checks, more patrols and possibly more restrictions on flying equipment near sensitive areas. The reporting does not describe those changes, so they remain possibilities rather than confirmed steps.
Moscow's denials and the wider pattern
Russia has consistently denied involvement in sabotage and hybrid attacks. It has also blamed Germany for staging incidents to stir up anti-Russian sentiment. Moscow's ambassador to Berlin previously dismissed Germany's allegations over the Leipzig attack as "absurd" and described the incident as a "provocation."
That pattern of denial is familiar. Since the full-scale invasion of Ukraine, European governments have accused Moscow of a range of covert actions, including damage to undersea cables, arson and attacks on transport and industrial sites. Moscow has generally rejected those accusations. Attribution in such cases is hard. Perpetrators often use intermediaries, and the physical evidence can be thin or hard to trace back to a state. That makes official findings, such as the government's conclusion on Leipzig, politically significant even when they are contested.
The new analysis is an internal military document. It is not a court ruling, and it does not in itself settle who sent the Wunstorf drone. The reporting does not say that a suspect has been named. What the report does provide is the military's own judgement about intent and capability, which is a different kind of evidence from a criminal finding.
What to watch next
The reporting does not describe a timetable for measures beyond the strengthening of protective steps at installations. Analysts would expect the Bundeswehr to review security at bases, airfields and training sites, especially those linked to Patriot, Arrow 3 and the support of Ukraine. They may also look at counter-drone defenses, which are designed to detect, track and disable small unmanned aircraft.
Several questions remain open. Investigators have not publicly named a suspect for the Wunstorf drone in the reporting available so far. It is also unclear how many other incidents are under review, or how the threat assessment might change if new evidence emerges. Analysts may also watch whether the government moves to restrict drone flights near military sites, though no such step has been reported.
Readers should watch for further statements from the Bundeswehr, the federal government and the Federal Criminal Police Office. Any update on the Wunstorf investigation, or any new suspicious drone sightings near air bases, would show whether the threat level is still rising. Changes to defense spending or to protection for air bases would also show how seriously the government is treating the warning.
Questions and answers
Why did Germany's military raise its sabotage threat level?
A classified internal analysis reported by WDR and the Süddeutsche Zeitung concluded that Russia almost certainly has the capability, and very likely an increased motivation, to act against German forces and facilities. The assessment followed the discovery of a crashed drone with explosives near Wunstorf air base in September.
What happened at Wunstorf air base?
An apparently crashed drone was found near Wunstorf air base in northern Germany in September. Investigators found a can containing explosives a few meters away and suspect the aircraft may have targeted military planes rather than civilian cargo aircraft.
Has Russia responded to the sabotage allegations?
Russia has consistently denied involvement in sabotage and hybrid attacks and has blamed Germany for staging incidents. Moscow's ambassador to Berlin dismissed Germany's Leipzig allegations as absurd and described the incident as a provocation.
Topics: Bundeswehr, Russian sabotage, Wunstorf air base, Leipzig/Halle Airport, Ukraine military support, hybrid warfare, Germany defense
Sources: Defense News