In early September, geopolitical rifts in Europe deepened dramatically. The attempted drone attack on Germany's Leipzig/Halle airport continued to escalate, with Berlin formally accusing Moscow of being behind it, and the EU subsequently announcing its largest-ever sanctions against Russia's military-industrial complex. Simultaneously, two attacks targeting power infrastructure occurred in Germany within 24 hours, affecting a total of 4,200 megawatts of generating capacity. From escalating hybrid warfare to pressure on energy security, the Eurozone is facing a new round of economic and security challenges.

Background: Drone loaded with explosives discovered at Leipzig Airport

In the early hours of August 4, 2026, staff at Leipzig/Halle Airport in Germany discovered a drone carrying explosives and a detonation device near the runway. This airport is a major civilian cargo hub and NATO logistics transit point in eastern Germany, handling military supplies for the German military and NATO allies, and also serving as the operating base for several An-124 supercargo aircraft operated by Ukraine's Antonov Airlines. German police subsequently deployed a bomb disposal robot to subdue the drone, and the German Federal Prosecutor's Office launched an investigation, classifying it as a "serious attack on German transport and logistics infrastructure."

Germany formally accuses Russia of announcing diplomatic retaliation.

On September 1, the German government formally accused Russia of orchestrating the attempted drone attack. German Interior Minister Dobrinth stated at a press conference that the explosives and detonation techniques used in the attack were similar to those previously used by Russia in other hybrid operations and the war in Ukraine, and that the attack exhibited professional characteristics, carried out by "low-level agents." German Foreign Minister Waldfol announced several countermeasures: closing the Russian Consulate General in Bonn on September 18; terminating contracts with the Berlin-based cultural institution "Russian House"; tightening entry checks for Russian citizens; and increasing pressure on Russia's alleged "shadow fleet." Germany also summoned the Russian ambassador to Germany. Russia denied involvement, calling the German accusations "baseless and absurd." Russian Foreign Ministry spokeswoman Zakharova stated that Russia would respond in kind to Germany's "punitive measures." Russian President Putin accused Germany of "planting evidence."

EU and NATO strongly support new sanctions against Germany, which are imminent.

Following a meeting with NATO Secretary General Mark Rutte in Brussels on September 2, European Commission President Ursula von der Leyen stated that the Leipzig attacks were "an attack launched by Russia using military equipment on EU territory." She emphasized, "Europe and NATO will not only maintain pressure on Russia, but will increase it, and will not stop unless Russia stops bombing and killing innocent Ukrainian children, men, and women." Von der Leyen also revealed that the EU had received new payment requests from Ukraine worth billions of euros, covering defensive equipment including advanced Patriot PAC-3 air defense systems. NATO Secretary General Rutte stated that more drones and missiles had entered NATO airspace on its eastern flank in Europe, and malicious activity had increased significantly. He warned Russia that it would be "very wrong" to believe that such threats would divide NATO or prevent it from supporting Ukraine. EU High Representative for Foreign Affairs and Security Policy Maria Kalas stated on September 2 that the EU had summoned the Russian ambassador to the EU regarding the Leipzig attacks, stating that the incident "has all the characteristics of state-sponsored terrorism." Kalas revealed that EU foreign ministers are working on a plan to impose sanctions on 1,600 individuals and entities related to Russia's military industry. She had previously stated that this would be "the largest sanctions list since the outbreak of the war," and once passed, it would increase the total number of sanctioned Russian organizations by one-third. The new sanctions are expected to be formally passed as early as October 2026. French Foreign Minister Barro called for further action against Russia's "shadow fleet." The EU and several member states have summoned Russian embassy officials.

Infrastructure damage in many parts of Germany casts a shadow of hybrid war.

Amidst the ongoing repercussions of the Leipzig airport incident, Germany experienced two suspected acts of sabotage against its power infrastructure within 24 hours. A substation in western Germany was vandalized: On the evening of September 1st, a deliberate act of sabotage occurred at the Amprion substation near Bergheim in North Rhine-Westphalia, western Germany. The perpetrators intentionally caused a short circuit by placing conductive material (suspected cable) into the high-voltage power lines. Rhine Group, which operates the substation, stated that five lignite-fired power generating units, with a total installed capacity of 4200 megawatts, were disconnected from the grid. North Rhine-Westphalia's Interior Minister, Reuer, stated that the investigation focuses on two possibilities: sabotage orchestrated by a foreign government, or the work of left-wing extremists. A high-voltage power grid node in eastern Germany was attacked: On the same morning, a key high-voltage power grid node near the Jenschwald lignite-fired power plant in Brandenburg was attacked multiple times with "homemade explosive rockets." Emergency services personnel discovered and defused multiple explosive devices at the scene. Brandenburg's Interior Minister, Reidmann, stated that the two attacks appear similar, but the investigation is still in its early stages and "no suspects can be ruled out" at this time. These incidents occurred at a sensitive time, ahead of the far-right Alternative for Germany (AfD) party's lead in the polls ahead of this weekend's state parliamentary elections. Trohm, the head of interior policy for Germany's ruling conservative bloc, stated that such incidents occurring before an election are "extremely noteworthy," with the explicit aim of undermining public confidence.

Investigation Update: Two Suspects Identified

According to German newspapers Süddeutsche Zeitung, NDR, and WDR, investigators have identified the logistics coordinator and instructors responsible for the drone attack. One of the men, born in Russia and holding a Latvian passport, is believed to have links to Russian intelligence. He flew to Berlin in late July, then rented a car and traveled to Leipzig, before leaving Germany by plane two days before the attempted attack. The second suspect is from Belarus, holds a Russian passport, and is believed to have entered Germany using an Italian tourist visa obtained in Minsk.

Editor's Summary

The attempted drone attack on Leipzig airport marks a new phase in Russia's "hybrid warfare" against Europe, escalating from cyberattacks and espionage to physical sabotage of critical infrastructure. The EU plans sanctions against 1,600 Russian military-industrial entities, the largest since the start of the Russia-Ukraine conflict, but this requires the unanimous consent of all 27 member states, leaving the stances of Hungary and Slovakia uncertain. Two attacks on German power facilities within 24 hours affected a combined 4,200 MW of generating capacity. While not causing widespread blackouts, these attacks sent a clear signal to the market that European energy infrastructure faces a systemic threat. With the upcoming state elections in eastern Germany, the political amplification effect of such events cannot be ignored—voters' anxieties about security could further reshape the German domestic political landscape. For investors, the European energy security premium, expected defense spending, and the intensity of the negotiations surrounding sanctions against Russia all need to be included in a medium-term risk assessment framework.

Frequently Asked Questions

Q1: Why was the Leipzig airport drone attack classified as a "hybrid warfare" operation? "Hybrid warfare" refers to a composite warfare approach that combines conventional military means with non-conventional methods (such as cyberattacks, disinformation campaigns, proxy sabotage, and attacks on critical infrastructure). The Leipzig airport attack used military-grade explosives and detonation technology, and the target selection was highly strategic—the airport is a key node for NATO to transport military supplies to Ukraine. The attackers possessed cross-border operational capabilities (entering Germany from Latvia and Belarus respectively), exhibiting organizational characteristics of a state actor, thus being categorized as "hybrid warfare" by the EU and NATO. Q2: What specifically are the 1,600 entities the EU plans to sanction? These 1,600 entities are the core of the EU's 22nd round of sanctions against Russia, primarily targeting the Russian military-industrial complex, including defense companies, related individuals, and organizations providing technical or material support to the Russian military. EU foreign policy chief Karas stated that the new sanctions aim to restrict Russia's ability to produce missiles and other systems used in the war against Ukraine. The EU's current sanctions list against Russia already contains over 3,000 items, and the addition of 1,600 items means that the number of sanctioned entities will increase by about one-third. The plan requires unanimous agreement from all 27 EU member states and is expected to be formally adopted in October 2026. Question 3: What was the actual impact of the attacks on German power facilities? Neither incident caused large-scale power outages. In the Bergheim substation incident in western Germany, five lignite-fired generators (totaling 4,200 MW) were disconnected from the grid, but three units were restored to operation the following day. In the Jenschwald incident in eastern Germany, only one of the multiple "rocket-shaped" explosive devices hit its target, causing a short circuit in the high-voltage line. However, the symbolic significance outweighed the actual damage—the attacks targeted critical German infrastructure, and the deterrent signal they sent was far more threatening than physical destruction. Question 4: What is Russia's "shadow fleet"? Why has it become a focus of sanctions? The "shadow fleet" refers to Russia's network of commercial vessels used to circumvent Western oil export sanctions. These vessels often conceal their oil transport routes through opaque registration, disabling satellite positioning signals, and ship-to-ship transfers. The EU has previously imposed sanctions on dozens of "shadow fleet" vessels and authorized EU naval forces conducting military operations in the Mediterranean to intercept and inspect foreign ships suspected of transporting Russian oil. Germany's announcement of increased pressure on the "shadow fleet," coupled with the French Foreign Minister's call for further action, indicates that the EU is expanding its sanctions from the vessels themselves to targeting the entire support network assisting them. Question 5: What is the connection between the Alternative for Germany (AfD) party and the current situation? The AfD is a far-right party that has long advocated for a de-escalation of relations with Russia and opposed military aid to Ukraine. Prior to the Saxony-Anhalt state elections held on September 5-6, the party was leading in the polls. The attacks on critical infrastructure at this sensitive juncture have drawn criticism from ruling coalition MP Trohm, who described them as "extremely noteworthy." Analysts believe that such events may amplify voters' anxieties about security, objectively benefiting the ruling coalition's hardline stance in securing votes, but could also exacerbate social divisions—precisely the "intimidation and division" goals that hybrid warfare seeks to achieve. Question 6: What impact will this have on the Euro? The EU's proposed expansion of sanctions against Russia has exacerbated geopolitical tensions, while rising energy costs and safe-haven demand are putting pressure on the euro. On September 3, the euro traded around 1.1590 against the dollar, capped by the 200-day moving average (around 1.1631). While the eurozone's August inflation rate reached 3.3%, and expectations of a European Central Bank rate hike provided some support, ongoing geopolitical conflicts and energy shocks continue to limit the euro's upside potential. Several institutions predict the euro may further decline to the 1.15 level against the dollar by the end of the month. At 09:33 Beijing time, the euro was trading at 1.1592/93 against the dollar.