BERLIN/BELGRADE, September 04 (BalkanView)— German investigators are examining possible links between an attempted attack on a Ukrainian aircraft at Leipzig airport and suspects detained in Serbia, as Western security services increasingly scrutinise the Balkan country as a potential recruitment and transit point for Russian-linked sabotage operations across Europe.
The investigation centres on what European security officials describe as “disposable agents” — people recruited, often for money, to carry out narrowly defined acts of sabotage while remaining several steps removed from those who allegedly organise the operations.
According to information reported by German media and cited by Deutsche Welle, investigators are particularly interested in two Serbian nationals held since June and in a wider network that may connect Serbia, Germany, Poland and other European countries.
Russia has repeatedly rejected accusations that it is behind sabotage operations in Europe.
A failed attack in Leipzig
The most serious recent incident occurred at Leipzig airport in early August.
Investigators found a drone close to a Ukrainian Antonov transport aircraft in an area of the airport also used for Ukrainian military logistics.
A container holding plastic explosives was found nearby.
According to the investigation cited by Deutsche Welle, the drone was apparently intended to strike the aircraft’s fuel tank and ignite its kerosene.
The attack failed because the explosive device had allegedly been incorrectly connected to its detonator.
About 10 days later, another similar drone was discovered roughly five kilometres from the airport.
Both devices were equipped with routers, meaning they could potentially have been controlled through mobile networks from a distant location.
Investigators reportedly recovered DNA evidence and identified at least two suspects.
One of them was allegedly in contact with Russian intelligence services and has been linked by investigators to an explosion in the Polish city of Łódź in 2024.
A second suspect travelled to Germany from Istanbul shortly before the Leipzig incident and later left for Serbia.
That route is one reason Serbia has attracted particular attention.
Serbia described as a recruitment hub
German weekly Der Spiegel, cited by Deutsche Welle, reported that Western intelligence services increasingly view Serbia as a hotspot for Russian sabotage activities in Europe.
Russian intelligence services allegedly use the country to recruit and train people for specific operations, according to the report.
German investigators are now closely following the case of Danilo B. and Slobodan Đ., who have been held in Serbia since June 11.
Danilo B. reportedly holds both Russian and Serbian citizenship, while Slobodan Đ. is a Serbian citizen.
They were stopped in separate vehicles while attempting to cross the border into Hungary.
Drone components were allegedly found in one vehicle and containers with explosives in another.
Serbian authorities are investigating them for illegal possession and carrying of weapons, ammunition and explosive materials. Danilo B. is also suspected of document forgery.
No terrorism charges have been announced.
German investigators nevertheless suspect that the two men may possess information about another alleged disposable agent connected to the Leipzig case.
Explosives near the Hungarian border
The investigation has also expanded to an earlier discovery near Kanjiža, close to Serbia’s border with Hungary.
Two backpacks containing explosives were found near a gas pipeline in April, only days before a crucial Hungarian election.
Then-Prime Minister Viktor Orbán used the incident to suggest that Ukraine might have been behind an attempt to disrupt supplies of Russian gas.
Serbian President Aleksandar Vučić did not identify a perpetrator, but said at the time that it was “obvious that geopolitical games will not leave us alone”.
On Sept. 2, the Higher Public Prosecutor’s Office in Subotica said the investigation had been expanded to four additional people.
Two were in custody, one was under house arrest and one was unavailable to Serbian authorities.
The prosecutor’s office declined to comment on German allegations, citing the secrecy of the investigation, but confirmed that the expanded probe was connected to the Kanjiža case.
The rise of ‘disposable agents’
The broader investigation reflects growing concern across Europe about the use of low-profile recruits for sabotage.
Such operatives are typically not professional intelligence officers.
Instead, according to security officials, they may be petty criminals, vulnerable individuals or ordinary citizens recruited online or through intermediaries and paid to carry out specific tasks.
Their value to those directing them lies partly in deniability.
If they are arrested, investigators may be able to prove what they did but struggle to establish who ultimately ordered the operation.
Deutsche Welle cited previous cases in which young Ukrainians were allegedly paid small amounts to spray anti-government graffiti and later set fire to railway-linked electrical infrastructure.
Another case involved damage to at least 270 vehicles in Germany.
According to investigators, suspects — including one Serbian and one Bosnian citizen — injected polyurethane foam into exhaust systems and left stickers designed to make the attacks appear to have been carried out by radical environmental activists.
German investigators suspected that the aim was to provoke public anger against the Greens and indirectly benefit the far right during elections.
Der Spiegel has described the wider campaign as a Russian “shadow war” against Germany.
Germany hardens its response
German Chancellor Friedrich Merz warned last week that those responsible for hybrid attacks against Germany “will pay for it”.
He did not initially name Russia, although other senior German officials subsequently pointed to Moscow as the suspected force behind the Leipzig operation.
The investigation has already had diplomatic consequences.
Germany announced the closure of the Russian House in Berlin and the Russian consulate in Bonn and said border controls on Russian citizens travelling to Germany would be tightened.
Moscow has rejected the accusations.
Russian Foreign Minister Sergei Lavrov recently described allegations of Russian involvement in the Leipzig case as fabricated provocations.
Russia, in turn, announced the closure of several Goethe-Institut locations.
Serbia’s balancing act
The investigation puts additional pressure on Serbia’s already complicated relationship with Russia and the West.
Since Russia’s full-scale invasion of Ukraine, Belgrade has refused to join EU sanctions against Moscow.
At the same time, Serbian ammunition has reached Ukraine through intermediaries, including companies and governments in Central Europe, while Belgrade has also maintained dialogue with Kyiv.
That balancing strategy was again visible during Ukrainian President Volodymyr Zelenskiy’s visit to Belgrade in August.
Serbia has tried to preserve political and cultural ties with Russia while simultaneously strengthening practical cooperation with Western governments.
The sabotage investigations complicate that position.
Previous cases raised similar questions
The Leipzig case is not the first time Serbia has appeared in European investigations into alleged Russian-linked covert activity.
Last September, Serbian authorities arrested two people accused of training around 150 Moldovan and Romanian citizens at a camp near Loznica to provoke unrest after elections in Moldova.
Around the same period, another 11 people were arrested in Serbia on suspicion of espionage and inciting religious and ethnic hatred.
Investigators alleged that members of that group carried out provocations in Paris and Berlin, including attacks on Jewish and Muslim sites intended to fuel intercommunal tensions.
European media widely reported that the operations were carried out for money and in Russia’s interest.
Predrag Petrović of the Belgrade Centre for Security Policy said at the time that it was difficult to believe Serbian security services were unaware of what was happening.
The concern, he argued, was that these were not isolated incidents but part of a wider pattern involving foreign nationals being prepared in Serbia for security-related or paramilitary activities elsewhere.
Belgrade largely silent
Serbian institutions have so far said little publicly about the wider German allegations.
That silence contrasts with increasingly direct statements from German officials.
Interior Minister Alexander Dobrindt said German security services had warned Serbian counterparts and in doing so helped prevent an attack in Germany.
Belgrade has not publicly confirmed that version of events.
The gap between German claims and Serbian public statements is now one of the central questions surrounding the investigation.
Analysts cited by Deutsche Welle argue that Vučić’s government may be trying to avoid an open confrontation with Moscow while quietly cooperating with Western partners through arrests, intelligence exchanges and arms deliveries to Ukraine.
If so, Serbia may simultaneously be a place where alleged Russian networks operate and a country whose authorities are helping dismantle some of those networks.
That contradiction is becoming increasingly difficult to ignore.