As Germany investigates how a drone loaded with explosives reached a runway at Leipzig airport, there is renewed talk in Europe of hybrid war.

The interior minister is warning of a “new level of danger” from an attack that “may involve foreign powers”.

There is no proof at this stage to link the flying bomb directly to Russia, which denies any role. But as well as the means and the motive, Moscow does have form.

The BBC has seen details of the investigation into a plot in 2024 in which Russian-linked proxies in Poland and Lithuania not only handled drones and explosives but also delivered them to Germany.

The quadcopter was discovered at Leipzig airport late on Tuesday night, forcing one runway into lockdown as a bomb disposal robot rolled into action.

On the tarmac close by were several Ukrainian Antonov cargo planes, stripes along their enormous bodies in the blue and yellow of the country’s flag. One reads, “Be Brave Like Kherson”, the southern city now on the frontline of Russia’s invasion.

Pictures published by German media suggest the drone was a relatively small device which airport staff spotted “floating” between the Ukrainian planes.

Around the same time, a DHL cargo plane collided with an “unidentified object” as it pulled up into the sky, unable to land in Leipzig.

Teams are still working to establish whether that was a second drone.

They are also trying to trace who launched the devices and why.

A previous Russian-backed plot involving Leipzig airport could provide clues.

In 2024, a parcel containing a sophisticated incendiary device caught fire at the airport’s DHL hub shortly before it was loaded onto a plane. Similar packages then ignited in the UK and Poland, causing extensive damage.

A group of men are currently on trial in both Lithuania and Poland, where prosecutors believe they were part of a substantial network of proxies recruited by Russian military intelligence.

But there was a subplot that has been little discussed before.

Last September, Lithuanian prosecutors said that investigators had also seized RDX explosives meant for “other terrorist attacks”. The amount was significant: equivalent to 6kg of TNT.

“Some of the devices were manufactured to intensify the blast,” the prosecutor added.

The BBC has since had access to case documents that describe how several of the men on trial were paid to transport those explosives around Europe, concealed in cans of sweetcorn and chopped tomatoes. The detonators were hidden inside headphone sets.

The suspects also handled drone parts and the case talks specifically of attachments, suitable for holding a bomb.

Prosecutors allege that some of the items were brought into the EU from the Russian exclave of Kaliningrad.

Almost two dozen suspects have been charged with terror offences, but with the men’s handlers still at large, believed to be in Russia, it is not clear whether the entire network was disbanded or all the hidden material found.

While there is no evidence of a link to the Leipzig drone bomb, the 2024 plot certainly highlights the potential.

One of the suspects charged in Poland, a Ukrainian called Vladyslav D., described in detail to investigators how he made multiple long car trips in July 2024 following instructions from someone he knew as “Warrior”.

He has since pleaded not guilty in court.

One message sent him to the edge of a Lithuanian forest where he found a carrier bag containing “three or four packs of headphones”, soggy with rain.

He had already collected two cans of corn “lightly covered with soil” from another location, telling investigators he had no idea what was inside.

He was ordered to leave the headphones many hours’ drive away in Poland where he noticed “a guy on a bicycle” collect them from beside the road.

For another assignment he received a pin for a location inside a Lithuanian cemetery and was told to dig beneath some plastic flowers. He quickly uncovered a bin bag wrapped in brown tape.

“Inside were drone components: small plastic propellers, I think four pieces,” Vladyslav told investigators.

These items were to be left by a road in central Poland for pick-up.

Finally there was a trip to Germany where he was given the code to access a hostel room in Dusseldorf. He was instructed to leave the drones and other items inside.

The intended targets were never revealed.

In statements to investigators, Vladyslav D. said he was paid more than $2,000 (£1,487) in cryptocurrency for his efforts. His motive was clear.

And what about the Leipzig case?

Few details about the drone bomb are yet public.

Some German sources report that the explosive was Semtex, which contains RDX – the explosive found in the food cans in a Lithuanian cemetery.

We do not know how much the drone found at the airport was carrying and the physical damage may have been limited.

“The drone casing, if it was metal, might have put a hole in the plane but just a blast wave probably would just have dented it unless they put some fragmentation inside,” explosives expert Professor Jackie Akhavan of Cranfield University explained.

But if Russia was behind this, its aim was more likely to sow fear.

Andrei Soldatov, an expert on Russia’s intelligence agencies, said it “makes sense” to suspect Moscow, pointing to a clear pattern of sabotage and hostile activity, from arson attacks on facilities supporting Ukraine to drones over sensitive sites in Europe.

Germany is one of Kyiv’s biggest suppliers of military aid.

“It’s a message. You get something like that [bomb] into one of the biggest European airports and you send the message that, ‘Guys, we can do that. Remember’,” Soldatov explained.

“You hint to the adversary that you might cause a really big problem: that tomorrow might be more serious.”

And the potential motive? Moscow is under intense pressure from Ukraine’s long-scale drone attacks, he said, and the fact that Russian President Vladimir Putin “has been humiliated, repeatedly”.

“We are aware of the incident, which the German authorities continue to investigate,” a Nato official told the BBC.

Antonov Airlines has also been cautious so far in its response.

The firm supplies planes for certain Nato operations but declined to say whether that includes military support for Ukraine.

Asked whether the Ukrainian planes might have been targeted, a spokeswoman in Kyiv told the BBC: “We are not making any such assumptions…We don’t know what this drone was or why it was there.”

But Russia watchers are clear.

“This is Russian interference,” said John Lough of the New Eurasian Strategies (NEST) Centre. “It’s all part of undermining support for Ukraine by pointing to the dangers of escalation and, frankly, scaring the German authorities.”

He sees high potential for a surge in such hybrid attacks now because Ukraine has “changed the balance” of the war.

“My expectation is that such activity will increase quite sharply over the coming months. I think it’s a dangerous moment.”