German security authorities can now name, with high probability, two suspects behind the drone incursion at Leipzig/Halle airport, according to Welt.

Secret investigation documents obtained by Welt am Sonntag link one suspect to Russia's military intelligence service, the GRU.

If confirmed officially, the finding would shift Berlin's framing of the case from anonymous sabotage to an incident tied directly to a Russian state intelligence body. European governments have spent the past two years debating how to respond to suspected Russian hybrid activity — sabotage, cyberattacks, disinformation — without crossing into open confrontation; a documented GRU link would move this case from criminal investigation toward state attribution.

HYPOTHESIS: Publicly naming a GRU-linked suspect could push Berlin toward a formal diplomatic response or NATO-level consultation. Supporting this: attributing an incident to a foreign military intelligence service is a threshold German authorities rarely cross without intending consequences. Against this: the finding so far rests on leaked files reported by Welt am Sonntag, not on-record confirmation from German prosecutors or the interior ministry.

What to watch: whether German authorities issue an on-record attribution beyond the leaked files; whether Berlin summons Russia's ambassador or raises the case with NATO allies; and whether the two suspects are formally identified or made subject to arrest warrants.