Explosive drones are increasingly being controlled via mobile networks, making them harder to detect. Ukraine demonstrated the technology in Operation “Spiderweb”, Israel in Iran. Now the threat appears for the first time in Germany.

Two weeks ago, a bus driver is said to have found a quadcopter at Leipzig/Halle Airport in Germany that had apparently previously been fitted with explosives and flown towards the fuel tanks of an Antonov aircraft from Ukraine. That same evening, a DHL cargo aircraft also apparently collided with a drone there. It is plausible that the government in Moscow was behind the alleged attempted attack, but this cannot be confirmed.

The German government has so far made no statement on possible perpetrators. Interior Minister Alexander Dobrindt (Christian Social Union) merely spoke of a “new kind of threat”. He is right, particularly with regard to the technology involved: the drone at Leipzig/Halle Airport was not controlled by radio as usual but, as far as is known, by two SIM cards via the public mobile network. Ukraine in particular has experience with this technology, but so do Israel, Iran and Russia.

Control via any internet provider

Drones controlled via mobile networks are equipped with commercially available modules for one or more SIM cards. This allows them to connect to the networks of any internet provider. Pilots can send navigation commands and receive high-resolution video. Unlike radio-controlled drones, the distance from the area of operations is unlimited – as long as there is a mobile network there.

Modules for this type of mobile control are cheaply available in electronics shops worldwide. The software required is often open source and runs on single-board computers such as the Raspberry Pi. One disadvantage compared with radio-controlled drones, however, is the latency of mobile communications, meaning that the transmission of control commands is delayed by fractions of a second.

Spectacular “Spiderweb” operation

The most spectacular use of this technology to date was demonstrated by Ukraine in June 2025 in Operation “Spiderweb”. The SBU intelligence service attacked four Russian military airfields, some of them more than 4,000 kilometres from Ukraine. Up to 14 strategic bombers and other combat aircraft were hit and, in most cases, destroyed.

According to current investigations, two drones were involved at Leipzig/Halle Airport, while there were 117 in Operation “Spiderweb”, according to the Ukrainian intelligence service. They are said to have been transported in wooden crates on lorries to the vicinity of the airfields months beforehand. This could also have happened in Germany – various media reports say that unknown clients allegedly sent couriers with drone components to Germany via Poland, supposedly to test transport routes. In Operation “Spiderweb” in Siberia and other parts of Russia, the drivers were reportedly from unsuspecting civilian transport companies and left the lorries at motorway rest areas or petrol stations. It is not yet known where the drones were launched during the alleged attack in Germany – or neighbouring countries. Police searched the abandoned village of Kursdorf bordering Leipzig/Halle Airport after eyewitnesses reported an explosion there.

Similar use of sleeper drones in Iran

Russia and Iran also use drones controlled via mobile networks, according to Western intelligence services. Iranian “Shahed” kamikaze drones, for example, can reportedly be equipped with SIM cards and 4G modems. SIM cards belonging to domestic network operators are said to have been found in examples shot down by Ukraine.

Russia is now producing the “Shahed” under licence, where it is known to the military as the “Geran-2”. Last summer, Ukraine also claimed to have found SIM cards from Lithuanian and Polish providers in them. The country’s intelligence service also says it recovered a Russian drone equipped with two LTE modems. The Times of Israel, among others, reported that Israel’s foreign intelligence service Mossad established a clandestine drone base near Tehran before Israel’s major attack on Iran in June 2025 and also deployed sleeper drones supported by mobile networks from there. The Israeli pilots, operating from a considerable distance, are said to have used them at night to attack launch sites for surface-to-surface missiles in Iran. The operation was similar in scale and years of preparation to Ukraine’s “Spiderweb” operation.

Telecom developing “giant radar”

Technology used to detect drones to date is based on radar systems, optical sensors, the detection of electronic signatures or radio signals. When drones fly with SIM cards, however, detection is considerably more difficult because the data traffic is barely distinguishable from normal smartphone use in the surrounding area.

In Germany, arms manufacturer Rheinmetall and Deutsche Telekom are seeking to develop a new system – with Rheinmetall primarily contributing the “effectors”, i.e. the weapons. Telekom is conducting research with Helmut Schmidt University in Hamburg into how the mobile network itself can become a sensor by detecting anomalies in data traffic – for example, an aircraft moving rapidly between mobile masts. This “giant radar” is intended to become part of the project with Rheinmetall. The cooperation is still at an early stage, however, meaning that attacks such as the one at Leipzig/Halle Airport cannot initially be detected or even repelled using it.

The only option is to switch off the mobile network

Conventional jamming and defence measures are of no use against drones controlled via mobile networks, particularly when they attack in swarms as in Operation “Spiderweb”. Interceptor drones could only take off after the extremely fast aircraft had been detected by automated systems.

Even the new “drone defence centre”, which Interior Minister Dobrindt plans to open at Cochstedt Airport in Saxony-Anhalt tomorrow, Tuesday, will presumably reach its limits in the face of this new threat.

The Federal Police, which is responsible for German commercial airports, could simply switch off the mobile network when unidentified objects approach rapidly – that is at least what Russia does when faced with attacks involving explosive drones from Ukraine.

Attempted attack remains a mystery

It remains unclear whether the two drones at Leipzig/Halle Airport were actually intended to carry out an attack and whether it failed. Alternatively, the unknown party may have intended it as a kind of warning and the explosive package was not supposed to detonate. Or someone may have wanted to ensure that suspicion would fall unequivocally on Russia.

It is also conceivable that German intelligence services have the perpetrators on their radar and, together with foreign partners or the Criminal Police Office, tampered with the drone or the explosive so that it could not detonate. German authorities did something similar almost 20 years ago in the so-called Sauerland Group case in order to continue surveillance and investigations into suspects. That would at least provide an explanation for why the Chancellor Friedrich Merz is also conspicuously silent on the matter.

Published in German in „nd“.

Image: At Leipzig/Halle Airport, a mobile-network-controlled drone flew into the wing of a Ukrainian aircraft. The attack has a precedent claimed by Ukraine (SBU Ukraine).