The attempted drone attack at Leipzig/Halle Airport has changed the discussion around drone security in Germany.
Section 1 – The new reality – civil infrastructure used for drone attacks
On 4 August 2026, an explosive-laden drone targeted a Ukrainian cargo aircraft at Leipzig/Halle Airport, one of Germany’s major cargo and logistics hubs. German authorities have since attributed the attack to Russia, an allegation Moscow denies. Germany’s Federal Prosecutor took over the investigation, while the incident has become part of a wider national discussion about sabotage, hybrid threats and the protection of critical infrastructure, but Leipzig raises a problem that extends far beyond airports.
Germany’s Federal Office for Information Security (BSI) reported that, as of 30 June 2026, 1,231 operators were registered with 2,180 critical infrastructure facilities across Germany. These facilities span energy, water, food, IT and telecommunications, healthcare, finance, transport and other essential sectors.
Protecting more than 2,000 geographically distributed facilities against drones cannot depend solely on installing additional point sensors around individual sites.
The threat itself is changing.
Cellular-connected drones can operate through the same civil 4G and 5G infrastructure used by ordinary mobile devices. They can be difficult for conventional RF detection systems to identify, their pilots do not necessarily need to be physically close to them, and small drones can challenge other conventional sensors. This creates a need for a complementary layer of drone detection: large-scale, close-to-real-time cellular airspace intelligence.
What did the Leipzig drone attack reveal?
The Leipzig/Halle incident provides an important case study for understanding how the counter-UAS challenge is evolving.
Traditional drone protection generally relies on combinations of radar, RF scanners, optical cameras, acoustic sensors and other technologies. Each remains important. However, each also observes a particular part of the threat.
The Leipzig case demonstrated why relying exclusively on conventional detection methods can leave gaps when small, cellular-connected drones are involved.
1. Cellular-controlled drones create an RF detection gap
Conventional RF drone detection typically looks for radio-frequency links between a drone and its controller.
A cellular-connected drone changes this communications model.
Instead of relying on a conventional point-to-point controller link, the aircraft can communicate through existing 4G or 5G mobile infrastructure.
According to reporting around the Leipzig investigation, the explosive-laden drone was equipped with 5G antennas, indicating that cellular communication may have been involved.
This matters because cellular communications take place alongside enormous volumes of legitimate network activity.
The drone is no longer necessarily transmitting a conventional drone-control signal that an RF scanner was designed to identify. Its communications blend into the same cellular environment used by smartphones, vehicles, IoT devices and other connected equipment.
Dimetor describes this as one of the key challenges addressed by AirborneAI: non-cooperative drones can hide within ordinary 4G/5G cellular traffic, making them difficult if not impossible to detect through conventional RF signal analytics alone.
2. Small drones create challenges for radar
Radar is an essential component of modern counter-UAS architectures because it can detect physical objects without depending on the aircraft transmitting a signal.
However, small drones create a difficult classification problem. The smaller the aircraft, the harder it can become to distinguish it reliably from other small objects in the airspace, particularly in complex environments with significant clutter.
A counter-UAS architecture therefore cannot assume that radar alone will provide complete identification and classification of every small drone.
This becomes particularly relevant when protecting critical infrastructure, where the system needs to operate continuously without creating even a noteworthy number of false alarms.
3. Acoustic detection has limitations in noisy environments
Acoustic sensors provide another useful source of counter-UAS information by detecting characteristic sounds produced by drone motors and propellers, but airports illustrate their limitations.
Aircraft engines, ground vehicles, industrial equipment and other background noise create a difficult acoustic environment. Similar challenges exist around ports, railway infrastructure, industrial facilities and other critical sites.
Acoustic sensors can therefore contribute to the detection picture, but they cannot provide nationwide coverage or solve the cellular drone problem independently.
EO/IR – Optical Sensors
Widely used at airports and critical infrastructure sites, electro-optical and infrared (EO/IR) sensors support drone detection and visual identification. However, their effectiveness is limited by line-of-sight, weather conditions and visibility, making continuous wide-area coverage difficult.
Multi-Sensor Fusion
No single sensor technology provides complete drone detection coverage. Combining radar, RF, EO/IR, acoustic and cellular intelligence helps address individual detection gaps, reduce false alarms and improve wide-area situational awareness. Cellular intelligence is particularly important for detecting drones that communicate through conventional mobile networks.
Section 2 – How Cellular Drones Change the Paradigm
Cellular-connected drones fundamentally change the threat landscape. The greatest challenge is not simply that operators can control drones remotely, but that the infrastructure needed to operate them already exists across entire countries. These drones can use ordinary 4G and 5G networks, blending their communications into legitimate cellular traffic and making conventional RF detection more difficult.
For critical infrastructure, this creates a nationwide security challenge. Energy distribution networks, railways, ports, airports and telecommunications facilities comprise thousands of geographically dispersed assets. Protecting every location with dedicated counter-UAS sensors is neither practical nor sufficient. Effective protection increasingly requires continuous, wide-area detection capabilities.
For defence, the implications are even more fundamental. Historically, military equipment relied primarily on dedicated military communication systems. Today, hostile drones can operate through civilian telecommunications infrastructure, meaning military threats can be controlled through civilian networks and may need to be detected through those same networks. This represents a major shift in modern warfare and creates a new requirement for defence surveillance and counter-UAS systems.
Dimetor’s AirborneAI addresses this challenge by turning existing cellular infrastructure into a software-based detection network. It detects, localises and characterises cellular-connected drones, providing an additional intelligence layer for both national defence and critical infrastructure protection.
As military threats increasingly exploit civilian communication networks, cellular intelligence must become part of modern counter-UAS detection.
Cellular-connected drones fundamentally change the detection challenge
Cellular connectivity introduces a major shift in drone operations: threats can emerge almost anywhere, with operators potentially controlling aircraft from virtually any location.
Unlike conventional radio-control links, 4G and 5G networks provide extensive, established and relatively inexpensive communications infrastructure. This allows drones to operate without dedicated control equipment near their targets, while their communications blend into legitimate mobile network traffic.
The challenge for counter-UAS systems is significant. Traditional radar, RF and optical detection technologies primarily provide coverage around specific locations, while conventional RF detectors cannot readily distinguish drone communications hidden within ordinary cellular traffic.
As a result, protecting thousands of military and critical infrastructure sites requires more than perimeter-based detection. It requires wide-area visibility into cellular-connected airborne devices.
The fundamental questions remain: Is there a drone? Where is it, and where is it heading? Is it cooperative or potentially hostile? And where is its operator?
From Operation Spiderweb to Leipzig: A Threat Beyond War Zones
Ukraine’s Operation Spiderweb in June 2025 provided a prominent early demonstration of how drones can be deployed near targets while their operations are coordinated remotely. The drones reportedly travelled approximately 6–20 km from their launch locations, with subsequent analysis suggesting that cellular communications may have played a role.
The increasing integration of cellular technology into military drones reinforces this development. Reports cited by the Institute for the Study of War (ISW) describe Russian Shahed-type drones equipped with cellular communication capabilities, illustrating how civilian telecommunications infrastructure can support military operations.
The reported cellular capabilities of the drone involved in the Leipzig/Halle Airport incident further demonstrate why this threat must be considered beyond active war zones. Airports, energy infrastructure, transport networks and military facilities across Europe may face similar vulnerabilities.
As another example, a report published in October 2026 concluded that one of the key elements of the successful, and largely un-detected drone incursion of about 30 drones into Poland – flying up to 500km into Polish airspace – was the use of Polish SIM cards in these drones. They used the Polish civil infrastructure on 4G/5G networks for control and data transmission. RF scanners could not see them.
The critical change is that the communications infrastructure already exists wherever mobile networks operate, while conventional counter-UAS detection remains largely focused on individual locations.
This makes nationwide cellular intelligence an increasingly important component of protecting both critical infrastructure and military assets.
Section 3: Critical Infrastructure protection – example Germany
Germany has 2,180 registered critical facilities to consider
Let’s take Germany as an example. Leipzig/Halle Airport is strategically important, but it represents only one potential target. Germany’s critical infrastructure extends across the entire country.
The BSI (Federal Office for Information Security) reported 2,180 registered critical facilities operated by 1,231 operators as of 30 June 2026.
These include:
- 552 energy facilities
- 219 transport and traffic facilities
- 129 IT and telecommunications facilities
- 356 healthcare facilities
- 198 financial-sector facilities
- 182 water facilities
- 117 food-sector facilities
alongside facilities in other KRITIS (critical infrastructure) sectors.
This geographical scale fundamentally changes the economics and architecture of drone protection.
It is one thing to establish sophisticated counter-UAS protection around a military base or major international airport. It is another to provide persistent situational awareness around thousands of critical facilities distributed across an entire country.
Germany’s critical infrastructure is also highly interconnected. The BSI specifically notes that infrastructure in sectors such as IT and telecommunications and transport can extend across regional boundaries, while energy plays a particularly important role because all other critical-infrastructure sectors depend on it.
A drone-security architecture therefore needs to think beyond individual facilities.
Why protecting only borders and strategic sites is insufficient
Cellular-connected drone threats can emerge anywhere, at any time, with operators potentially controlling them from virtually anywhere in the world. This fundamentally changes the requirements for national airspace security.
Unlike conventional threats that must approach from outside a protected perimeter, cellular-connected drones can already be positioned within a country and use existing 4G and 5G infrastructure for communication. This infrastructure is widely available, reliable and inexpensive, while drone communications can blend into ordinary cellular traffic, making them particularly difficult for conventional RF detection systems to identify.
Traditional counter-UAS systems primarily protect specific locations, such as borders, airports and military installations. However, thousands of critical infrastructure assets, including energy distribution networks, railways, ports and telecommunications facilities, remain geographically dispersed and cannot all be protected through dedicated point-based sensors.
The fundamental challenge is that the threat is no longer confined to predictable locations, while most established detection systems still are. Effective national protection therefore requires continuous, wide-area detection capabilities that can identify, localise and distinguish potentially hostile drones from legitimate airspace users, wherever they operate.
In late September 2026 El Mundo reported that the CIA is warning of potential Russian drone attacks in the Mediterranean region. See reports also from n-TV [Germany] and The Independent [UK]. The drones are reportedly concealed on ships and can be remotely controlled. According to the CIA, these involve Gerbera and/or Geran drones. What does that mean?
All Gerbera and Geran drones are now equipped with cellular modems (see articles confirming that for both the Geran and Gerbera models). Consequently, these drones, capable of flying up to 600 km, could hit thousands of critical infrastructure locations in southern Europe. And equally, what if cellular drones are not waiting on ships, but anywhere in containers in continental Europe? This emphasizes the need for national airspace security and drone detection on cellular to be added.
Section 4: The problem does not go away – it becomes worse
More legitimate cellular drones will make the detection problem harder
4G and 5G connectivity is not inherently a security problem. Quite the opposite: cellular networks are becoming important enablers of legitimate BVLOS drone operations, including public safety, emergency response, infrastructure inspection and logistics.
However, as more drones use mobile networks, distinguishing between legitimate, hostile and accidental airspace users becomes increasingly important.
Simply detecting an airborne cellular device will no longer be sufficient. Security systems must differentiate between authorised aircraft, such as registered police drones (friends); unauthorised or potentially hostile drones (foes); and unintended airborne cellular devices, such as a passenger’s mobile phone left switched on during a flight (fools).
This requires more than identifying airborne signals. Effective airspace intelligence must combine cellular network behaviour, location data, aircraft identification and authorisation information (such as from airspace management platforms), with radar, optical, RF and other sensor inputs to distinguish genuine threats from legitimate or accidental activity.
The objective is therefore moving beyond basic drone detection towards reliable friend-or-foe differentiation, identification of unintended airspace users and multi-sensor situational awareness.
Why cellular drone detection requires a different approach
Deploying dedicated radar, RF, optical and acoustic sensors at every potential critical-infrastructure location will require extensive infrastructure. Detecting cellular connected drones by means of signal intelligence works without additional sensor hardware, utilizing the existing telecom infrastructure and signals.
Mobile infrastructure is already geographically distributed across any country worldwide. About 95% of the populated area worldwide is covered by cellular networks. If information available within these networks can be analysed for airborne signatures, the telecommunications network itself can contribute another layer of drone detection.
This does not eliminate the need for existing sensors. It adds a data source that operates at a fundamentally different scale.
Dimetor’s AirborneAI is designed around this principle.
Section 5 – How AirborneAI helps
How AirborneAI detects drones through cellular networks
AirborneAI identifies network and signalling traces and unusual signal patterns generated by drones operating at altitude.
Dimetor’s approach combines different telecommunications data feeds to identify patterns associated with airborne cellular devices. On that basis, AirborneAI detects, localizes and classifies the rogue drones from legitimate terrestrial mobile-network users. Taking aviation data into account it the further differentiates between non-cooperative, cooperative and unintended airborne users.
AirborneAI is not a replacement for radar or RF detection
No single technology can provide a complete counter-UAS picture.
AirborneAI adds the cellular layer.
For example, a counter-UAS system could combine a cellular indication of an airborne device with radar tracks and optical information.
Correlating these independent sources can provide a more complete operational picture than relying on any individual sensor.
This is why AirborneAI should be considered as part of a large-scale, multi-sensor drone detection architecture, rather than as a standalone replacement for established counter-UAS technologies.
From point protection to nationwide situational awareness
The Leipzig incident demonstrates why the next generation of drone protection cannot focus exclusively on individual airport perimeters.
The example of Germany shows that thousands of critical facilities across sectors underpin everyday society and the economy. The authorities state that the threat situation for critical infrastructure is extremely high and stress the importance of reliable technical and organisational detection capabilities.
At the same time, drones are becoming smaller, more advanced and increasingly connected.
The security architecture therefore needs to add wide-area and close-to-real-time airspace awareness of cellular connected drones.
From a defence perspective that means that civil infrastructure, and data from civil infrastructure, must be considered for effective drone detection and protection against the new threats in hybrid warfare.
Closing the cellular gap in critical-infrastructure protection
The attempted attack at Leipzig/Halle Airport is ultimately about more than one drone or one airport. It highlights a change in the threat model.
A cellular-connected drone can use infrastructure originally designed for legitimate communications. The drone operator can be separated geographically from the aircraft. Small drones can challenge conventional sensors. And as legitimate BVLOS and public-safety drones increasingly use 4G and 5G, identifying suspicious aircraft within cellular traffic will become more important.
The example of Germany’s 2,180 registered critical facilities demonstrates the scale of the protection challenge. Protecting them requires multiple complementary technologies working together.
AirborneAI provides the cellular intelligence layer within that architecture, using telecom-network data to detect, localise and characterise cellular-connected drones and contribute that intelligence to holistic counter-UAS systems.
If hostile drones can use the cellular network, the cellular network needs to become part of the detection and defence picture too.
Learn more about AirborneAI and Dimetor’s approach to cellular drone detection.