Tweet recounts German and Latvian reporting on GRU-linked operative Oleg Levushkin, alleged organizer of a failed plot to bomb Ukrainian planes at Leipzig Airport, his dual Russian-Latvian citizenship, family ties including a security officer in a Latvian critical infrastructure firm, and the role of GRU Col. Denis Smolyaninov and Serbia in such operations.

Military & Paramilitary OperationsHigh-Tech Military ToolsUnderwater sabotage (pipelines, cables, sensors)

Aggressor

Summary

Social media summary of a German investigative journalism article and Latvian TV coverage about Oleg Levushkin, described as the organizer of a failed operation in Germany to blow up Ukrainian aircraft at Leipzig Airport. The post notes that Levushkin holds both Russian and Latvian citizenship and that the Latvian State Security Service (VDD) has initiated a procedure to revoke his Latvian citizenship. The author highlights additional details from the German article: Levushkin reportedly has three daughters. One, aged 19, presents herself on social media as an influencer and was recently in Saint Petersburg, Crimea, and Venice; she attended a Rammstein concert in Tallinn in 2022 and worked at the Saint Petersburg International Economic Forum in 2025. Another, the eldest daughter (35 years old), is said to live in Riga, with her husband reportedly responsible until November of the current year for corporate security at a partly state-owned Latvian internet and electricity service provider (a company described as part of Latvia's critical infrastructure but not named). This company allegedly told German journalists that "employment relations with the respective person were recently terminated." The post also states that the GRU colonel who recruited Levushkin, Denis Smolyaninov, is on the EU sanctions list and is responsible for a so-called "Ukraine directorate." Serbia is repeatedly mentioned in the German article as an important location and staging ground inside the EU for such operations. The tweet links to a Welt investigative segment and to a Latvian DeFacto television segment as sources on the case.

Classification

Confidence: Medium

The tweet summarizes reporting that attributes to Oleg Levushkin the role of organizer in a failed operation to bomb Ukrainian planes at Leipzig Airport, an act that would constitute a serious hostile operation on German territory and part of a broader Russian military-intelligence campaign. It also connects Levushkin to a GRU colonel under EU sanctions and notes operational hubs such as Serbia. These elements align with hostile state or state-proxy activity, though details of the plot and ti...

Source URL

https://x.com/kSukevics/status/2120806891240468893

Open source

Provenance

Publisher: extension
Submitted: Nov 12, 2026, 10:55 UTC
Last updated: Nov 12, 2026, 11:37 UTC
Event time: Nov 12, 2026, 09:12 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "3ece1326-f2d9-43e0-ad99-af79b9ea8e48",
  "url": "https://x.com/kSukevics/status/2120806891240468893",
  "source": "extension",
  "status": "processed",
  "category": "Military & Paramilitary Operations",
  "subcategory": "High-Tech Military Tools",
  "incident_type": "Underwater sabotage (pipelines, cables, sensors)",
  "country": "Germany",
  "source_reliability": "F",
  "info_credibility": "6",
  "tags": [
    "Oleg Levushkin",
    "Leipzig Airport",
    "Ukrainian aircraft",
    "Germany",
    "Latvia",
    "Russia",
    "VDD",
    "latvian security service",
    "dual citizenship",
    "GRU",
    "Denis Smolyaninov",
    "EU sanctions list",
    "Ukraine directorate",
    "Serbia",
    "Welt",
    "DeFacto",
    "Latvian critical infrastructure",
    "internet and electricity provider",
    "corporate security",
    "Saint Petersburg International Economic Forum",
    "Rammstein concert",
    "Tallinn",
    "Crimea",
    "Venice",
    "Riga",
    "Saint Petersburg"
  ],
  "nodes": [],
  "countries": [],
  "where_text": "Land",
  "headline": null,
  "description": "Social media summary of a German investigative journalism article and Latvian TV coverage about Oleg Levushkin, described as the organizer of a failed operation in Germany to blow up Ukrainian aircraft at Leipzig Airport. The post notes that Levushkin holds both Russian and Latvian citizenship and that the Latvian State Security Service (VDD) has initiated a procedure to revoke his Latvian citizenship. The author highlights additional details from the German article: Levushkin reportedly has three daughters. One, aged 19, presents herself on social media as an influencer and was recently in Saint Petersburg, Crimea, and Venice; she attended a Rammstein concert in Tallinn in 2022 and worked at the Saint Petersburg International Economic Forum in 2025. Another, the eldest daughter (35 years old), is said to live in Riga, with her husband reportedly responsible until November of the current year for corporate security at a partly state-owned Latvian internet and electricity service provider (a company described as part of Latvia's critical infrastructure but not named). This company allegedly told German journalists that \"employment relations with the respective person were recently terminated.\" The post also states that the GRU colonel who recruited Levushkin, Denis Smolyaninov, is on the EU sanctions list and is responsible for a so-called \"Ukraine directorate.\" Serbia is repeatedly mentioned in the German article as an important location and staging ground inside the EU for such operations. The tweet links to a Welt investigative segment and to a Latvian DeFacto television segment as sources on the case.",
  "summary_short": "Tweet recounts German and Latvian reporting on GRU-linked operative Oleg Levushkin, alleged organizer of a failed plot to bomb Ukrainian planes at Leipzig Airport, his dual Russian-Latvian citizenship, family ties including a security officer in a Latvian critical infrastructure firm, and the role of GRU Col. Denis Smolyaninov and Serbia in such operations.",
  "summary_extended": null,
  "actor_primary": null,
  "target_primary": null,
  "location_text": "Leipzig Airport, Germany",
  "location_region": null,
  "location_coordinates_lat": 51.165691,
  "location_coordinates_lon": 10.451526,
  "location_precision": "Exact",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "Medium",
  "classification_rationale": "The tweet summarizes reporting that attributes to Oleg Levushkin the role of organizer in a failed operation to bomb Ukrainian planes at Leipzig Airport, an act that would constitute a serious hostile operation on German territory and part of a broader Russian military-intelligence campaign. It also connects Levushkin to a GRU colonel under EU sanctions and notes operational hubs such as Serbia. These elements align with hostile state or state-proxy activity, though details of the plot and ti...",
  "event_time_utc": "2026-11-12T09:12:20.000Z",
  "end_time_utc": null,
  "event_time_confidence": "pm24h",
  "created_at": "2026-11-12T10:55:00.039Z",
  "updated_at": "2026-11-12T11:37:05.917Z",
  "reliability_band": "pattern",
  "location_precision_band": "exact",
  "time_precision_band": "within_24h",
  "severity_band": "significant",
  "attribution_basis": "single_source"
}

Public assessmentReliability: Pattern fitSeverity: SignificantSingle sourceTime: Same dayLocation: Exact

Source reliability

Info credibility

Event time

Nov 12, 2026, 09:12 UTC

Event time confidence

pm24h

Location

Leipzig Airport, Germany

Country

Germany

Tags

Oleg Levushkin, Leipzig Airport, Ukrainian aircraft, Germany, Latvia, Russia, VDD, latvian security service, dual citizenship, GRU, Denis Smolyaninov, EU sanctions list, Ukraine directorate, Serbia, Welt, DeFacto, Latvian critical infrastructure, internet and electricity provider, corporate security, Saint Petersburg International Economic Forum, Rammstein concert, Tallinn, Crimea, Venice, Riga, Saint Petersburg

Loading signal...

{ "id": "3ece1326-f2d9-43e0-ad99-af79b9ea8e48", "url": "https://x.com/kSukevics/status/2120806891240468893", "source": "extension", "status": "processed", "category": "Military & Paramilitary Operations", "subcategory": "High-Tech Military Tools", "incident_type": "Underwater sabotage (pipelines, cables, sensors)", "country": "Germany", "source_reliability": "F", "info_credibility": "6", "tags": [ "Oleg Levushkin", "Leipzig Airport", "Ukrainian aircraft", "Germany", "Latvia", "Russia", "VDD", "latvian security service", "dual citizenship", "GRU", "Denis Smolyaninov", "EU sanctions list", "Ukraine directorate", "Serbia", "Welt", "DeFacto", "Latvian critical infrastructure", "internet and electricity provider", "corporate security", "Saint Petersburg International Economic Forum", "Rammstein concert", "Tallinn", "Crimea", "Venice", "Riga", "Saint Petersburg" ], "nodes": [], "countries": [], "where_text": "Land", "headline": null, "description": "Social media summary of a German investigative journalism article and Latvian TV coverage about Oleg Levushkin, described as the organizer of a failed operation in Germany to blow up Ukrainian aircraft at Leipzig Airport. The post notes that Levushkin holds both Russian and Latvian citizenship and that the Latvian State Security Service (VDD) has initiated a procedure to revoke his Latvian citizenship. The author highlights additional details from the German article: Levushkin reportedly has three daughters. One, aged 19, presents herself on social media as an influencer and was recently in Saint Petersburg, Crimea, and Venice; she attended a Rammstein concert in Tallinn in 2022 and worked at the Saint Petersburg International Economic Forum in 2025. Another, the eldest daughter (35 years old), is said to live in Riga, with her husband reportedly responsible until November of the current year for corporate security at a partly state-owned Latvian internet and electricity service provider (a company described as part of Latvia's critical infrastructure but not named). This company allegedly told German journalists that \"employment relations with the respective person were recently terminated.\" The post also states that the GRU colonel who recruited Levushkin, Denis Smolyaninov, is on the EU sanctions list and is responsible for a so-called \"Ukraine directorate.\" Serbia is repeatedly mentioned in the German article as an important location and staging ground inside the EU for such operations. The tweet links to a Welt investigative segment and to a Latvian DeFacto television segment as sources on the case.", "summary_short": "Tweet recounts German and Latvian reporting on GRU-linked operative Oleg Levushkin, alleged organizer of a failed plot to bomb Ukrainian planes at Leipzig Airport, his dual Russian-Latvian citizenship, family ties including a security officer in a Latvian critical infrastructure firm, and the role of GRU Col. Denis Smolyaninov and Serbia in such operations.", "summary_extended": null, "actor_primary": null, "target_primary": null, "location_text": "Leipzig Airport, Germany", "location_region": null, "location_coordinates_lat": 51.165691, "location_coordinates_lon": 10.451526, "location_precision": "Exact", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "Medium", "classification_rationale": "The tweet summarizes reporting that attributes to Oleg Levushkin the role of organizer in a failed operation to bomb Ukrainian planes at Leipzig Airport, an act that would constitute a serious hostile operation on German territory and part of a broader Russian military-intelligence campaign. It also connects Levushkin to a GRU colonel under EU sanctions and notes operational hubs such as Serbia. These elements align with hostile state or state-proxy activity, though details of the plot and ti...", "event_time_utc": "2026-11-12T09:12:20.000Z", "end_time_utc": null, "event_time_confidence": "pm24h", "created_at": "2026-11-12T10:55:00.039Z", "updated_at": "2026-11-12T11:37:05.917Z", "reliability_band": "pattern", "location_precision_band": "exact", "time_precision_band": "within_24h", "severity_band": "significant", "attribution_basis": "single_source" }