Metadata from the emails used to rent a sailboat suspected to have been used in the attack tie them to Ukraine, Spiegel weekly reported Friday.
The president of the presumed shell company through which the “Andromeda” yacht was hired also lives in Kyiv, according to research by broadcasters NDR and WDR, daily Sueddeutsche Zeitung and international media partners.
German investigators had also identified a Ukrainian man in his mid-twenties with ties to the military who they believe may have been part of the six-person team manning the yacht, according to the joint report.
The links to Ukraine corresponded with assessments by multiple intelligence services, according to Spiegel.
The agencies were examining whether the attack could have been carried out by an independent Ukrainian commando group or if a government-backed unit was more likely, the weekly said.
A potential false flag operation, used by the Russians to pin the blame on someone else, has also not been completely ruled out. Separate reports have pointed out that a Russian navy vessel specialised in submarine operations was photographed near the sabotaged Nord Stream gas pipelines just prior to the mysterious blasts in September.
The pipelines had been at the centre of geopolitical tensions as Russia dwindled gas supplies to Europe in suspected retaliation to sanctions over Moscow’s invasion of Ukraine.
Western countries were quick to blame the explosions under the Baltic Sea on Russia following the incident, while the Kremlin has accused the West of sabotage.
German, Swedish and Danish authorities have been investigating the blasts that sparked the leaks.