Back
Automatically translated version. May contain inaccuracies compared to the original.
Russia is sowing chaos in Europe using GRU “one‑use” agents: cargo arson, explosive parcels, and attacks on military logistics
Russian military intelligence has deployed a network of “one‑use” operatives across Europe to carry out sabotage against transport infrastructure, defense firms, and supply routes delivering weapons to Ukraine. After the mass expulsion of Russian diplomats and GRU officers, the GRU increasingly recruits ordinary people via Telegram and intermediaries, commissioning them to transport explosives, set fires, and reconnoiter targets. Operatives are paid, often do not know the ultimate client, and are replaced after arrest. This system allows Moscow to disrupt military logistics and create a persistent threat inside Europe, reports The Telegraph.
One key episode is the case of Ukrainian national Vasyl Kovach, who lived in Latvia for more than 30 years. The 63‑year‑old Kovach was detained by Latvian security services on a farm near Riga on 1 March 2025, with phones, SIM cards, a pistol with the serial number filed off, an AK bayonet‑knife and a mobile phone jammer seized. According to investigators, Kovach was transporting massage cushions to Lithuania that were used to hide incendiary devices. He says he only helped an acquaintance and did not know the contents of the shipment. Five defendants have been brought before a Lithuanian court, and another five before a Polish court.
On 19 July 2024, four parcels containing disguised explosive devices were sent from Vilnius. Already on 20 July in 05:45 one ignited at Leipzig airport before being loaded onto a DHL plane bound for the United Kingdom. The flight delay prevented a possible in‑flight fire. On 21 July a parcel detonated in a DPD truck near Warsaw, and on 22 July one detonated at a warehouse in Birmingham. The fourth device failed to detonate. Hidden incendiary mechanisms were found inside the massage cushions, and cosmetic packages contained additional combustible materials. The Lithuanian Prosecutor General’s Office confirmed the chronology and contents of the shipments.
Investigators established a multistage recruitment system. According to the investigation materials, the intermediary was Andriy Baburov — a former commander of a Russian submarine and an acquaintance of Kovach. Operatives were found through personal contacts and Telegram, offered money to deliver shipments, take photographs, and hand over items. One participant was promised €4000 per month, with payments made in part in cryptocurrency. Each person was responsible only for a separate segment of the operation, unaware of the other participants and organizers.
Among the alleged coordinators, Lithuanian intelligence highlights GRU Colonel Denys Smolianynov. He has already been included on EU sanctions lists for recruiting sabotage operatives via social networks. European investigators also link this model to the preparation of the IKEA arson in Vilnius on 9 May 2024. A joint investigative team from Germany, Lithuania, Poland, the Netherlands and the United Kingdom, with Europol’s support, identified 22 suspects in a series of parcel attacks. Eurojust data also revealed test shipments to the United States and Canada.
In August 2026, the Leipzig/Halle airport was again the target of a sabotage attempt. A drone carrying explosives and a detonator was found near a Ukrainian cargo plane operated by Antonov Airlines, which is used to transport military cargo. Investigators also found traces of other drones; the explosive devices did not detonate. In 1 September Germany officially blamed Russia for the attempted attack, pointing to elements and methods characteristic of Russian hybrid operations.
New episodes hit defense sites and Ukraine‑linked communications. In Munich two Bulgarian nationals were suspected of attempting arson near defense companies, a fire occurred near a weapons factory in Romania, and equipment fires affecting Starlink were recorded in Poland and Bulgaria.
The sabotage mechanism relies on the availability of operatives and on severed links between them. European services assess that the GRU uses people with financial problems, the unemployed, and individuals with criminal pasts. The objectives of the operations are to disrupt deliveries of arms to Ukraine, damage transport and defense infrastructure, increase European states’ security expenditures, and weaken public support for Kyiv.
Unbelievable, but true...
Telegram publication
