A civilian broker at the centre of clandestine plots

European security officials have identified a 42-year-old former taxi driver from southern Russia as a pivotal organiser in a widening campaign of sabotage targeting countries supporting Ukraine. Aleksei Vladimirovich Kolosovsky, described by investigators as a criminal intermediary rather than a trained intelligence officer, is alleged to have coordinated attacks in Poland, Lithuania, Britain and Germany. Court filings and interviews with officials from five European nations indicate he worked closely with officers from Russia’s military intelligence service, the G.R.U. His role illustrates how Moscow has shifted towards outsourcing sensitive operations to deniable actors embedded in criminal networks.
Arson attacks and parcel bomb plots
Authorities link Kolosovsky to a series of arson incidents in May 2024, including a blaze at an IKEA store in Vilnius and a fire outside Warsaw that destroyed more than 1,000 small businesses. Investigators say he recruited operatives through Telegram accounts operating under variations of the name “Warrior”. From Krasnodar, he allegedly arranged the transfer of detonators and bomb components to railway station lockers for collection by local recruits. Around the same period, coordinated incendiary devices were placed in cargo shipments moving through Germany, Poland and Britain, narrowly avoiding catastrophic consequences.

Escalation after diplomatic expulsions
The alleged network emerged after more than 750 Russian diplomats were expelled from Europe following the full-scale invasion of Ukraine. Western security chiefs have said the expulsions severely curtailed Moscow’s traditional intelligence presence. In response, President Vladimir Putin is said to have expanded the remit of the G.R.U., promoting Gen Andrei Averyanov and consolidating sabotage units under a structure known in Western circles as the Special Activities Service. Officials describe the campaign as operating in a “gray zone” between peace and war, designed to erode Western unity without crossing the threshold of open conflict.
Criminal networks and cyber links
Investigators tracing Kolosovsky’s background found connections to car theft rings, online ransom schemes and hacker collectives including KillNet. His telephone numbers were reportedly linked to Telegram channels involved in smuggling and the sale of forged identification documents. A rival hacker group’s data leak in 2024 associated him with the handle @warriorkillnet. Western officials believe such criminal infrastructure allowed him to mobilise operatives able to travel within Europe, a capability increasingly restricted for official Russian officers.
Diplomatic fallout and mounting scrutiny
The sabotage plots triggered an extensive multinational investigation spanning at least nine countries. Polish authorities closed Russian consulates following the Warsaw fire, while Lithuanian prosecutors brought charges against more than a dozen suspects tied to parcel bomb operations. Western governments have warned Moscow that further escalation could provoke stronger countermeasures. The Kremlin has denied responsibility for the attacks.
