On 17 September 2025, Lithuania’s General Prosecutor’s Office and the Criminal Police Bureau announced the detention of a group accused of orchestrating four terrorist attacks across Europe and planning further operations. Investigators said that in July 2024, a network of 15 individuals used courier services DHL and DPD to send explosive and incendiary devices from Vilnius to the United Kingdom and Poland. The operation was allegedly organized by Russian nationals linked to Moscow’s military intelligence services, according to the Lithuanian prosecutor’s office.
Latvia charges man with spying on NATO facilities
In parallel, Latvian authorities completed an investigation into a man detained on 27 August 2025 by the State Security Service. He is accused of passing information to Russian intelligence about the location, security systems, and construction of Latvian military facilities, as well as the presence of NATO troops. Officials said he also provided details that could threaten the wider security of the Baltic region, according to local media reports.
Recruitment methods and seized explosives
Lithuanian investigators revealed that the group relied on strict secrecy, dividing tasks such as transporting parcels, hiding explosives, and activating incendiary devices among separate, often unconnected operatives. Recruitment was conducted through personal contacts and encrypted channels like Telegram, with payments made in cryptocurrency. More than 30 searches uncovered explosives hidden in food cans and detonators, with a total blast equivalent of over six kilograms of TNT. Some charges were engineered to maximize directional impact, and officials believe they were intended for further attacks.
Broader pattern of Russian hybrid warfare
Western officials have long warned of Moscow’s covert operations. In 2024, the Wall Street Journal reported that Russia planned arson attacks against cargo and passenger aircraft flying from the Baltics to North America. That same year, Lithuania prosecuted two citizens for spying for Belarus, while Estonia sentenced Erna Moisejeva to three years in prison for collaborating with Russia’s FSB. Security experts say Moscow’s strategy involves sabotage, disinformation and the use of “disposable” agents who often do not realize they are working for Russian intelligence.
Baltic states strengthen defenses with NATO
Lithuania, Latvia and Estonia have responded by boosting defense budgets, abandoning restrictions on anti-personnel mines, and building fortified border structures under the joint Baltic Defense Line initiative. Cooperation with NATO has deepened, including the Baltic Sentry mission to protect undersea cables and pipelines, regular air policing, and reinforcement of the Suwałki Gap between Poland and Lithuania. Officials in Vilnius, Riga and Tallinn argue that such steps are essential to counter Russia’s ongoing hybrid pressure, which combines espionage, sabotage, and efforts to exploit Russian-speaking minorities in the region.
