A multinational investigation has established that Russia’s military intelligence agency orchestrated a series of parcel bomb attacks across the European Union, utilising a network of disposable couriers recruited through social media and paid in cryptocurrency. The joint probe, involving law enforcement agencies from Germany, Lithuania, Poland, the Netherlands, and the United Kingdom, uncovered a systematic operation targeting EU nations, the United States, and Canada.
Disposable Couriers and Crypto Payments
The GRU, Russia’s military intelligence directorate, built an extensive recruitment system for one-time operatives to conduct arson and sabotage within the EU, exploiting international logistics channels. Controllers from the agency identified potential executors via messaging apps and social networks, offering financial rewards in digital currency. Those recruited often came from vulnerable situations, including citizens of Russia, Baltic states, and Ukraine residing in Europe. Their task involved dispatching hazardous parcels from Vilnius to various destinations; two test packages successfully reached North America, while two others were intercepted in Amsterdam following intelligence work.
Previous Sabotage Campaign and Arrests
This latest revelation follows earlier exposures linking Russian military intelligence to a series of disruptive incidents in July 2024, including fires at DHL warehouses in Birmingham and Leipzig. The incendiary devices were disguised as everyday electronics and cosmetics, activating during transport and posing a significant threat to aviation safety. Within the current investigation, authorities in Lithuania and Poland have detained 22 individuals implicated in the logistical operations. These suspects now face charges of terrorism and espionage for their alleged roles in the network.
Broader Hybrid Campaign Against European Security
The parcel bomb scheme represents an expansion of Russia’s hybrid operations against EU member states, which concurrently include cyber attacks, information campaigns, and acts of sabotage. These activities aim to foster an atmosphere of uncertainty and distrust within European societies, ultimately seeking to undermine EU unity, diminish public support for Ukraine, and weaken sanctions pressure on Moscow. By targeting civilian infrastructure like logistics hubs, the operations create risks for passenger safety, workers, and global supply chains, forming part of a wider strategy to destabilise Europe’s economic and transport systems.
Operational Tradecraft and Deniable Plausibility
A hallmark of the Russian operations is the use of so-called “one-day” executors who lack formal ties to Russian intelligence structures. Recruitment through social media allows the GRU to maintain distance from the attacks, while cryptocurrency payments further complicate financial tracking. This model enables the rapid creation of temporary executor networks in different countries and complicates law enforcement efforts, as each operation may involve new, unconnected participants. In the event of exposure, it provides Moscow with a layer of deniability and a means to avoid direct political accountability.
Coordinated Response and Future Implications
The formation of the joint investigative team between several European nations proved crucial in uncovering the sabotage network. The coordination mechanism allowed for rapid intelligence and evidence sharing, enabling synchronised arrests across different jurisdictions. This collaborative format demonstrates that transnational threats require a unified and coordinated response. The increase in Russian sabotage activity demands that EU nations not only enhance security mechanisms but also develop a clear deterrence system, potentially involving additional sanctions, criminal prosecution of organisers, and strengthened international counter-intelligence cooperation.
