Russian military intelligence has increasingly turned to criminal networks, hackers, and recruited civilians to conduct sabotage operations across Europe, including arson and bomb threats, according to a report by The New York Times.
The investigation outlines how, since the onset of Russia’s full-scale invasion of Ukraine, European nations have expelled over 750 Russian diplomats, many of whom were identified as spies. This has significantly hampered the operations of the Main Intelligence Directorate of the General Staff of the Armed Forces of the Russian Federation, which is responsible for such covert activities. In response, Russian intelligence has begun to recruit criminals, refugees, and individuals willing to act for financial compensation, who can move freely within Europe unlike professional spies.
The New York Times’ findings are based on court documents and interviews with security officials from five European countries. One key figure identified is 42-year-old Alexei Kolosovsky from Krasnodar, a former taxi driver with connections to auto theft, hacking, and the production of counterfeit documents.
Kolosovsky reportedly facilitated the delivery of detonators and bomb-making materials to storage locations at train stations, where recruited individuals would collect them, often unaware of their true nature. Among those recruited was a Ukrainian teenager, Daniil Bardadym, who in May 2024 planted an incendiary device in an IKEA store in Vilnius. The device detonated on May 9, coinciding with Russia’s Victory Day celebrations. Bardadym was apprehended days later while traveling to Riga with materials for another bomb, reportedly receiving an old BMW as payment for his actions.
At around the same time, Kolosovsky’s associates set a fire near Warsaw that destroyed over 1,000 small businesses. Polish Prime Minister Donald Tusk indicated that authorities were likely aware of the involvement of Russian intelligence, leading to the closure of all Russian consulates in Poland.
By July 2024, the scale of these operations expanded significantly. Incendiary devices containing thermite, concealed in massage pillows with electronic timers, detonated in a DHL cargo container in Leipzig, on a truck in Poland, and at a DHL warehouse in Birmingham. Had the Leipzig aircraft not been grounded, an airborne explosion could have occurred. The operation raised sufficient concern within the White House that the then-national security advisor and CIA director contacted Moscow to demand a cessation of these activities.
Kolosovsky is also linked to the hacker group KillNet, which has targeted websites of Ukrainian and European companies since the invasion began. In 2024, KillNet claimed responsibility for breaching a French asset management firm. Security agencies believe Kolosovsky was recruited by Russian intelligence in 2021 following a brief detention, as the agency routinely seeks potential agents among incarcerated individuals.
However, following the DHL operation, Kolosovsky was summoned to the local FSB office in Krasnodar, where his devices were examined. Security officials noted that the publicity surrounding these operations may have caused discontent within the Kremlin. Furthermore, Kolosovsky appears to be facing financial difficulties, allegedly spending his own money on operations and attempting to recoup costs from funds allocated by the intelligence services. Recently, he has been seeking real estate in London, which may indicate a desire to leave Russia.
Lithuanian prosecutors have charged over a dozen individuals connected to Kolosovsky’s operations. Security agencies from five European countries possess a list of more than 300 names of Russian officers linked to sabotage activities.
The Kremlin has consistently denied any involvement in sabotage operations within Europe.
A report reveals that Russian intelligence is increasingly utilizing criminal networks and civilians for sabotage operations in Europe, following the expulsion of numerous diplomats. Key figures, including Alexei Kolosovsky, have been implicated in various incidents, raising concerns among European security agencies.