Recent investigations reveal that Russian intelligence agencies are increasingly utilizing criminal networks, hackers, and recruited civilians to conduct sabotage activities across Europe, including arson and bomb threats. A former taxi driver from Krasnodar has emerged as a key figure in several of these operations.
According to a report by The New York Times, the expulsion of over 750 Russian diplomats from Europe since the onset of the full-scale invasion of Ukraine has significantly hampered Russia’s ability to operate through traditional intelligence channels. Many of those expelled were identified as spies, leading the Russian military intelligence agency, the GRU, to adapt by recruiting criminals, refugees, and individuals willing to act for financial incentives. Unlike professional spies, these recruits reside in Europe and can move freely within its borders.
The investigation is based on court documents and interviews with security officials from five European nations. It identifies Alexey Kolosovsky, a 42-year-old former taxi driver with a background in car theft, hacking, and document forgery, as a key intermediary between the intelligence services and operatives.
Kolosovsky is reported to have organized the delivery of detonators and bomb-making materials to storage locations at train stations, where recruited individuals would collect them, often unaware of their true nature. One such recruit was a Ukrainian teenager, Daniil Bardadym, who, in May 2024, planted an incendiary device in an IKEA store in Vilnius. The device detonated on May 9, coinciding with Russia’s Victory Day celebrations. Bardadym was apprehended days later while en route to Riga with materials for another bomb. In exchange for his actions, he received an old BMW.
Around the same time, Kolosovsky’s associates set fire to a site near Warsaw, destroying over 1,000 small businesses. Polish Prime Minister Donald Tusk indicated that authorities were likely aware of the involvement of Russian intelligence, leading to the closure of all Russian consulates in Poland.
By July 2024, the scale of operations had expanded. Incendiary devices containing thermite, hidden in massage pillows with electronic timers, detonated in a DHL shipping container in Leipzig, on a truck in Poland, and at a DHL warehouse in Birmingham. Had the Leipzig plane not been grounded, an explosion in the air could have occurred. The seriousness of these incidents prompted the White House to intervene, with senior U.S. officials contacting Moscow to demand an end to such activities.
Kolosovsky is also linked to the hacker group KillNet, which has targeted Ukrainian and European companies since the invasion began. In 2024, KillNet claimed responsibility for hacking a French asset management firm. Security officials believe that Russian intelligence likely recruited Kolosovsky in 2021 following a brief detention, as they routinely seek potential agents among incarcerated individuals.
However, following the DHL operation, Kolosovsky was summoned by the local FSB office in Krasnodar, where his devices were scrutinized. Security officials suggest that the public attention surrounding these operations may have caused dissatisfaction within the Kremlin. Additionally, Kolosovsky appears to be facing financial difficulties, reportedly spending his own money on operations and attempting to recoup costs from intelligence funds. Recently, he has been searching for property in London, which may indicate a desire to leave Russia.
Lithuanian prosecutors have filed charges against more than a dozen individuals connected to Kolosovsky’s operations. Security agencies from five European countries have compiled a list of over 300 names of Russian officers linked to sabotage activities.
The Kremlin has consistently denied any involvement in sabotage operations within Europe.
Investigations reveal that Russian intelligence is increasingly relying on criminal networks and civilians for sabotage operations in Europe. A former taxi driver from Krasnodar has been identified as a central figure in these activities, which have raised significant security concerns across the continent.