Russia-Backed Network Linked to Exploding Parcels in Europe

Lithuanian prosecutors announced on September 17, 2025, that they have dismantled a Russia-backed network accused of orchestrating a series of parcel explosions and arson attacks across Europe in 2024. The operation, allegedly directed by Russia’s military intelligence service, the GRU, involved sending homemade explosive devices concealed in everyday items such as massage pillows and cosmetic tubes through major courier services, including DHL and DPD. The parcels detonated at logistics centers and warehouses in Germany, Poland, and the United Kingdom, but fortunately caused no casualties.

The Network and Its Operations

According to the Lithuanian prosecutor general’s office, fifteen individuals from Russia, Lithuania, Latvia, Estonia, and Ukraine have been charged in connection with the plot. The investigation revealed that the network used sophisticated methods to disguise incendiary devices, which contained highly flammable substances like thermite, and distributed them via international courier routes. The parcels were posted from Vilnius on July 19, 2024, with two sent to the UK and two to Poland. One package exploded at a DHL facility in Leipzig, Germany, another in a DPD truck in Poland, and a third at a DHL warehouse in Birmingham, England. A fourth device failed to detonate due to a technical fault.

The Lithuanian authorities, supported by intelligence from several European countries, believe the operation was coordinated remotely via encrypted messaging platforms such as Telegram. The suspects included both seasoned operatives and unwitting couriers, some of whom were recruited online. The investigation also linked the network to an arson attack on an Ikea store in Vilnius and a suspected sabotage fire at a Leroy Merlin store in Poland.

International Response and Ongoing Investigations

The cross-border investigation involved more than 30 searches in Lithuania, Poland, Latvia, and Estonia, resulting in the seizure of six kilograms of explosives and the issuance of international arrest warrants for three suspects. Authorities in the UK, Lithuania, and Latvia have detained several individuals, while others remain at large. The Lithuanian prosecutor general’s office stated that the attacks were part of a broader campaign by Russian intelligence to retaliate against European support for Ukraine and to test the security of logistics networks, potentially as a precursor to targeting transatlantic cargo routes.

European security officials have warned that Russian sabotage operations have increased in both frequency and severity since 2023, with the number of attacks nearly quadrupling. The GRU’s Department of Special Tasks, a unit with a history of covert operations, is believed to have overseen the parcel plot. The investigation has highlighted the use of criminal networks and digital platforms to facilitate state-sponsored sabotage, raising concerns about the vulnerability of critical infrastructure across the continent.

Arrests and Legal Proceedings

Several suspects are currently in pretrial detention in Poland and Lithuania, while others are being sought under international warrants. The Polish National Prosecutor’s Office and its counterparts in the Baltic states continue to pursue leads, with ongoing efforts to disrupt further plots. Authorities have confirmed that the same network may have been responsible for multiple acts of sabotage, including arson and attempted bombings, across Europe. The case underscores the evolving tactics of Russian intelligence and the challenges faced by European law enforcement in countering hybrid threats.