Western security officials are uncovering a startling truth: Russia’s intelligence services are waging a covert shadow war across Europe. This campaign includes brazen acts like the arson that destroyed over a thousand businesses near Warsaw, another blaze that engulfed an IKEA in Lithuania, and a dangerous scheme to place incendiary devices on cargo planes destined for Britain, Germany, and Poland.
Remarkably, a central figure in these alarming plots isn’t a seasoned spy, but Aleksei Vladimirovich Kolosovsky, a 42-year-old former taxi driver from rural Russia.
Kolosovsky, who has a background linked to criminal groups involved in hacking, selling fake IDs, and car theft, has emerged as a crucial player in this new, unconventional conflict. With the assistance of Russian intelligence officers, he has allegedly orchestrated the planning and execution of recent operations in Poland, Lithuania, Britain, Germany, and potentially other locations, according to court documents and insights from over a dozen security officials across five European nations.
A 2024 arson attack outside Warsaw was one of several plots carried out in Europe by a criminal network on behalf of Russian intelligence services, according to European officials.
Aleksei Vladimirovich Kolosovsky in a photograph he posted online in 2020. Western security officials believe that Russian intelligence services recruited him, seeing his network in Europe as a valuable asset.
Officials describe Kolosovsky’s role as unconventional. He is not a formally trained operative nor an embedded asset within a foreign government. Instead, he acts as a ‘service provider,’ collaborating closely with intelligence officers—primarily from the G.R.U., Russia’s military intelligence service, which spearheads sabotage operations.
Operatives like Kolosovsky are becoming increasingly vital in the Kremlin’s expanding and more aggressive sabotage campaign. This campaign has escalated dramatically, moving beyond petty vandalism to include bombings, arson, and even murder. Security officials believe the ultimate goal is to erode Western unity.
Kolosovsky, they assert, offers an invaluable network of criminals skilled in moving illicit goods and individuals discreetly, thus avoiding law enforcement detection. Critically, these contacts can operate and travel freely within Europe—a capability that has become increasingly challenging for Russia’s professional intelligence officers since President Vladimir Putin’s full-scale invasion of Ukraine.
“We are now operating in a space between peace and war,” noted Blaise Metreweli, head of Britain’s spy agency MI6, in a public address. “Russia is testing us in the gray zone with tactics that are just below the threshold of war.”
New Recruits
Kolosovsky, described as husky and often unshaven, first drew the attention of Western intelligence services following a series of arson attacks in May 2024, according to two security officials.
Using a Telegram account under various iterations of the name “Warrior,” he allegedly recruited a network of agents, including a Ukrainian teenager. Their mission: to plant incendiary devices at an IKEA store in Vilnius, the Lithuanian capital, and at a major commercial center outside Warsaw, as detailed in court records and by officials.
From his base in Krasnodar, a city in southern Russia, Kolosovsky reportedly orchestrated the delivery of detonators and bomb-making equipment to lockers in train stations. These were then retrieved by often-unwitting recruits, according to security officials from two Western countries and court documents.
On May 8, 2024, Daniil Bardadim, the Ukrainian teenager, placed an incendiary device with a remote timer in the mattress section of an IKEA store. The device ignited in the early hours of May 9, deliberately timed, prosecutors said, to coincide with Moscow’s celebration of the Soviet Union’s victory over Nazi Germany.
Bardadim was apprehended days later while on a bus in Lithuania, en route to Riga, the Latvian capital. He was found with a bag containing bomb-making materials, including a remote-controlled toy car, two vibrators, and six mobile phones, according to court documents. He had planned a similar attack in Riga to the one in Vilnius. As compensation for the IKEA attack, he had received an older model BMW.
Around the same period, another group of accomplices connected to Kolosovsky initiated a massive fire near Warsaw, destroying over 1,000 small businesses. Subsequently, Donald Tusk, Poland’s prime minister, stated unequivocally that Russian intelligence services were responsible. In response, Poland closed all Kremlin consulates in the country, significantly hindering Russian espionage activities.
“The actions were coordinated by a person staying in Russia,” Mr. Tusk confirmed.
Kolosovsky has not responded to multiple requests for comment. The Kremlin has consistently denied any involvement in sabotage operations.
The services provided by Kolosovsky and individuals like him are a strategic necessity for Russia. Since the invasion of Ukraine, over 750 Russian diplomats—the vast majority of whom were spies—have been expelled from Europe, as stated by Ken McCallum, the head of Britain’s domestic security agency MI5, in a 2024 speech.
“We sent home almost all the Russians,” remarked Michal Koudelka, director of the Czech Security Information Service, in an interview. “The ability of Russians to operate on Czech territory under traditional cover is very limited.”
These expulsions left the Kremlin significantly hampered, unable to effectively respond as Western nations rapidly supplied Ukraine with weapons and matériel to counter Russian forces. In response, Putin turned to the G.R.U., which traditionally led overseas covert actions.
Prior to the 2022 invasion of Ukraine, G.R.U. operatives from a specialized unit, known as Unit 29155, conducted assassinations, plotted coups, and detonated weapons depots across Europe.
Mr. Kolosovsky recruited a Ukrainian teenager to plant an incendiary device at an IKEA store in Vilnius, Lithuania, in 2024, European security officials said.
Gen. Andrei Averyanov, left, led a unit within Russia’s military intelligence service that specialized in sabotage in Europe. After the 2022 invasion of Ukraine, he was promoted.
Following the invasion, the G.R.U. intensified these efforts, promoting Unit 29155’s commander, Gen. Andrei Averyanov, to deputy head of the entire agency. Western intelligence officials interpreted his elevation as a clear indication of sabotage’s critical importance to Putin’s conflict with the West.
General Averyanov now oversees the G.R.U.’s Special Activities Service, known by its Russian acronym S.S.D. This service comprises several subunits with diverse specializations, including cyberwarfare, explosives, and assassination, according to security officials from four European countries. Some sources indicate that Unit 29155 is currently commanded by Gen. Vyacheslav Stafeyev, a seasoned special operator with expertise in cyberwarfare.
Gen. Vyacheslav Stafeyev, a specialist in cyberwarfare. His name appears on a list of people, mostly Russian officers, who are alleged to be involved in overseas sabotage.
A list of individuals involved in Russia’s sabotage operations, reviewed by The New York Times and verified by several Western intelligence agencies, contains over 300 names, predominantly Russian officers. The list includes photographs, passport numbers, and cover names, including those used by General Stafeyev and other high-ranking S.S.D. members.
“Servicemen of this unit are involved in the organization, planning and direct execution of terrorist acts and sabotage and terrorist operations on the territory of Ukraine, the European Union and other countries outside Russia,” a note accompanying the list, circulated among more than three dozen intelligence services, stated.
Sabotage is not a new tactic for the G.R.U. Training manuals from the 1930s already outlined the concept of “deep battle,” which included sabotage operations conducted far behind enemy lines.
However, these operations were traditionally meant for professional officers during wartime. Now, Russia is increasingly relying on a diverse group of criminals, Ukrainian refugees, and others driven by financial desperation.
“During the Cold War there was at least some level of accountability and professionalism,” observed Sean Wiswesser, a former C.I.A. officer who spent decades countering Russian spy services and authored a book on the subject. “But now everything seems to be in the realm of possibility. We’ve never seen this level of recklessness.”
A Spy Network
Kolosovsky’s public persona offers no hint of a life steeped in secret intrigue.
He reportedly lives modestly and is frequently in debt, according to security officials from one European nation. His social media accounts primarily feature cars, though none are flashy. His last post on one account, dated December 15, 2020, his birthday, included a photograph with his mother.
However, Western security officials and researchers investigating his background have uncovered evidence of a hidden life.
Kolosovsky appears to have been linked to Daniil Oleynik, a professional car thief known online as Wasp Killer. Western security officials have connected both men to a Telegram channel—Kolosovsky reportedly using the alias LexTER—which served as a platform for extorting ransom payments for stolen vehicles. Oleynik was arrested in Italy and extradited to Ukraine in August 2024 on car theft charges.
It remains unclear whether Kolosovsky was directly involved in car theft. However, researchers and security officials have traced his phone numbers to a network of Telegram channels and groups facilitating smuggling, doxxing, and the sale of fake IDs and car theft tools. His number was frequently saved in contacts as “Aleksei” followed by a car brand, such as Lexus, Ford, or Toyota.
Kolosovsky is also recognized as a sophisticated cyberoperator. He was reportedly associated with the hacker collective KillNet, according to security officials in one European country. Since the invasion of Ukraine, KillNet has focused on attacking the websites of Ukrainian and European companies, notably claiming a hack on a French asset management firm in 2024.
“Nothing personal, we’re just against the support of Nazis,” KillNet declared on social media, echoing a common Kremlin derogatory term for the Ukrainian government.
The group’s communications frequently concluded with the rallying cry: “Our enemies fall at our feet. Long Live Russia.”
A 2024 leak by a rival hacker group connected Kolosovsky to the online handle @warriorkillnet.
In 2021, Kolosovsky was briefly detained by Russian authorities for undisclosed reasons. Security officials believe it was during this period that he was likely recruited by intelligence services, which often seek out potentially useful inmates in prisons, offering freedom in exchange for cooperation.
Following Kolosovsky’s detention, his associate, Oleynik, urged followers to delete their communications, as authorities had seized Kolosovsky’s electronic devices, according to security officials. Telegram channels potentially linked to Kolosovsky also subsequently disappeared.
His mother, who regularly shares family photographs on social media, has not posted any images of Kolosovsky since at least 2021. When asked about his whereabouts in a July 2022 comment on a Russian social media post, she replied that he was on a business trip.
A Growing Backlash
In the early hours of July 20, 2024, a shipping container being loaded onto a DHL cargo plane in Leipzig, Germany, erupted in flames. Less than 24 hours later, a package on a freight truck in Poland spontaneously ignited. The following day, in Birmingham, England, a similar incident occurred on a forklift at a DHL shipping facility, where a pallet of packages caught fire.
These synchronized attacks sent shockwaves through Western governments, surpassing previous sabotage efforts due to their potential for mass casualties and the catastrophic risk of detonating cargo planes mid-flight. A massive investigation spanning nine countries ultimately concluded that the G.R.U. was behind the plots. A vast network of operatives across Europe carried out these actions, meticulously adhering to a “very strict conspiracy,” according to prosecutors in Lithuania, where the parcel bombs originated.
At the core of these attacks, according to security officials in two European countries, was Kolosovsky.
He allegedly coordinated the recruitment of the network responsible for overseeing the transport and distribution of materials used to construct the incendiary devices, according to European security officials and court documents. The network, the documents reveal, utilized a military-grade incendiary material called thermite to create the devices, which were concealed within massage pads equipped with electronic timers.
(The Washington Post previously reported Kolosovsky’s potential involvement with the G.R.U. and his connection to the plot targeting cargo planes with incendiary devices.)
The attacks signified a dramatic escalation in Russia’s shadow war, demonstrating a heightened willingness to employ violence to achieve its national security objectives, as stated by security officials from the five European countries. Had the DHL cargo plane in Leipzig not been delayed, officials believe the device would likely have detonated in midair. The White House was so alarmed that President Joseph R. Biden Jr.’s national security adviser and the head of the C.I.A. immediately contacted their Russian counterparts, delivering a clear message to cease such actions.
“The Russians have taken state-sponsored murder and sabotage to a new level,” Wiswesser observed. “They’re using it to accomplish strategic aims.”
While these attacks delivered an ominous message, the backlash against Russia has been severe.
Lithuanian prosecutors swiftly moved to dismantle the plot, charging over a dozen individuals, several of whom were also implicated in the IKEA store attack. Among them was Yaroslav Mikhailov, a Russian citizen.
In 2024, an incendiary device that Mr. Kolosovsky’s network planted on a DHL cargo plane in Leipzig, Germany, came close to going off in midair, European security officials said.
The head of Russia’s foreign intelligence service, Sergei Naryshkin, second from left, in a 2025 photograph released by Russian state media.
Security officials from two European countries identify Mikhailov as a long-time associate of Kolosovsky, specifically recruited for the DHL operation. Mikhailov is now entangled in a diplomatic struggle. Currently detained in Azerbaijan, he is subject to a “red notice” issued by Poland through Interpol for his arrest. Russia, in turn, has filed a counter-application with Interpol, a tactic frequently used to retrieve its apprehended spies and agents.
The Kremlin’s vested interest in Mikhailov’s case underscores his significance, according to officials. Mikhailov reportedly sent a letter to Sergei Naryshkin, the head of Russia’s foreign intelligence service, requesting assistance in returning to Russia, as revealed by officials in one of the countries.
However, Kolosovsky himself appears to be facing difficulties.
Following the DHL operation, he was reportedly summoned to the local office of the F.S.B., Russia’s domestic security agency, in Krasnodar, where his electronic devices were searched, according to security officials. The reasons for this vary among officials; some suggest that the widespread publicity surrounding his activities, particularly the DHL plot, triggered a negative response from the Kremlin.
Officials also noted signs that Kolosovsky has been experiencing financial troubles. There is evidence suggesting he used his own money to fund some operations and may have attempted to recoup these costs from intelligence service allocations.
Although he has not traveled internationally since the invasion of Ukraine, he recently conducted an online search for real estate in London, according to officials in two European countries—an indication that he might be seeking a future retirement destination, or perhaps a way to escape Russia.
Tomas Dapkus contributed reporting from Vilnius, Lithuania.