Western security officials are reporting a disturbing escalation in Russia’s covert intelligence operations, a “shadow war” marked by audacious sabotage. These plots include a devastating arson attack that razed over 1,000 businesses near Warsaw, another fire at an IKEA in Lithuania, and a chilling scheme to place incendiary devices on cargo planes across Britain, Germany, and Poland.
However, the mastermind behind these increasingly brazen acts isn’t a seasoned spy, but rather Aleksei Vladimirovich Kolosovsky, a 42-year-old former taxi driver from rural Russia. With a background connected to criminal enterprises involving hacking, fraudulent IDs, and car theft, Kolosovsky has become a crucial operative in this new, unconventional conflict. Aided by Russian intelligence officers, he has orchestrated and executed these recent attacks in multiple European nations, as revealed by court documents and insights from over a dozen security officials across five European countries.
According to security officials, Mr. Kolosovsky’s role is quite unique. He’s not a formally trained intelligence officer or an asset embedded within a foreign government. Instead, he functions as a specialized service provider, collaborating closely with intelligence personnel—primarily from the G.R.U., Russia’s military intelligence service, which spearheads sabotage missions.
Operatives like Kolosovsky are becoming more prevalent in the Kremlin’s increasingly brutal sabotage campaign, which has intensified from minor vandalism to bombings, arson, and even murder. Officials state that the primary objective is to undermine Western unity.
Kolosovsky, they explain, brings to the table an extensive network of criminals adept at moving illicit goods and individuals without attracting law enforcement attention. Crucially, these contacts reside and can travel freely across Europe, a feat that has become exceedingly difficult for Russia’s professional intelligence officers since President Vladimir V. Putin initiated the full-scale invasion of Ukraine.
Blaise Metreweli, head of Britain’s MI6 spy agency, remarked in a speech, “We are now operating in a space between peace and war. Russia is testing us in the gray zone with tactics that are just below the threshold of war.”
New Recruits
Mr. Kolosovsky, with his rugged and often unshaven appearance, first caught the attention of Western intelligence agencies following a series of arson attacks in May 2024, as recounted by two security officials.
Operating through a Telegram account under various iterations of the name “Warrior,” he recruited a diverse group of agents, including a Ukrainian teenager. Their mission was to plant incendiary devices at an IKEA store in Vilnius, the Lithuanian capital, and a major commercial center just outside Warsaw, according to court documents and officials.
From his command center in Krasnodar, a city in southern Russia, Mr. Kolosovsky meticulously organized the delivery of detonators and bomb-making materials to train station lockers. These were then retrieved by often unsuspecting recruits, as detailed by security officials from two Western nations and corroborated by court documents.
On May 8, 2024, Daniil Bardadim, the Ukrainian teenager, placed an incendiary device with a remote timer in the mattress section of an IKEA store. The device was engineered to ignite in the early hours of May 9, deliberately coinciding with Moscow’s celebration of the Soviet Union’s victory over Nazi Germany, prosecutors revealed.
Bardadim was apprehended merely days later while on a bus en route to Riga, the Latvian capital. His bag contained bomb-making components, including a remote-controlled toy car, two vibrators, and six mobile phones, according to court documents. He had intended to detonate a similar device in Riga. Prior to his arrest, he had received an older model BMW as payment for the Vilnius attack.
Concurrently, a different group of accomplices linked to Mr. Kolosovsky ignited a massive fire outside Warsaw, destroying over 1,000 small businesses. Subsequently, Polish Prime Minister Donald Tusk confirmed that authorities were “sure” that Russian intelligence services were responsible. In response to these sabotage plots, Poland closed all Kremlin consulates in the country, significantly hindering Russian espionage activities.
“The actions were coordinated by a person staying in Russia,” Mr. Tusk asserted.
Mr. Kolosovsky has not responded to multiple requests for comment, and the Kremlin has consistently denied any involvement in sabotage operations.
For Russia, the services provided by Mr. Kolosovsky and others like him have become a strategic necessity. Since the invasion of Ukraine, over 750 Russian diplomats, “the great majority of them spies,” have been expelled from Europe, as stated by Ken McCallum, the head of Britain’s MI5, in a 2024 speech.
“We sent home almost all the Russians,” remarked Michal Koudelka, director of the Czech Security Information Service, in an interview. “The ability of Russians to operate on Czech territory under traditional cover is very limited.”
These expulsions severely hampered the Kremlin’s intelligence gathering, leaving it partially blind as Western nations began supplying Ukraine with a flood of weapons and matériel to counter Russian forces. In response, Mr. Putin redirected focus to the G.R.U., which traditionally handled overseas covert actions.
Before the 2022 invasion of Ukraine, G.R.U. operatives from a specialized group known as Unit 29155 were notorious for carrying out assassinations, orchestrating coups, and blowing up weapons depots across Europe.
Following the invasion, the G.R.U. intensified these efforts, elevating Unit 29155’s commander, Gen. Andrei Averyanov, to a deputy head of the entire agency. Western intelligence officials interpreted his promotion as a clear indication of the paramount importance sabotage held in Mr. Putin’s conflict with the West.
General Averyanov now presides over a G.R.U. division known as the Special Activities Service, or S.S.D. in Western intelligence circles. This service comprises several subunits specializing in areas like cyberwarfare, explosives, and assassination, according to security officials from four European countries. Some also noted that Unit 29155 is now under the command of Gen. Vyacheslav Stafeyev, a seasoned special operator with deep expertise in cyberwarfare.
A document detailing individuals involved in Russia’s sabotage operations, reviewed by The New York Times and verified by multiple Western intelligence agencies, lists over 300 names, predominantly Russian officers. The list includes photographs, passport numbers, and cover names, such as those utilized by General Stafeyev and other high-ranking S.S.D. members.
“Servicemen of this unit are involved in the organization, planning and direct execution of terrorist acts and sabotage and terrorist operations on the territory of Ukraine, the European Union and other countries outside Russia,” stated a note accompanying the list, which was distributed among more than three dozen intelligence services.
Sabotage itself is not a new tactic for the G.R.U. Training manuals dating back to the 1930s outline the concept of “deep battle,” which encompasses sabotage operations far behind enemy lines.
However, these operations were historically intended for execution by professional officers during wartime. Now, Russia is increasingly relying on a disparate group of criminals, Ukrainian refugees, and others driven by financial desperation.
Sean Wiswesser, a former C.I.A. officer who has authored a book on Russia’s spy services, against which he worked for decades, observed, “During the Cold War there was at least some level of accountability and professionalism. But now everything seems to be in the realm of possibility. We’ve never seen this level of recklessness.”
A Spy Network
Mr. Kolosovsky’s public presence offers no hint of a life immersed in clandestine affairs.
He reportedly maintains a modest lifestyle and frequently struggles with debt, according to security officials from one European country. His social media profiles showcase numerous cars, none of which are particularly extravagant. His last post on one account dates to December 15, 2020, his birthday, featuring a photograph with his mother.
However, Western security officials and researchers who delved into his background uncovered evidence of a hidden life.
Mr. Kolosovsky appears to have been linked to Daniil Oleynik, a professional car thief known online as Wasp Killer. Western security officials have connected both men to a Telegram channel—Mr. Kolosovsky using the alias LexTER—that served as a platform for extorting ransom payments for stolen vehicles. Mr. Oleynik was arrested in Italy and subsequently extradited to Ukraine in August 2024 on car theft charges.
It remains unclear whether Mr. Kolosovsky was directly involved in car theft. Nevertheless, researchers and security officials have traced his phone numbers to a web of Telegram channels and groups engaged in smuggling, doxxing, and the sale of fake IDs and car theft tools. His number was frequently stored in contacts as “Aleksei” followed by a car brand, such as Lexus, Ford, or Toyota.
Mr. Kolosovsky is also recognized as a sophisticated cyber operator. According to security officials in one European country, he was associated with a hacker collective named KillNet. Since the invasion of Ukraine, KillNet has focused its efforts on attacking the websites of Ukrainian and European companies. In 2024, the group claimed responsibility for hacking a French asset management firm.
“Nothing personal, we’re just against the support of Nazis,” KillNet declared on social media, echoing a common Kremlin slur for the Ukrainian government.
The group’s communications frequently concluded with the defiant message: “Our enemies fall at our feet. Long Live Russia.”
A 2024 leak by a rival hacker group established a link between Mr. Kolosovsky and the online handle @warriorkillnet.
In 2021, Mr. Kolosovsky faced a brief detention by Russian authorities, though the precise reason remains undisclosed. It was during this period, security officials suggest, that he was likely recruited by intelligence services, which often scour prisons for potentially useful inmates willing to collaborate in exchange for freedom.
Following Mr. Kolosovsky’s detention, his associate, Mr. Oleynik, urged followers to erase their communications, as authorities had confiscated Mr. Kolosovsky’s electronic devices, security officials reported. Telegram channels potentially connected to Mr. Kolosovsky also subsequently vanished.
Notably, his mother, who regularly shares family photographs on social media, has not posted any images of Mr. Kolosovsky since at least 2021. When questioned about his whereabouts in a comment on a Russian social media post in July 2022, she responded that he was away on a business trip.
A Growing Backlash
In the early hours of July 20, 2024, a shipping container being loaded onto a DHL cargo plane in Leipzig, Germany, suddenly erupted in flames. Less than 24 hours later, a package on a freight truck traversing Poland ignited. The following day, in Birmingham, England, a similar incident occurred on a forklift carrying a pallet of packages at a DHL shipping facility.
These coordinated assaults unnerved Western governments far more than previous sabotage attempts, given their potential to down cargo planes and inflict mass casualties. A massive investigation spanning nine countries later confirmed that the G.R.U. was behind the plots, executed by an extensive network of operatives across Europe who maintained a “very strict conspiracy,” according to Lithuanian prosecutors, where the parcel bombs originated.
At the core of these attacks, security officials in two European countries revealed, was Mr. Kolosovsky.
He orchestrated the recruitment of the network responsible for the transportation and distribution of materials used to construct the incendiary devices, European security officials and court documents confirmed. The network, according to these documents, utilized military-grade thermite to create the devices, which were concealed inside massage pads equipped with electronic timers.
(The Washington Post had previously reported Mr. Kolosovsky’s potential involvement with the G.R.U. and his connection to the plot to place incendiary devices on cargo planes.)
These attacks signaled a drastic escalation in Russia’s shadow war, demonstrating a heightened willingness to employ violence to achieve its national security objectives, as stated by security officials from five European nations. Had the DHL cargo plane in Leipzig not been delayed, officials believe the device would likely have detonated mid-flight. The White House was so alarmed that President Joseph R. Biden Jr.’s national security adviser and the head of the C.I.A. immediately contacted their Russian counterparts, delivering a stern message to cease such actions.
“The Russians have taken state-sponsored murder and sabotage to a new level,” Mr. Wiswesser observed. “They’re using it to accomplish strategic aims.”
Despite the ominous message delivered by these attacks, Russia has faced intense backlash.
Lithuanian prosecutors moved swiftly to dismantle the plot, charging over a dozen individuals, several of whom were also implicated in the IKEA store attack. Among them was a Russian citizen named Yaroslav Mikhailov.
Security officials from two European countries state that Mr. Mikhailov, a long-time friend of Mr. Kolosovsky, was specifically recruited for the DHL operation. Mr. Mikhailov is now embroiled in a diplomatic dispute. Currently in Azerbaijan, he is subject to a “red notice” issued by Poland through Interpol for his arrest. Russia, however, has filed a counter-application with Interpol, a tactic frequently used to reclaim its arrested spies and agents.
The Kremlin’s strong interest in his case underscores Mr. Mikhailov’s significance, officials noted. Mr. Mikhailov reportedly sent a letter to Sergei Naryshkin, the head of Russia’s foreign intelligence service, requesting assistance for his return to Russia, according to officials in one of the involved countries.
However, Mr. Kolosovsky appears to be facing his own set of challenges.
Following the DHL operation, he was summoned to the local office of the F.S.B., Russia’s domestic security agency, in Krasnodar, where his electronic devices were subjected to a thorough search, security officials reported. Officials offer various explanations for this; some speculate that the public exposure of his activities, particularly the DHL plot, may have drawn disapproval from the Kremlin.
Officials also indicated signs that Mr. Kolosovsky had been experiencing financial difficulties. There is evidence that he used his personal funds to finance some of his operations and may have attempted to reimburse himself with money allocated by the intelligence services.
Although he has not traveled internationally since the invasion of Ukraine, he recently conducted an online search for real estate in London, according to officials in two European countries—a possible indicator that he might be considering a future retirement outside Russia, or even an escape route.
Tomas Dapkus contributed reporting from Vilnius, Lithuania.