Western security officials are revealing details of a clandestine ‘shadow war’ orchestrated by Russia’s intelligence services. This covert campaign involves devastating acts of sabotage, from an arson attack that decimated over a thousand businesses near Warsaw to another that gutted an IKEA store in Lithuania. Disturbingly, it also includes audacious plots to plant incendiary devices on cargo planes across Britain, Germany, and Poland.
Yet, at the center of these escalating plots, officials point to an unlikely mastermind: Aleksei Vladimirovich Kolosovsky, a 42-year-old former taxi driver from rural Russia. Despite his unassuming background, Kolosovsky, who has links to criminal networks specializing in hacking, fake IDs, and car theft, has become indispensable to Russia’s unconventional warfare. With support from Russian intelligence, he has allegedly directed these recent sabotage operations across Poland, Lithuania, Britain, and Germany, as confirmed by court documents and insights from over a dozen security officials from five European nations.
A 2024 arson attack outside Warsaw was one of several plots carried out in Europe by a criminal network on behalf of Russian intelligence services, according to European officials.
Security officials describe Kolosovsky’s role as unprecedented. Far from a formally trained operative or embedded agent, he functions as a ‘service provider,’ collaborating closely with Russia’s military intelligence service, the G.R.U., which spearheads sabotage efforts.
Operatives like Kolosovsky are now common in the Kremlin’s increasingly violent sabotage campaign, which has escalated beyond petty vandalism to bombings, arson, and even murder. The ultimate goal, according to security officials, is to undermine Western unity.
Kolosovsky brings to this fight an extensive network of criminals adept at moving goods and people without attracting law enforcement. Crucially, these contacts reside and can travel freely within Europe—a capability that has become significantly challenging for Russia’s professional intelligence officers since President Vladimir Putin launched his full-scale invasion of Ukraine.
As Blaise Metreweli, head of Britain’s MI6 spy agency, articulated in a speech: ‘We are now operating in a space between peace and war. Russia is testing us in the gray zone with tactics that are just below the threshold of war.’
New Recruits: The Face of Modern Sabotage
Kolosovsky, with his husky build and often unshaven appearance, first caught the attention of Western intelligence agencies following a series of arson attacks in May 2024, two security officials confirmed.
Operating under variations of the alias ‘Warrior’ on the messaging service Telegram, he reportedly recruited a network of agents, including a Ukrainian teenager. Their mission: to plant incendiary devices at an IKEA store in Vilnius, Lithuania, and a large commercial center near Warsaw. These details emerge from court records and official statements.
From his base in Krasnodar, southern Russia, Kolosovsky allegedly orchestrated the delivery of detonators and bomb-making equipment to lockers in train stations. Often, unwitting recruits would retrieve these packages, according to security officials from two Western countries and court documents.
On May 8, 2024, Ukrainian teenager Daniil Bardadim planted an incendiary device with a remote timer in the mattress section of an IKEA store. It ignited in the early hours of May 9, deliberately timed, prosecutors stated, to coincide with Moscow’s celebration of the Soviet Union’s victory over Nazi Germany.
Bardadim was arrested days later, pulled from a bus in Lithuania en route to Riga, Latvia. His bag contained bomb-making materials, including a remote-controlled toy car, two vibrators, and six mobile phones, according to the court documents. He had planned a similar attack in Riga. Before his capture, he received an older model BMW as payment for the Vilnius operation.
Around the same period, another group of accomplices linked to Kolosovsky started a massive blaze outside Warsaw, destroying over 1,000 small businesses. Polish Prime Minister Donald Tusk later asserted that authorities were ‘for sure’ certain of Russia’s intelligence services’ responsibility. In response, Poland closed all Kremlin consulates, significantly hindering Russian spy activities.
‘The actions were coordinated by a person staying in Russia,’ Tusk confirmed.
Kolosovsky has not responded to requests for comment, and the Kremlin consistently denies involvement in sabotage.
The reliance on individuals like Kolosovsky is a matter of necessity for Russia. Since the invasion of Ukraine, over 750 Russian diplomats—the vast majority of whom were spies—have been expelled from Europe, as Ken McCallum, head of Britain’s MI5, noted in 2024.
‘We sent home almost all the Russians,’ stated Michal Koudelka, director of the Czech Security Information Service. ‘The ability of Russians to operate on Czech territory under traditional cover is very limited.’
These expulsions left the Kremlin partially blind, hindering its response as Western nations supplied Ukraine with weapons. Consequently, Putin shifted focus to the G.R.U., long Russia’s primary agency for overseas covert action.
Prior to the 2022 invasion, G.R.U. operatives from a specialized group known as Unit 29155 conducted assassinations, orchestrated coups, and blew up European weapons depots.
Aleksei Vladimirovich Kolosovsky, shown in a photograph posted online in 2020, is believed by Western security officials to have been recruited by Russian intelligence, who saw his European criminal network as a valuable asset. The image also depicts an IKEA store in Vilnius, Lithuania, which was subject to an incendiary device plot in 2024. General Andrei Averyanov, left, led a G.R.U. unit specializing in sabotage in Europe and was promoted after the 2022 invasion of Ukraine.
Following the invasion, the G.R.U. intensified these efforts, promoting Unit 29155’s commander, Gen. Andrei Averyanov, to deputy head of the entire agency. Western intelligence officials viewed this as a clear signal of sabotage’s paramount importance to Putin’s conflict with the West.
General Averyanov now oversees the Special Activities Service, or S.S.D., a G.R.U. branch comprising subunits specializing in cyberwarfare, explosives, and assassination, according to security officials from four European countries. Unit 29155, some added, is now led by Gen. Vyacheslav Stafeyev, a seasoned special operator with cyberwarfare expertise.
General Vyacheslav Stafeyev, a specialist in cyberwarfare, appears in a close-up photo. His name is found on a list of individuals, mostly Russian officers, alleged to be involved in overseas sabotage.
The New York Times reviewed a list of over 300 individuals linked to Russia’s sabotage operations, confirmed by several Western intelligence agencies. This list includes photographs, passport numbers, and cover names for officers like General Stafeyev and other senior S.S.D. members.
‘Servicemen of this unit are involved in the organization, planning and direct execution of terrorist acts and sabotage and terrorist operations on the territory of Ukraine, the European Union and other countries outside Russia,’ a note attached to the list, circulated among over three dozen intelligence services, declared.
Sabotage is not a new tactic for the G.R.U., with training manuals from the 1930s detailing ‘deep battle’ concepts, including operations far behind enemy lines.
However, those operations were traditionally reserved for professional officers in wartime. Today, Russia relies on a disparate collection of criminals, Ukrainian refugees, and others desperate for money.
‘During the Cold War there was at least some level of accountability and professionalism,’ remarked Sean Wiswesser, a former C.I.A. officer who authored a book on Russian spy services. ‘But now everything seems to be in the realm of possibility. We’ve never seen this level of recklessness.’
A Spy Network’s Unlikely Leader
Kolosovsky’s public persona gives no hint of a life of secret intrigue.
According to security officials from one European country, he appears to lead a modest life and frequently struggles with debt. His social media accounts, though featuring many cars, show no luxury vehicles. His last post on one account, on his birthday in December 2020, included a photograph with his mother.
However, Western security officials and researchers investigating his background uncovered evidence of a hidden life.
Kolosovsky was reportedly associated with Daniil Oleynik, a professional car thief known online as ‘Wasp Killer.’ Western security officials linked both men to a Telegram channel—Kolosovsky using the alias LexTER—that served as a platform for extorting ransom payments from victims of car theft. Oleynik was later arrested in Italy and extradited to Ukraine in August 2024 on car theft charges.
While Kolosovsky’s direct involvement in car theft remains unclear, researchers and security officials connected his phone numbers to various Telegram channels and groups engaged in smuggling, doxxing, selling fake IDs, and distributing car theft equipment. His number was frequently saved in contacts as ‘Aleksei’ followed by a car brand, such as Lexus, Ford, or Toyota.
Kolosovsky is also a skilled cyberoperator. Security officials in one European country associated him with KillNet, a hacker collective that, since the invasion, has targeted Ukrainian and European company websites. In 2024, the group claimed responsibility for hacking a French asset management company.
‘Nothing personal, we’re just against the support of Nazis,’ KillNet declared on social media, echoing a favored Kremlin derogatory term for the Ukrainian government.
Their communications often concluded with: ‘Our enemies fall at our feet. Long Live Russia.’
A 2024 leak by a rival hacker group connected Kolosovsky to the online handle @warriorkillnet.
In 2021, Kolosovsky was briefly detained by Russian authorities for undisclosed reasons. Security officials believe this period likely marked his recruitment by intelligence services, who often seek out potentially useful inmates in prisons in exchange for their freedom.
Following Kolosovsky’s detention, his associate, Oleynik, urged followers to delete their communications due to authorities confiscating Kolosovsky’s electronic devices. Telegram channels, possibly linked to Kolosovsky, also vanished, officials noted.
His mother, who regularly shares family photographs on social media, has not posted any of Kolosovsky since at least 2021. When questioned about his whereabouts in a July 2022 Russian social media comment, she replied that he was on a business trip.
A Growing Backlash: Russia’s Reckless Escalation
In the early hours of July 20, 2024, a shipping container ignited while being loaded onto a DHL cargo plane in Leipzig, Germany. Less than 24 hours later, a package on a freight truck in Poland burst into flames. The next day, a similar incident occurred on a forklift carrying a pallet of packages at a DHL shipping facility in Birmingham, England.
These coordinated attacks profoundly unnerved Western governments, surpassing previous sabotage efforts due to their potential for mid-air explosions and mass casualties. A massive international investigation involving nine countries later confirmed the G.R.U.’s responsibility, revealing a vast European network of operatives who executed the plots with ‘a very strict conspiracy,’ according to Lithuanian prosecutors, where the parcel bombs originated.
At the heart of these attacks, security officials in two European countries identified Kolosovsky.
He allegedly orchestrated the recruitment of the network responsible for transporting and distributing the materials for these incendiary devices. Court documents reveal that the network used thermite, a military-grade incendiary material, to construct devices hidden within massage pads fitted with electronic timers.
Two DHL planes on an airport tarmac illustrate the setting where one of Kolosovsky’s network’s incendiary devices, planted on a DHL cargo plane in Leipzig, Germany, almost detonated midair in 2024.
(It is worth noting that earlier reports from a major news outlet had also touched upon Kolosovsky’s potential involvement with the G.R.U. and his connection to the cargo plane incendiary plot.)
These attacks signaled a drastic escalation in Russia’s shadow war, demonstrating a heightened willingness to employ violence for national security aims, according to security officials from five European countries. Had the DHL cargo plane in Leipzig not been delayed, the device likely would have exploded mid-flight. The White House was so alarmed that President Joseph R. Biden Jr.’s national security adviser and the head of the C.I.A. immediately contacted their Russian counterparts, delivering a clear message to cease such actions.
‘The Russians have taken state-sponsored murder and sabotage to a new level,’ Wiswesser reiterated. ‘They’re using it to accomplish strategic aims.’
While the attacks conveyed an ominous message, Russia has faced significant repercussions.
Lithuanian prosecutors moved swiftly to dismantle the plot, charging over a dozen individuals, several of whom were also implicated in the IKEA store attack. Among them was a Russian citizen, Yaroslav Mikhailov.
Several men in suits are seated at a table during a meeting, with Sergei Naryshkin, second from left, head of Russia’s foreign intelligence service, visible in a 2025 photograph released by Russian state media.
Security officials from two European countries state that Mikhailov, a long-time friend of Kolosovsky, was specifically recruited for the DHL operation. Mikhailov is now embroiled in a diplomatic dispute, detained in Azerbaijan and wanted by Poland, which issued an Interpol ‘red notice’ for his arrest. Russia, in turn, filed a counter-application with Interpol, a common tactic to retrieve its arrested spies and agents.
The Kremlin’s keen interest in Mikhailov’s case underscores his perceived importance, officials noted. Mikhailov reportedly sent a letter to Sergei Naryshkin, head of Russia’s foreign intelligence service, requesting assistance for his return to Russia.
Kolosovsky, too, has advocated for his friend, lobbying his Russian intelligence handlers to help free Mikhailov.
However, Kolosovsky appears to be facing his own set of challenges.
Following the DHL operation, he was summoned to the local F.S.B. office—Russia’s domestic security agency—in Krasnodar, where his electronic devices were searched, according to security officials. Explanations vary, but some suggest that the widespread publicity surrounding his activities, particularly the DHL plot, may have led to pushback from the Kremlin.
Officials also noted signs of Kolosovsky’s financial difficulties. Evidence suggests he used his personal funds for some operations and may have attempted to reimburse himself with intelligence service allocations.
Although he has not traveled internationally since the Ukraine invasion, he recently searched online for real estate in London, officials in two European countries reported. This could indicate he is looking for a future retirement home or a potential escape route from Russia.