Crossing NATO Lines:
Tracing the GRU’s Explosive Parcel Bombs

• Details of the most dangerous Russian intelligence operation, responsible for explosions in Poland and Europe. Its traces lead to a Soviet nuclear submarine


• We have identified several people who were involved in transporting the bombs on behalf of the GRU. The saboteurs were coordinated by a man convicted of smuggling radioactive materials


• We have reconstructed the route taken by the explosive packages – before they exploded, they crossed the borders of several EU countries many times without arousing suspicion


• The case of the traveling packages is linked to the arson attacks on large stores in Poland and Lithuania

This story is the result of an international investigation involving:

Daniel Flis, Anna Gielewska, Alicja Pawłowska, FRONTSTORY (Poland), VSquare

Inga Spriņģe, Re:Baltica (Latvia)

Indre Makaraitytė, LRT (Lithuania)

Holger Roonemaa, Delfi Estonia

Michael Weiss, Kato Kopaleishvili, Christo Grozev, The Insider

Interactive visualization: Anastasiia Morozova, FRONTSTORY/VSquare

Illustrations: Alisa Szorochowa

This spy story begins several decades ago, during the Soviet era, on a Soviet submarine somewhere between Murmansk and the Mediterranean Sea. Its protagonists, Andrei, Nikolai, and two Alexanders, met at the turn of the 1980s and 1990s. They all served on the same submarine, which penetrated the sea’s depths while hiding from NATO radar.

Alexander Miroshnikov, a cheerful blond with a broad moustache, is the highest-ranking among them. He is a commander: shortly after the fall of the USSR, he helmed the K-387 submarine, a nuclear-powered vessel, for three years. His service consisted of secret missions – during the Cold War, Soviet nuclear submarines escorted their surface fleet and tracked NATO units, conducting intelligence missions. They were capable of approaching the US coast and surfacing near the North Pole. For recruits, service in the navy lasted longer than in other branches of the military, as ships and submarines required skilled personnel.

Thirty years later, Commander Aleksandr inviteds his colleagues from the ship to join him on one more secret mission.

In early summer 2024, former sailor Nikolai calls former sailor Andrei. Andrei Baburov has not served in the navy for a long time, having retired in 1993 as a second captain. A year later, he founded the logistics company Baltic Escort in Russia. He still runs the company and is a businessman and respected figure in St. Petersburg: a multiple president of the freight forwarders' association and a member of veterans' associations. Despite being 63 years old, Andrei keeps up with the times, and for several months his company has been offering its clients a way to circumvent Western sanctions: “Individual approach. Settlements in rubles. [Price:] from two percent of the invoice value,” Baltic Escort’s website offers temptingly.

Nikolai calls to convey a request from Commander Alexander to businessman Andrei. The former commander is looking for someone in Latvia to pick up a package of neck massage pillows. There is a problem with the package: the commander sent it to his relatives in Riga, but they will not be able to pick it up in time because they are traveling. The package, which weighs only a few kilograms, needs to be delivered to them in Vilnius.

The story of the package's journey sounds strange, but Andrei agrees to help. It is difficult to refuse when the commander asks.

GRU operation: sowing fear

Andrei Baburov is currently wanted by the Lithuanian police because today, more than a year after that phone call, it is known that the parcel contained explosives in addition to therapeutic massage pillows. The saboteurs divided them into four shipments, three of which caught fire in July 2024 in logistics company warehouses and at airports in Poland, Germany and the United Kingdom. By a stroke of luck, none of them caused a fire on board the aircraft, which would have led to a crash.

Polish and Lithuanian prosecutors believe that the GRU, the Russian military intelligence service, was behind the parcels and arson attacks.

This was the most dangerous action by Russian services against Europe since the outbreak of full-scale war in Ukraine in early 2022. At the same time, the GRU organized an operation to send other parcels – this time without explosives – from Poland to the US and Canada. Both operations (the one with the commander's package and the one with the shipment to North America) are being investigated by an international team within Eurojust, the EU's prosecuting agency. It includes investigators from Poland, Lithuania, Latvia, Estonia, the UK, Germany, the Netherlands, the US, and Canada.

FRONTSTORY.PL, together with journalists from Re:Baltica in Latvia, The Insider, Delfi in Estonia, Lithuanian public television (LRT), and the Central European outlet VSquare, has established the details of this operation. Based on documents, conversations with Western intelligence officers, and relatives of the perpetrators, we have reconstructed the route of the explosive parcels. As it turns out, they traveled between the Baltic states and Poland for almost a month. We managed to identify not only the so-called “disposable agents” recruited via Telegram, but also their coordinators and clients from Russia.

The operation we are describing involving parcels from 2024 was not a one-off. In the same year, Russia organized a series of similar acts of sabotage in Poland, the Baltic states, and Western Europe. In Warsaw alone, a shopping center on Marywilska Street, a construction warehouse, and an Obi hypermarket were set on fire. All these actions were commissioned by Russians, and the police caught most of the perpetrators.

As in the case of last week's Russian drone attack on Poland, Moscow denies any connection to the sabotage. “We do not rule out that this is simply another case of fake news or a manifestation of blind Russophobia,” Kremlin spokesman Dmitry Peskov said in response to questions from Reuters about the explosive packages in April.

Commander: dies with the secret

“I feel guilty about what happened. I didn't want to get anyone into trouble,” says former sailor and businessman Andrei Baburov.

Baburov, as our partners at Re:Baltica have established, is in Russia. He still lives in St. Petersburg, and until he decides to go to Europe, he can ignore the arrest warrant issued for him by the Lithuanians (who suspect him of organizing sabotage).

It is from him that we know that the sender of the package was Commander Aleksandr Miroshnikov, and that the intermediary was Nikolai Zagorodny, his former subordinate in the navy. To confirm his version of events, Baburov gives the phone number of Nikolai's wife (Nikolai himself recently suffered a stroke and is allegedly unable to speak).

The woman confirms Baburov's version: “Sending parcels between Russia and Europe was a common practice among friends,” she says.

And what does Commander Miroshnikov himself, who asked his old submarine colleagues for help, say about his explosive package? We will never know. Miroshnikov died of cancer in early 2025.

The story of the commander sending a package to his family should therefore be treated with caution. Especially since it contradicts our findings at least one point.

The bomb: it arrives at the parcel locker

According to Andrei, Commander Miroshnikov personally sent the package, which arrived in Riga by bus. But our interlocutors from European law enforcement agencies claim that the package arrived in Latvia as a parcel to a parcel locker (similar to those in Poland).

Andrei Baburov's version omits the fact that the parcel traveled through Latvia not once, but twice.

Initially, the sender (whose identity is unknown) sent it from Narva on June 24, 2024. This is a small Estonian town on the Gulf of Finland, right on the border with Russia, 140 km from St. Petersburg. It is called the most Russian city in the European Union, with 34% of its inhabitants being Russian.

European law enforcement agencies determine that the package was delivered from Narva to Riga via the Estonian courier company Omniva.

It is not known whether the package from Narva already contained explosives. If not, someone must have put them there at a later stage.

The first person to come into contact with the package was Vasilijs Kovacs, an athletic Ukrainian living in Latvia. He never sailed on submarines, but St. Petersburg businessman Andrei Baburov has known him for years and is his son's godfather. It is Kovacs who was asked to pick up the package from the commander.

Kovacs reluctantly agreed to help.

The pistol: found under the sink

Together with his sister's sons, two 20-year-old men, Kovacs got into a Toyota Land Cruiser on June 27 and drove the package to Vilnius. In an interview with Re:Baltica, Andrei recalls that Kovacs was angry when he called from Vilnius: no one had picked up the package, so he allegedly left the car unlocked and went to get something to eat, telling the recipients to take the package from the trunk themselves.

Re:Baltica reporters contacted a member of Kovacs's family (who wishes to remain anonymous). According to him, Vasilijs is a man of many talents. In the 1990s, he founded a company in Russia, which was unlawfully taken away from him. In Latvia, he traded in electronic equipment, bred horses, and earned extra money as a sailor on ships between Spain, Majorca, and Cuba.

During a search of his home, Latvian authorities found a gun with a filed-off serial number and an object resembling a GSM signal jammer under the kitchen sink. They also found files related to a 2022 criminal case involving the murder of a Latvian gangster. Vasilijs claims he does not know where the weapon came from. Court files? Someone put them in his mailbox to help with the case. How could he have done that? It is not known.

He also denies involvement in sabotage, claiming that he was only transporting massage pillows. He does not know who picked them up. When he returned from lunch in Vilnius, the trunk of his Toyota was already empty.

Extradition: Poland races against Russia

After delivering the package to Vilnius, his colleagues from the submarine lose sight of it. But contrary to their assurances, the packages are not picked up by the commander's relatives. It is taken out of the trunk of the Toyota by Vyacheslav Chebanenko, a 33-year-old Ukrainian, nicknamed “Donut,” according to The Guardian. “Donut” most likely does not know Vasilijs, businessman Andrei, or Commander Alexander.

“Donut” spent more than five years in prison in his homeland for raping his wife. In 2024, he moved to Warsaw with Russian native Alexander Bezrukawy. Today, both are suspected of preparing another sabotage operation on behalf of the GRU: sending test packages to the US and Canada (without explosives).

Bezrukavyi was arrested in Bosnia and Herzegovina, where, together with instructors associated with the Wagner Group, he trained Moldovans in breaking up street demonstrations. According to Gazeta Wyborcza, the Russian authorities requested his extradition from Bosnia and Herzegovina, allegedly wanting to try him for crimes committed in his homeland. In February 2025, however, Sarajevo extradited him to Poland (our extradition request had been submitted earlier).

Bezrukavyi is currently being held in the notorious detention center in Radom, where, in addition to the most dangerous criminals, Russian spies are also being held.

We know that “Donut's” colleague in Poland was Sergei Yevseyev, accused by the Opole prosecutor's office of participating in the theft of 14 cars across Europe. Yevseyev helped obtain cars for the parcel operation - he was also charged in Poland for this act.

Russians: they hire a criminal

“Donut” was not a lone gunman, he did not act on his own initiative. He was carrying out tasks assigned to him via the Telegram app by an account called “Jarik Deppa”. Together with journalists from The Insider, we have established his identity.

“Jarik” is Yaroslav Mikhailov, a 37-year-old Russian from the Rostov region, which borders Ukraine. Since at least 2015, he has been wanted by the Russian FSB for smuggling weapons, explosives, or radioactive materials.

But the Russians stopped looking for him in 2022. That is when he was probably recruited. Hiring criminals in exchange for solving legal problems is a practice known not only among Russian intelligence services.

Although Mikhailov was sentenced two years later for trading in dangerous goods, it appears that he avoided prison. We know that in recent years he has used fake Ukrainian passports under the names Daniil Gromov and Daniil Likchin. And that in March this year he reappeared in the Russian wanted register. Why? It is possible that this was so that Russia could demand his extradition if he were detained in the West (as was the case with Bezrukavyi).

Mikhailov is being pursued by the Lithuanian police and, according to our information, is hiding in Azerbaijan.

According to our sources in European services, Mikhailov, from his Telegram account, was involved in at least three other secret Russian operations, in addition to the “package from the commander” that we already know about. The first was the arson of the Marywilska shopping center in Warsaw in May 2024 (financial losses were estimated at several hundred million). The fire destroyed over 1,300 stores, and thousands of merchants and their employees lost their jobs.

The second operation, in which Mikhailov was involved in coordination, was the arson attack on an Ikea store in Vilnius in May 2024. This year, the Polish and Lithuanian authorities officially announced that the fires on Marywilska Street and in Vilnius were the result of actions by Russian services. And that in both cases, the fires were set by the same people.

The triggerman, the perpetrator of both arson attacks, was 17-year-old Ukrainian Daniil Bardadim. Lithuanian police arrested him on his way to Latvia, where he wanted to carry out another act of sabotage. He had the same explosives with him as those hidden in the “package from the commander.” He got them from a Lithuanian named Šuranovas, who was involved in transporting them (this name will appear again in this story).

Mikhailov's third act of sabotage was a “test” shipment of packages from Warsaw to the US and Canada. In this operation, he issued orders via Telegram to Bezrukavyi, a colleague of “Donut” who had been extradited to Poland by Bosnia and Herzegovina.

Both parcel shipment operations (those to North America and those that ended in explosions in Europe) are covered by the same investigation by the National Prosecutor's Office.

According to FRONTSTORY.PL, the Łódź District Prosecutor's Office reports that another thread in this case is the arson of the Leroy Merlin store in Łódź in July 2024. We are the first to report that the fire was the result of sabotage. Local media reported a year ago that the fire was probably caused by the improper storage of plant protection products. The fire was extinguished, but the losses were estimated at PLN 200,000. One of the saboteurs transporting the “package from the commander” also took part in this action.

The same characters appear in sabotage operations in Poland and the Baltic states. They are probably members of the same network. Who is in charge of it? “Jarik” Mikhailov, the mysterious coordinator from Telegram? Not necessarily. According to our information, the man is only a kind of middle manager on contract with the GRU.

Decisions on attacks are made higher up.

Aquarium: managing saboteurs

Mikhailov receives orders for “Donut” and other saboteurs from Telegram accounts under the pseudonym “Warrior.” We have determined that “Warrior” also directly coordinated the activities of two other saboteurs involved in the parcel operation.

According to our sources in the European services, Warrior's Telegram account is operated by someone from GRU headquarters. Specifically, from its new unit, created a year after the invasion of Ukraine – the Special Tasks Department (SSD), based in a glass building on the outskirts of Moscow, known as the “aquarium.”

The SSD is a special branch of the spy headquarters. According to the Wall Street Journal, the unit has taken over some of the FSB's tasks and has also absorbed the famous Unit 29155, responsible for the assassination attempt on Sergei Skripal. The SSD organizes diversionary actions in the West.

The most famous SSD officers are Colonel Denis Smolyaninov and his colleague Vladimir Lipchenko. According to the findings of the Dossier Center and Süddeutsche Zeitung, both were involved in the operation of sending explosive packages.

“Donut”: activates bombs

Let's go back to “Donut.” The day after picking up the package from the trunk of a Toyota in Vilnius, on June 28, 2024, he took it to an apartment rented through Airbnb. Who rented it? We don't know; the renter provided false information and a false Polish name.

In the apartment, “Donut” divides the contents of the package into four separate parcels. In addition to sports equipment and sex toys, he puts four makeshift bombs in them. The massage pillows conceal detonators and explosives, and nitromethane is stuffed into cosmetic tubes.

All that is needed to fully arm the bombs is to activate the timing mechanisms that will detonate them at a specific time.

On the orders of “Jarika” Mikhailov, “Donut” activates the bombs and leaves the apartment.

The Lithuanian: gets lost and interrupts the operation

In the final stretch, Aleksandr Šuranovas, a powerful Lithuanian man in his fifties, enters the action. He is a specialist in dirty work. A decade ago, he was involved in Recyclix, one of the largest Polish pyramid schemes (operating between 2015 and 2017). In July 2025, FRONTSTORY.PL, together with Lithuanian public television LRT, revealed that Recyclix was run by Russians who, a few years later, created the Juicy Fields mega pyramid scheme and stole almost €700 million.

Aleksandr was only a front man in the Polish pyramid scheme.

The task he received from the Telegram coordinator was simple. He was to pick up packages from the apartment where “Donut” left them. Two of them were to be sent to Poland and two to the United Kingdom.

But Šuranovas messed up. He got lost and could not find the right address.

The Lithuanian's failure interrupted the GRU's operation.

“Jarik” Mikhailov ordered the evacuation. On the same day, he ordered “Donut” to return to the apartment and deactivate the bombs.
But four days later, “Donut” took the packages to Kaunas. On July 9, Wladyslaw Barkov, a 37-year-old from Ukraine, controlled by “Jarik,” went to pick them up.

Then he left for Poland (with the packages in the trunk). Here, their trail disappears for a few days.

We do not know how they get to Moldova, but on July 12, the packages were already in the luggage compartment of a tourist coach traveling from Moldova to Latvia. In Riga, they were again picked up by Andrei's envoy, an officer from a Soviet submarine.

The packages with bombs crossed several borders, traveling right next to unsuspecting tourists.

Package: traveling around Europe

This time, Andrei could not reach Vasilijs, who picked up the package the first time. In a hurry, he enlisted the help of another friend from the navy – Aleksandr Kacers, a former submarine helmsman who lived in Riga. To convince him, he played on his sentiments: he sent him a photo of them together from the old days.

Aleksandr agreed to help. He sent his stepson to the bus station. Later, he handed the package over to Vasilijs Kovacs' nephew (the one with the gun under the sink). The parcel traveled around Europe, crossing the borders of the Baltic states and Poland at least five times. And Andrei once again asked Vasilijs to deliver it to the “commander's relatives.”

Why is the package on the road again? In a conversation with Re:Baltica, Vasilijs' relative mentions that this time he was more suspicious and initially refused the request.

In the end, however, he gave in — after all, it was his child's godfather who was asking for help.

“Warrior”: recruiting again on Telegram

The rest of the package's route repeated the first lap almost exactly. On July 17, Vasilijs and his nephews once again drove it to Vilnius in a Toyota.

In Vilnius, they handed it over to Vladislav Barkov, a well-known associate of “Yarik” Mikhailov from Telegram.

Barkov then transported it to Kaunas in the trunk of a Lexus. He left the car at a cooperative garage from the Soviet era.

There, it was picked up by Vladyslav Derkavets, a small, 27-year-old Ukrainian. He came to Kaunas all the way from Katowice, where a year earlier a court had sentenced him to two years and 10 months for money laundering. He found that job, together with a school friend, on Telegram, too. At the behest of a stranger, they withdrew cash from ATMs and exchanged it for cryptocurrencies. In the courtroom, they learned that the money they were handling came from SMS fraud.

Before the verdict in Poland became final, Vladyslav found another job on Telegram. The client was “Warrior,” an operator from a GRU special unit in Moscow.

It was “Warrior” who ordered the delivery to be taken to Vilnius. Derkavets activated the bombs at a square in the center of the capital and transported them to the Stay Express hotel. There, he repacked them into four separate packages.

Bomb: burning at the airport

This time, Šuranovas, a powerful Lithuanian, finally found the right address. Using a false name, he sent two packages to the UK via DHL. Two more were sent via DPD to Poland.

On July 20, at 5:45 a.m., the first package caught fire at the airport in Leipzig, Germany. The German head of the Office for the Protection of the Constitution, Thomas Haldenwang, will later tell the Bundestag that if the package had caught fire during the flight, “it would have ended in disaster.”

The next day, July 21, at 9 a.m., a second package caught fire near Warsaw. A fire broke out in a DPD courier company warehouse, in a truck trailer. Four fire crews were needed to extinguish the flames. The trailer burned completely.

Three days later, on July 22, a third package ignited in a DHL warehouse in Birmingham.

The fourth package was intercepted by the Polish Internal Security Agency (ABW). The services discovered a timer igniter and a flammable substance hidden in a massage cushion.

GRU: recruiting thousands of saboteurs

Russian operations involving the shipment of explosive packages from the commander and “test” packages sent to North America are currently being investigated by an international team within Eurojust.

As a result of the investigation, a group of saboteurs involved in sending the parcels are now in prisons in Radom (Bezrukavyi and Derkavets), Włocławek (Yevseyew), Barczewo (“Donut”) and Wołów in Lower Silesia (Barkov). Two others are in Lithuania (Kovacs and Šuranovas; Kacers and Kovacs' nephews have already been released from custody). The day before our publication, the Estonian Police and Border Guard Board (Kapo) informed our partners at Delfi that it had also detained two people in connection with the case (we do not know their identities or roles). “Jarik” aka Mikhailov escaped when Polish authorities detained ‘Donut’ and Bezrukavyi. The Polish prosecutor's office accuses them of participating in sabotage and organized crime.

According to our investigation, “Jarik” was one of at least several mid-level operators in the attacks on Europe. People at his level in the GRU coordinated networks of “one-time saboteurs” recruited on Telegram or through relatives and friends. They were often unaware that they were participating in an operation by the Russian services.

Saboteurs from Telegram received several hundred to several thousand dollars per job. The damage they caused by setting fire to hypermarkets, logistics centers, and shopping malls amounts to hundreds of millions of zlotys.

According to our sources in the European services, the sabotage attacks carried out by the Kremlin in Europe are linked at the level of operators such as Jarik. The clues in most of these stories lead to a GRU special unit near Moscow.

At the end of July, Polish Prime Minister Donald Tusk summarized the actions of Polish law enforcement agencies in these cases: "We have 32 people detained and suspected of cooperating with Russian services, which ordered these people to carry out either acts of sabotage or assaults. This list is not exhaustive. It is also time to issue a real alert to all services.”

According to cautious estimates by the services, Russia may have already recruited tens of thousands of people for sabotage in Europe.