Revealed: How Russia’s GRU Plotted Europe’s Parcel Explosions

Michael Weiss, Kato Kopaleishvili
Collaboration: Daniel Flis, Anna Gielewska, Anastasiia Morozova, Alicja Pawłowska (FRONTSTORY, Poland)
Inga Spriņģe (Re:Baltica, Latvia)
Indre Makaraitytė (LRT, Lithuania)
Holger Roonemaa (Delfi, Estonia)
Christo Grozev (The Insider)
Illustration: Delfi Estonia 2025-09-17

Our Investigations

The following investigation, conducted over the course of six months with a consortium of five international partners, was scheduled to run tomorrow morning. After receiving a list of detailed questions based on months of research and reporting, the Lithuanian Prosecutor’s Office and the Criminal Police Bureau decided to reveal  part of our findings preemptively and publicly, naming three of the suspects involved in sabotage operations targeting Europe and North America. These operations were stagemanaged by the GRU, Russia’s military intelligence service, via the social media platform Telegram. Given Vilnius’ unexpected disclosure, VSquare and its partners have decided to publish this story, recounting the actors involved and the route their dangerous consignment took throughout Europe, a day early. Tomorrow VSquare will publish a sequel, a visual investigation of this complex story.

On March 1, 2025, more than ten masked men from the Latvian State Security Service stormed a rural house in Vidzeme, Latvia. Their quarry was a 62-year-old Ukrainian residing in Latvia named Vasily Kovacs, whom they took into custody. As Kovacs’ house was being raided, two of his Ukrainian nephews, Roman and Vadim Borsuk, both in their twenties, were arrested in Vilnius while riding on an intercity bus to Poland to work there. The boys had arrived with their mother in Latvia because of the Russian invasion of Ukraine two years earlier.

Later, Aleksandr Katser, a 73-year-old who had once worked as helmsman on a Soviet submarine, was also rounded up by authorities in Riga.

Lithuanians investigators believed that this disparate group – two pensioners and two college-aged refugees – were involved in transporting bombs concealed in commercial products, from cosmetics to sex toys to Chinese-made neck massage pillows, from Riga to Vilnius in June and July of last year. These parcels would wind up in various locations throughout Europe linked to the German-based international courier company DHL. 

On July 20, 2024 at 5:45 a.m., a container with the parcels burst into flames at Leipzig airport, the key hub for DHL’s network, where 7,000 employees handle 2,500 tons of packages. The container was being scanned before being loaded into the hold of a plane; when opened and photographed, it showed a seemingly harmless cargo of two erotic toys, tubes of cosmetics and black massage pillows.

Less than 24 hours later, at 9:00 a.m. on July 21, a second package caught fire inside a truck trailer at a depot in Jabłonowo, a village near Warsaw, run by DPD, a subsidiary of Geopost, one of the largest parcel shipment companies in the world. It took four crews of 20 firefighters two hours to extinguish the burning pallets containing courier shipments. No one was injured. 

The following day, July 22, a third package detonated at the DHL transport warehouse in Birmingham, England after it had departed that city’s airport. 

A fourth parcel was intercepted by the Polish Security Services in Warsaw before it could ignite. When examined, that parcel, one of the neck massage pillows, had been outfitted with a timer, an ignition device, and nitromethane, an oily and highly flammable substance.

Thomas Haldenwang, head of the German Constitutional Protection Bureau, the country’s domestic intelligence service, later told the Polish newspaper Wyborcza that “it was just a happy coincidence that the package caught fire on the ground, not in flight.” 

The culprit behind the attacks was the GRU, Russia’s military spy service. Well-known for the Skripal poisonings, hacking and election interference, and a series of deadly bombings of weapon and ammunition facilities across different NATO countries, the GRU has lately been escalating its campaign of sabotage operations against the West. “Russian sabotage operations in Europe have increased their range of targets and severity of attacks,” a recent report by the International Institute for Strategic Studies (IISS), a Washington, D.C.-based think tank, concluded. “The number of attacks almost quadrupled from 2023 to 2024.” The aim, according to Western security and law enforcement sources, is to disrupt U.S. and European security assistance to Kyiv and also terrorize democratic electorates with plausibly deniable attacks in order to weaken popular support for Ukraine. Most of the European targets, IISS found, are critical infrastructure “linked to the war in Ukraine and government facilities.”

In collaboration with Latvia’s re:Baltica, Lithuania’s LRT, Estonia’s Delfi, Poland’s Frontstory and The Insider, VSquare has spent the last six months reconstructing the plot of exploding international shipments and those behind it. Based on documents obtained from Western intelligence services and interviews conducted with the relatives of the perpetrators and one of the perpetrators himself, VSquare and its partners have identified the ringleader of this network, a Russian smuggler of radioactive materials and the exact route the explosive parcels took across Europe – all three Baltic states, Poland, Germany and the United Kingdom – for almost a month, bypassing NATO borders multiple times. Also revealed in this investigation is how the GRU remotely recruited and controlled both Russian and Ukrainian nationals residing in the West to carry out acts of state terrorism in pursuit of Russia’s ongoing war of conquest in Europe.

***

Russian intelligence often relies on established networks of agents, some of them long dormant. This story of modern sabotage begins in the Soviet Union in the late 1980s and early 1990s, when four naval officers, Aleksandr Miroshnikov, Andrei Baburov, Nikolai Zagorodny, and Aleksandr Katser, served together in the Soviet Northern Fleet.

Andrej Baburov, Source: Prokuraturos.lt

Aleksandr Miroshnikov, a cheerful blond man with a broad mustache, a commander, the highest ranking among them. Just after the collapse of the USSR, he was responsible for the K-387 submarine, a nuclear-powered vessel, for three years. Its service once consisted of secret missions. During the Cold War, Soviet nuclear ships escort their surface fleet and track NATO units, and conduct intelligence missions. Subs such as the K-387 would routinely approach the coastlines of the United States and surface near the North Pole.

Three decades later, Commander Miroshnikov reunited with his former comrades. 

In the early days of the summer of 2024, Nikolai Zagorodny called Andrei Baburov. Both lived in St. Petersburg. Baburov, bald with a mustache and in his early sixties, had been working running his own logistics company called Baltic Escort. For several months, his company included a service to circumvent Western sanctions against Russia, imposed by the United States and EU because of the war. “Individual approach,” read a statement on the website of Baltic Escort. “Settlements in rubles. Price: from 2% of the invoice value.”

Zagorodny told Baburov that Miroshnikov, who also lived in Russia, needed his help: the ex-commander, now seriously ill with cancer, was seeking someone in Latvia to pick up a package intended for his relatives. Miroshnikov’s relatives, Zagorodny explained, were unable to make it to Riga as it was too far and preferred to collect the item in Vilnius. The contents, weighing several kilograms, were said to be either medicine or neck massage pillows, according to Baburov, who spoke at length to re:Baltica and emphasized that there was nothing illegal about transporting massage equipment. 

Baburov felt he couldn’t refuse a request from Miroshnikov. “When the commander asks…” he said. Baburov contacted his old friend in Latvia, Vasily Kovacs, a sometime electronics trader, horse breeder and merchant marine. Baburov is also godfather to Kovacs’ son. At first, Kovacs, the only outsider among the former navymen, hesitated but eventually agreed to help. “Sending parcels between Russia and Europe was a common practice among friends,” said Zagorodny’s wife, speaking for her husband who has since suffered a stroke that has rendered him incommunicative.  

According to Baburov, who spoke to re:Baltica from St. Petersburg where he is evading a Lithuanian arrest warrant in connection with the sabotage operation, Miroshkinov was meant to send the parcel to Riga by bus. Except that never happened. Sources from European law enforcement said that the package actually arrived in Latvia as a shipment of Omniva, an Estonian logistics company. Initially, the actual sender, whose identity is unknown, dispatched the parcel on June 24, 2024, from Narva, a small Estonian town bordering Ivangorod, Russia and inhabited mostly by ethnic Russians. 

Kovacs did as he was told and picked up the package together with his two nephews, Roman and Vadim Borsuk, in a Toyota Land Cruiser and drove it to Vilnius. Baburov maintains that Kovacs was angry because no one showed up in Lithuania to collect the cargo. He waited a while and went out to charge his phone, leaving the Land Cruiser unlocked so that Miroshnikov’s relatives, assuming they were indeed the recipients, could remove the neck massage pillows from the trunk at their leisure. When he returned, the package was gone. 

No relatives ever came, however.

The person who picked up the package on June 27, 2024 was a 33 year-old Ukrainian named Vyacheslav Chebanenko, nicknamed “Ponchik,” according to The Guardian, or doughnut in Russian, owing to his obesity. A violent ex-convict, Chebanenko had spent more than five years in prison in Ukraine for raping his wife. By 2024, he’d relocated to Warsaw and lived with a Russian associate, Aleksandr Bezrukavy. 

The day after Chebanenko emptied the Land Cruiser, he took the wares to an Airbnb apartment in Vilnius, rented using false data and a false name, “Paweł Morawiecki.”

In the apartment, Chebanenko divided the contents of the package into four separate parcels. Neck massage pillows were only some of the contents; other stuff included sports equipment and sex toys and cosmetics. According to the findings of European intelligence, once Chebanenko took custody of the original shipment, a makeshift bomb was planted in each of the four sub-parcels. The massage pillows hid the fuses of the detonation device, while cosmetic tubes easily concealed the incendiary nitromethane. 

What was to be done with the now weaponized parcels? Chebanenko asked his virtual handler and the coordinator of this operation, “Jarik Deppa.”At least that was the name he used on the social media platform Telegram. Jarik Deppa instructed Chebanenko to activate the timing mechanisms on each of the devices and leave the apartment. Another recruit in this ever-widening sabotage network would evidently take it from here.

This was Aleksandr Šuranovas, a Lithuanian man in his fifties, with ample experience in mokroe delo, the Russian euphemism for “wet work” or violent operations. Previously, Šuranovas was involved in Recyclix, a company that specialized in recycling plastic waste but was the subject of one of the largest financial pyramid schemes in Poland. In July 2024, Frontstory, together with the Lithuanian public television LRT, revealed that Recyclix, of which Šuranovas was company president, was in fact run by Russians, who a few years later created an even larger pyramid in Berlin and stole a total of nearly 700 million euros. Šuranovas was the apex of the pyramid, but not its base. The investigation into Recyclix is ongoing in Poland, and the alleged orchestrator of the pyramid scheme, Sergei Berezin, was arrested in the Dominican Republic and now sits in pretrial detention in Spain. Šuranovas was sentenced in Denmark for another case of fraud and forgery.

Aleksandras Šuranovas at the shooting range in Vilnius, Source: A. Šuranovas’ Facebook photo.

His task, as explained by Jarik Deppa on Telegram, was simple. 

On June 28, Šuranovas was supposed to pick up the packages from the Airbnb on where Chebanenko had left them, then send two to Poland and two to Great Britain. The scheme went sideways, however, when Šuranovas got lost and couldn’t find the address of the Vilnius apartment. Lousy navigation led to a last-minute backup plan.

Jarik Deppa ordered Chebanenko to return to the Airbnb and deactivate the bombs and consolidate everything into one big package again. Then he waited. Four days later, on July 2, Chebanenko was on the road to Kaunas, Lithuania’s second city, with the wares. Once he arrived, he linked up with Vladisov Barkov, a 37 year-old Ukrainian, acting on orders from Jarik Deppa, took custody of the cargo on July 9. Rather than ship everything directly from Lithuania, the goods would now take a more sinuous albeit unknown route to Moldova.

On July 12, the package somehow made it into the hold of a tourist bus headed from Chisinau, the Moldovan capital, to Riga. From there, it was meant to be picked up by Kovacs, but Baburov was unable to reach him; Kovacs had apparently been injured in a motorcycle accident. Desperate to fulfill his former commander’s request, Baburov contacted Aleksandr Katser, an old acquaintance from the submarine fleet, who now lived in Riga. To win him over, Baburov sent nostalgic photos from their time together in the Soviet Navy. One picture shows the two men at a table surrounded by vodka and food and a nameless woman snuggling one of them. This trip down memory lane did its job. 

Katser’s stepson collected the consignment from the Riga bus station after midnight on July 13 and later handed them over to Kovacs’ nephew. Improvised explosive devices and the innocuous consumer product casings for them had by now circled Europe, passing the borders of all three Baltic countries and Poland at least five times. And Kovacs was suspicious. Why all the couriers to ferry something that could easily be mailed by post?  His doubts were allayed by an overriding obligation to the rites of baptism: he couldn’t deny the request of his son’s godfather.

So together with his nephews, Kovacs brought everything to Vilnius on July 17, 2024. Two new courier-agents then arose to complete the roundabout journey. The first was Vladislav Barkov, a 37-year-old Ukrainian and one of Jarik Deppa’s remote recruits. Barkov drove the packages back to Kaunas in the trunk of a Lexus, then abandoned the car in a communist-era garage with white bricks and a metal roof. 

Vladyslav Derkavets, a short, 27-year-old Ukrainian, picked up the car after traveling more than seven hours from Katowice, Poland, where a year earlier a local court had sentenced him to two years and 10 months in prison for money laundering. Derkavets had withdrawn cash from ATMs and redeposited it into Bitcoin terminals, obscuring the source of an illicit income stream by a third party who had defrauded people via text message scams. Derkavets had been solicited for the money-laundering caper by another unseen Telegram user, this one using the online name “VWarrior.”

On July 19, Derkavets took the shipment to Vilnius’ Stay Express hotel, where he reactivated the explosive devices and redistributed the wares into four different parcels. That same day, he handed over the four parcels to Aleksandras Šuranovas, the transporter who’d failed to find the Airbnb safehouse in Vilnius three weeks earlier. 

Šuranovas now drove the ready-made bombs to the local DHL office in his Mercedes SUV. Under a false name, he cleared two shipments for England. He sent the other two to Poland via DPD.

The nearly month-long peregrination of lethal material across the continent, involving a dozen operatives, some of them unwitting, was at an end. Mission accomplished. 

The next day, July 20, the first explosion occurred at the DHL warehouse in Leipzig. 

***

Jarik Deppa’s real name, VSquare and its partners have learned, is Yaroslav Mikhailov. He is a 37-year-old Russian from the eastern Ukrainian city of Donetsk. Wanted by Russia’s domestic security service, the FSB, for smuggling weapons, explosives and radioactive materials, he was arrested in 2022. Despite being sentenced for trafficking in prohibited goods, he didn’t serve any time in prison and was likely recruited by the Russian intelligence services, which often rely on career criminals to carry out risky illegal tasks abroad. In recent years, Mikhailov has used two false Ukrainian passports issued under the names “Danil Gromov” and “Danil Likhin.”  

Daniil Gromov/ Jaroslav Mikhailov, Source: Prokuraturos.lt

According to sources in several European intelligence services, Mikhailov participated in several operations using his Telegram cutout, all of them directed by the GRU.

The first was the arson attack on the Marywilska shopping center in Warsaw in May 2024, a fire that destroyed over 1,300 retail stores, affecting thousands of merchants and workers. The second was another arson attack on an Ikea store in Vilnius in May 2024. 

The perpetrator of both firebombings was 17-year-old Ukrainian national, Daniil Bardadim. Lithuanian police detained Bardadim on his way to Latvia, where, according to the authorities, he was planning to carry out a third attack. According to VSquare’s sources from European law enforcement agencies, Bardadim was carrying the same type of explosives, constructed with nitromethane, as those hidden in the commander’s “neck massage pillows.” He’d received them from Aleksandr Šuranovas, one of the alleged perpetrators in the DHL-DPD operation. 

Mikhailov, according to European intelligence, also ran trial runs for his bomb plots, specifically testing how European logistics companies inspected and loaded cargo bound for the United States and Canada. Mikhailov had various packages dispatched without, using his Jarik Deppa account to enlist Bezrukavny for these dress rehearsals. 

Both the inert and armed parcel plots are now being investigated by the Polish National Prosecutor’s Office. 

The Łódź District Prosecutor’s Office has indicated a connection between the DHL/DPD cases and a suspected arson attack on the French-owned Leroy Merlin home improvement and gardening store in Łódź around the same time, July 2024. Local media reported at the time that a fire was likely caused by improper storage of plant protection products and insecticides. The blaze was extinguished, but the losses were estimated at $56,000. 

VSquare and its partners have confirmed with the Polish National Prosecutor’s Office that the Leroy Merlin fire was an act of sabotage. Other sources have implicated Vladyslav Derkavets in that attack.

Based on the recurring list of suspects in seemingly disparate acts of terrorism throughout Europe, the GRU appears to be relying on a single criminal network, retasking the same operatives over and over again – at least until they get caught. 

Mikhailov, in other words, didn’t command any of the operations he’s been fingered for, but instead acted as a remote go-between or middle manager. “VWarrior,” the Telegram persona behind Derkavets’ cryptocurrency caper, is almost certainly Mikhailov’s control officer. 

According to the Wall Street Journal, this account is managed by a special unit created by the GRU in 2023, known as the Department of Special Tasks (SSD), “set up in 2023 in response to Western support for Ukraine.” It includes veterans of Unit 29155, the GRU black-ops unit behind the Skripal poisonings and a series of bombings of Bulgarian and Czech ammunition depots over the last decade-and-a-half, as first reported by The Insider. The department borrows its name from a Cold War-era KGB outfit responsible for organizing the assassinations of Leon Trotsky and a series of Ukrainian nationalists. 

Two officers in the Department of Special Tasks are Denis Smolyaninov and Vladimir Lipchenko, both of whom have been implicated in the DHL/DPD sabotage affair, according to the findings of the Dossier Center and Süddeutsche Zeitung.

Source: Miko Rode via Re:Baltica

The parcel operations of the Department of Special Tasks are the purview of an international team of forensic and counterintelligence investigators under Eurojust, the European Union’s prosecutorial agency. The team consists of personnel from Poland, Lithuania, Latvia, Estonia, the United Kingdom, Germany, the Netherlands, the United States, and Canada. So far, the combined efforts of these nine countries over the course of the last year has disrupted the activities of at least one interlinked network of Russian-run saboteurs.

Vyacheslav Chebanenko was arrested by Polish authorities and is currently in pretrial detention in Barczewo, Poland. 

Aleksandr Šuranovas, the courier who got lost, is now in prison in Lithuania. 

Aleksandr Bezrukavy, Chebanenko’s roommate, was arrested in Bosnia and Herzegovina in November 2024, where along with members of the Wagner Group, the Russian mercenary corps responsible for atrocities in Ukraine and Syria, he was accused of training Moldovans to foment unrest during that country’s upcoming presidential election. Bezrukavy was extradited to Poland, owing to his suspected role in the sabotage plot. His extradition was also requested by the Russian authorities in Sarajevo, who allegedly wanted to try him for crimes committed in his homeland – possibly Moscow’s pretext for recovering a compromised asset. He is currently being held in the notorious Radom detention center, which, in addition to housing the most dangerous criminals, also incarcerates Russian spies.

The Polish Prosecutor’s Office has indicted one of Bezrukavy’s associates, Sergei Yevseev, a Ukrainian, for his role in stealing 14 automobiles across the European Union. The GRU handlers behind “VWarrior,” VSquare and its partners can reveal, also directly coordinated the activities of Yevseev and Derkavets. 

Yaroslav Mikhailov, the GRU agent behind the Jarik Deppa Telegram account, is being pursued by the Lithuanian police; according to VSquare’s information, he is hiding in Azerbaijan.

Yevseev was arrested by Polish police and is now in prison in Wloclawek, southern Poland. 

Aleksandr Miroshnikov, the ex-submarine commander who needed a small favor on behalf of his relatives, died of cancer early this year.

Andrei Baburov is being sought by the Lithuanian police in connection with his role in the sabotage operations. Speaking by telephone to re:Baltica, he admitted everything and said he was remorseful, which is why he agreed to talk. “I feel guilty for what happened,” he said. “I didn’t want to get anyone in trouble.” Baburov is still in St. Petersburg, where he can safely evade the Lithuanian dragnet.

Nikolai Zagorodny, his wife told re:Baltica, suffered a stroke which has left him unable to speak. He’s also in Russia.

Alexander Katser was arrested in Latvia, but eventually released. 

Kovacs and his sister’s sons were also arrested in Riga in March of 2025. The nephews were released while Kovacs was arrested at the request of Lithuanian prosecutors who have charged him with being part of a terrorist group. Kovacs denies the charges and claims that he is being framed. Speaking to re:Baltica, one of his close relatives said that Kovacs thought he was merely transporting neck massage pillows. He agreed to help Baburov, the relative maintains, because he considered him a “good man” who sheltered orphans and even adopted a young girl.

Yet a search of his home by Latvian authorities revealed a more questionable side to this benevolent sexagenarian. Kovacs kept a pistol with a scraped-off serial number and an object resembling a cell phone signal suppressor under his kitchen sink in his house in Vidzeme. In his mailbox were files from a criminal case involving the murder of an infamous Latvian gangster, Gennadi Valagin, in 2022. Valagin was one of the alleged clients of the murder of the bankruptcy trustee Mārtiņš Bunkus, whose slaying shocked the Baltic nation in 2018. 

Kovacs claims he has no idea where the pistol, modified as a professional assassin’s might be, came from. As to the court files, he suggested someone planted these in his mailbox to frame him. 

VSquare

Central Europe’s leading English language investigative platform.