From Kyiv to Riga: Russian Sabotage Operations in the Baltics

“We should be careful even when going to pick mushrooms because we are so close to a military facility. At any moment, someone can ask us to show documents,” the homeowner, who asked that her name not be used, told Re:Baltica.

Thanks to this accidentally discovered note, Latvian authorities tracked down a network of sabotage orchestrated by Russian special services using local residents as operatives in several countries. Among these acts was the arson of a building in Kyiv, commissioned a month before the full-scale invasion of Ukraine.

“The goal already then was to instill fear among Ukrainian residents. Just as Russia is now trying to do in Europe with acts of sabotage,” Normunds Mežviets, head of the State Security Service (VDD), told Re:Baltica.

Information compiled by Re:Baltica shows that Russian acts of sabotage have significantly increased in recent years. At least eight serious incidents have been reported in the Baltics and Poland alone.

This year, the Estonian Security Service, KAPO, detained 13 individuals for desecrating several national memorial sites and vandalizing the cars of the interior minister and a journalist. In Latvia, in February, two men attempted to set fire to the Museum of the Occupation, while in Lithuania, an IKEA store caught fire in May. Last year in Poland, a group was convicted of spying for Russia and planning to blow up a railway used to deliver aid to Ukraine.

A common thread in these cases is that the saboteurs are often recruited through the Telegram app.

In this investigation Re:Baltica details how the recruitment process works and who the individuals who agree to work in Russia’s interests are.

***

The note found by the owner of the house in Rembate was like hitting the jackpot for the authorities. It had everything: detailed instructions and meticulously recorded expenses.

At the bottom of the page, it read: “Create a report on the criteria! 1. Transport 2. Perimeter 3. Rest points 4. Location for all photos!”

Next to it were notes on the costs for two nights at a guesthouse near the airfield and the rental of a Canon camera.

First, investigators visited the guesthouse near the airfield. The owners remembered that they had only one guest that night. A young, tall man named Sergejs. He had his hair tied in a ponytail and wore a t-shirt and ripped jeans. He spoke Latvian and paid in cash.

Sergejs had come to relax with his guitar and Canon camera. He said his boss had treated him to a holiday for a job well done. He mentioned working in the shopping center in the capital, Riga. Sergejs also inquired about where the soldiers from the airfield go to unwind. The owner recommended the café “Kante” in the nearby town.

Sergejs had arrived at the guesthouse in a CarGuru vehicle, so the next stop for the investigators was the car rental agency. Using the GPS data from the car, the security team traced his route, but they still didn’t know the suspect’s name, as the car was rented under a woman’s name.

The breakthrough came soon after. The crucial note listed the Canon camera rental company, a significant lead for the investigators. The rental company had a copy of the young man’s ID card.

His name was indeed Sergejs. Sergejs Hodonovičs, then 21 years old.

During a search of his apartment in a run-down district of Riga, investigators seized a phone containing photos of an abandoned military bunker in the woods and the soldiers’ favorite café, “Kante,” in Lielvārde.

A criminal case was launched against Hodonovičs for espionage on behalf of Russia. The investigators stated: “It can be asserted that S. Hodonovičs’s activities fall within the tasks assigned by the Russian Federation’s GRU.”

***

Dressed in a denim jacket with a fleece lining, shoulder-length hair, and three-day beard stubble, Hodonovičs sits slumped in the interrogation video. He recounts how he met a man nicknamed Green while searching for weed on Telegram chats. This man was looking for someone to go to Estonia and “draw something” with spray paint. Sergejs agreed.

In April 2022, two months after Russia invaded Ukraine, he left work early and boarded a bus headed to Estonia’s capital, Tallinn. Along the way, he received instructions that his partner for the job was also on the bus with cans of spray paint. This turned out to be a short young man, around 18 years old, who Hodonovič dubbed the Kid. “He was irritable and spoke Russian. The Kid had the location on his phone,” Hodonovič told interrogators.

After getting off the bus, they walked for about an hour until they reached a concrete wall. Their task was to paint graffiti according to an image the Kid received on his phone. He didn’t understand what the writing meant. After painting the orange-red letters, they took a photo of the graffiti and sent it to the client, then boarded the bus to return to Latvia. Hodonovičs was paid 400 euros for the job.

The next morning, police received a call from a passerby that the outer walls of a military complex that houses the NATO Cooperative Cyber Defence Center of Excellence (Cyber Defence Center) had been spray painted.. The message – “Killnet hacked you” – was repeated multiple times across 190 meters of the wall. Killnet is a Russian-language hacking group.

It wasn’t just the scribbling. At the same time several Estonian online state services and websites, including that of the Cyber Defence Center, suffered distributed denial-of-service (DDOS) attacks and some were temporarily taken offline. Although Estonia has been a frequent target of Russian cyber attacks, this was the first time that such attacks coincided with a physical message. This was a new chapter.

It prompted the cyber crime unit of the central criminal police to start mapping the attackers and the tactics they were using. “The attacks are like kids throwing pebbles at windows from a distance. It’s not like a shot put,” said Ago Ambur, the head of the unit. According to him, the attackers never penetrated any networks. At best they managed to take a website or service down for a period.

Meanwhile, another unit in the police investigated the spray job. City traffic cameras soon revealed that a taxi took two men to a bus stop near the admittance gate of the Cyber Defence Center. It was a little after half past one at night. It took the men more than an hour to spray their message. They left the site on foot shortly after 3AM. 

Photographing the military airfield in Lielvārde was a much more serious task. The Telegram chat automatically deleted messages, so Hodonovičs wrote the instructions on paper. Following the client’s directions, he bought two memory cards. On one, he took “random photos, just in case someone asked.” On the other, he captured specific targets from four locations. He sent the photos from his phone to the client. For this job, he was paid 400 euros.

In the criminal case files, Hodonovič’s testimonies are inconsistent, but it is evident that he received assignments from multiple people who knew each other. 

One of them is the aforementioned Green, whose real name is Gļeb. His daily business involves money laundering by recruiting so-called “mules” — individuals who withdraw money from ATMs or allow their personal information to be used to open accounts, in this case at Revolut online banking services. Hodonovičs also assisted Gļeb in this business. On one occasion, he took a taxi for a five-hour drive from Riga to a hotel in Tallinn, received a bag of money from a man, and brought it back to Latvia.

Gļeb also helped a contact he met on Telegram find people for various tasks, earning a commission for each successful match. For finding Hodonovičs to paint the graffiti in Estonia, Gļeb earned 100 euros. During interrogation, he testified that the tasks varied — from drawing graffiti on buildings to arson. 

The “ads” came with photos, such as one with instructions on how to set fire to a church in Ukraine. Gļeb claimed he didn’t know the client personally; he frequently changed his phone numbers and usernames. (A separate criminal case has been opened against Gļeb, and the investigation is ongoing.)

Gļeb was just a link in a longer chain, much like Hodonovič. A more important link was another intermediary involved in Hodonovič’s assignments, known by the username MOT. 

MOT received tasks from a client whom everyone referred to as Alexander.

The identity of MOT was uncovered by investigators two days after Hodonovič’s arrest.

***

Investigators uncovered MOT’s identity by analyzing the payment chain to Hodonovičs for photographing the military airfield. 

Over several transactions, 630 euros had been transferred to Hodonovičs by a man named Timurs. Timurs testified that he had lent his Revolut card to a former classmate from the Latvian Maritime School. Further investigation revealed that several other classmates had also lent their Revolut accounts to MOT. He used these accounts to convert cryptocurrency received from Alexander into euros and pay the operatives.

MOT was arrested in an apartment in Purvciems, a district in Riga known for its Soviet-era block apartment houses and a large Russian-speaking population. His real name is Martins Griķis, and he was 20 years old. 

In the interrogation video, Griķis, wearing a dark red sweater and sporting a close-cropped haircut, answered questions matter-of-factly, as if discussing an ordinary job. Before starting his collaboration, he had sent Alexander a copy of his passport and a brief description. “To work in this field, you had to send your passport photo,” he explained to the investigator.

Griķis met Alexander on Telegram, where Alexander requested permission to deposit cryptocurrency into Griķis’s account, convert it to euros, and then forward the money. Over two years, Griķis earned about 10,000 euros in commission for this work. (The total amounts transferred are not mentioned in the criminal case.)

Griķis’s role also included finding operatives for tasks ordered by Alexander and vetting them for reliability. For each completed task, Griķis received cryptocurrency worth 500 to 2,000 euros. He converted the funds, paid the operatives, and kept his commission.

He earned well.

For instance, Hodonovičs earned 400 euros for photographing the airfield, while Griķis received a 200 euro commission.

For the graffiti task in Tallinn, Griķis received 2,000 euros from Alexander. Hodonovičs testified that he was paid 400 euros for the job. Nevertheless, Griķis also covered travel expenses, the cost of the spray paint, and a fee for the Kid.

Hodonovičs was not the only one recruited by Griķis. The Kid who painted graffiti with Hodonovičs in Tallinn boasted that this was not his first task. In January 2022, a month before Russia’s invasion of Ukraine, he traveled to Kyiv to throw a homemade Molotov cocktail into the ventilation shaft of a military building.

The criminal case identified him as Ivans Tarabanovs. His digital handlers sent him a PDF with instructions on how to make a Molotov cocktail and the need to take two sets of clothes – one dark-colored for committing the arson, and one casual for slipping the scene undetected. The organizers bought him a plane ticket to Kyiv, and he took a taxi to a nearby gas station to buy the necessary fuel.  However, the operation failed. Ivans got scared, set fire to the building’s exterior wall, and took a bus to Poland.

The specific building involved was not identified in the investigation. “Our security services didn’t want to bother the Ukrainians too much. They had enough on their plate with everything burning there already. The war had begun,” prosecutor Salvis Skaistais told Re:Baltica. A separate criminal case has been opened for this arson, and the trial is ongoing.

Ivan Tarabanov, or Kid, tried to set a building on fire with a Molotov cocktail in Kyiv. Photo: LTV

Griķis testified that he coordinated several other individuals whose contacts were provided by Alexander. During the search of Griķis’s home, investigators found several recordings of “job interviews.” In one recording, a potential recruit mentioned being in Ukraine and expressed willingness to commit arson for money but not to kill.

In his interrogation, Griķis mentioned that a Ukrainian citizen had gone to Ukraine to paint the Russian army symbol “Z.” Another person agreed to throw a Molotov cocktail into a building but got scared and backed out.

In Latvia, they sought both citizens and non-citizens to carry out tasks. The main requirement was that they not hold Russian citizenship, which would raise suspicions when entering Ukraine. According to Griķis, Alexander was also looking for individuals to start fires in villa districts in France or to work in drug manufacturing labs in Russia. Griķis found one recruit for the latter job.

The “business” had its downsides. Often, Griķis would find a recruit, buy tickets, and provide an advance payment, only for the “employee” to disappear.

“At first, drawing graffiti or taking photos doesn’t seem that dangerous. But throwing a Molotov cocktail into a house, especially knowing there might be victims, is something even people with criminal backgrounds won’t easily undertake,” explained VDD chief Mežviets.

Re:Baltica analysis shows that many involved had previous criminal records. “The criminal underworld is fertile ground for finding such people. If they have the inner conviction to commit crimes, they make good candidates,” said Latvian State Police Chief Armands Ruks.

This was evident in the arson attempt at the Latvian Museum of the Occupation this February. A man broke the window of the museum principal’s office with a hammer and threw in a Molotov cocktail. The fire was quickly extinguished. Police soon found the culprit because he left his mask and gloves at the scene. His DNA was already in the police database due to previous drug offenses. It was soon revealed that one of the men was recruited through a Telegram channel managed by someone in one of Latvia’s largest prisons. Mobile phones are prohibited in prisons, but there are loopholes in supervision.

Latvian Interior Minister Rihards Kozlovskis described the attack on the Museum of the Occupation as part of Russia’s hybrid warfare and emphasized the symbolic significance of the chosen target.

“If the rescue service had not arrived in time, a serious fire could have broken out, possibly destroying the exhibit, which would have caused a significant public outcry and achieved the intended goal,” the minister told Re:Baltica.

***

Who is Alexander?

This is the one big question left unanswered in the saga of photographing the airfield. 

Griķis testified that he had never met Alexander in person but that they had spoken on the phone, with Alexander always calling while being drunk. At one point, Alexander mentioned his real name was Vadim and that he hailed from Dnipro, Ukraine. He was 25 years old and a chef by profession. Vadim’s first job had been in a call center. “The first job was legal; the second was already in a fraudulent call center,” Griķis said.

The case files do not contain documents proving Alexander’s affiliation with the GRU. This assumption is based on information provided by Latvian security services. Prosecutor Salvis Skaistais explained to Re:Baltica that both Griķis and Hodonovičs had confessed to espionage for Russian special services, indicating they knew who they were working for.

At one point during the interrogation, an investigator asked Hodonovičs about photographing the airfield: “But you realized this is a military site, not some school project, right?”

“Well, yes,” Hodonovičs replied, “but he said it wouldn’t be sent to anyone, that no useful information could be obtained from it anyway.”

This defense did not hold up in court. On appeal, the court sentenced Griķis to three years in prison and Hodonovičs to two years and eight months.

Tarabanovs, who set fire to the building in Kyiv, testified that he did not know about Alexander’s connection to Russian special services. He thought Alexander was a gangster who threatened trouble if tasks were not completed. The court verdict in this case is expected in the fall.

All three—Tarabanovs, Hodonovičs, and Griķis—declined interviews with Re:Baltica.

VDD chief Mežviets stated that creating long chains of intermediaries for task execution is a deliberate strategy to make it harder to trace the original client. A source familiar with the case suggested that Alexander might not be from the GRU himself but was recruited to find intermediaries in other countries.

Latvian State Police Chief Armands Ruks also explained that operatives are intentionally recruited from other countries to complicate crime detection.

“We don’t have border control. A person comes in as if on a business trip and leaves. It’s also harder to trace their past if they’re not from Latvia.” To improve crime detection, surveillance cameras have been increasingly installed on national highways in Latvia.

Authorities are also intensifying cooperation at the international level. In January of this year, a dual citizen of Estonia and Russia was detained at the Latvian-Belarusian border for defacing national memorial sites in Latvia and Lithuania with paint. The arsonists who targeted Lithuania’s IKEA were detained in Poland.

In May, Prime Minister Evika Siliņa expressed gratitude to the VDD for collaborating with Polish and Baltic services. This followed the arrest of nine Russian spies in Poland connected to sabotage plans in the Baltics and possibly Sweden.

“The detention of the Russian special services group is a very good result of our services’ cooperation. The services have been monitoring these activities for a long time and have prevented several operations by groups working for Russia, as well as multiple crimes in our territory,” Siliņa said.

To the story contributed Šarūnas Čerņauskas (Siena/LT), Anastasiia Morozova (Vsquare).