Before dawn at Leipzig Airport in July 2024, a delayed cargo flight and a smoldering parcel may have spared Europe from a mid-air catastrophe. Within 48 hours, three separate fires broke out in cargo shipments at hubs in Germany, Poland, and the United Kingdom, setting off a cross-border investigation that would eventually point to Russian military intelligence and an alleged plan to test methods for bringing down cargo planes en route to North America.
Lucky breaks and early clues
The first fire started on July 20, when a container caught fire at Leipzig Airport at 5:45 a.m. The next day, a truck near Warsaw burned for two hours. On July 22, another package ignited in a Birmingham warehouse in England. In each case, the blaze was contained on the ground.
Germany’s domestic intelligence chief, Thomas Haldenwang, later told lawmakers that “it was just luck that the package caught fire on the ground.” A delayed flight out of Leipzig meant the device never made it into the air, avoiding a potential disaster over Europe.
The packages contained devices disguised as electric massagers, packed with magnesium powder that is exceptionally difficult to extinguish, especially at high altitude. Investigators concluded that if the timing had been different, a major aviation accident was possible.
Investigative trail to Vilnius
As security agencies compared notes, investigators in Germany, Poland, and the UK traced all three suspect parcels to Vilnius, Lithuania. The items had been shipped on July 19 through major delivery services, declared as ordinary consumer goods bound for the United Kingdom.
Lithuanian officials discovered that the devices contained electronic timers, ignition systems, and nitromethane, a highly flammable liquid used in explosives. Arvydas Pocius, who chairs Lithuania’s parliamentary security committee, described the activity as part of a “sustained campaign of hybrid attacks aimed at creating chaos, panic, and distrust” across Europe.
Polish prosecutors uncovered and intercepted a fourth device that failed to ignite, and searches across Lithuania recovered about 6 kilograms of explosives. By October 2024, security services in at least five countries were cooperating. Poland’s Internal Security Agency detained four suspects, while Lithuanian authorities arrested additional alleged operatives.
Polish prosecutor Katarzyna Calow-Jaszewska said the group’s objectives went beyond Europe: they “wanted to test sending such parcels, which were ultimately heading to the United States and Canada.” UK counter-terrorism police confirmed their Birmingham inquiry centered on air-shipped cargo, sharpening concerns over the safety of transatlantic flights.
GRU handlers and “disposable” operatives
By November 2024, European intelligence agencies publicly accused Russia’s GRU military intelligence service of directing the plot. Poland’s security agency said the incidents “were initiated and coordinated by Russian special services,” while Lithuanian prosecutors said the operation was “orchestrated by individuals associated with Russian military intelligence.”
An investigation by the outlet VSquare reported that the network was “managed by the GRU using Telegram,” where handlers using aliases such as “Jarik Deppa” and “VWarrior” coordinated operatives in multiple countries. By late 2025, at least 20 people in Lithuania and Poland were facing terrorism-related charges.
Lithuania’s indictment named 15 alleged participants from Russia, Lithuania, Latvia, Estonia, and Ukraine, reflecting what officials describe as a GRU strategy of using mixed-nationality “disposable agents” with no overt ties to Moscow. Among those identified were Daniil Gromov, also known as Yaroslav Mikhailov, Lithuanian citizen Aleksandras Šuranovas, and Latvian national Vasilijs Kovačs, arrested in Riga.
Western security officials told The Washington Post that Mikhailov represents a newer generation of Russian operatives brought in for their links to criminal groups, offering Russian intelligence additional deniability if operations are exposed.
Test runs for transatlantic attacks
According to Western officials cited by the Wall Street Journal and CNN, the July fires were considered “test runs” for a broader plan to target cargo aircraft headed to North America. The four packages shipped from Vilnius on July 19 via DHL and DPD networks were built into massage pillows with electronic timers and magnesium-based incendiary charges. Three ignited as intended; the fourth failed due to a technical fault.
The devices were calibrated to ignite during long-haul flights, when emergency response would be nearly impossible and damage could be severe. With DHL alone moving thousands of pounds of cargo daily through Leipzig and employing thousands of staff there, officials warned that a successful mid-air explosion could have killed crew members and disrupted global supply chains for months.
Security specialists quoted by the Financial Times said a successful series of such attacks might have caused “more disruption in the aviation sector than any terrorist act since the September 11 attacks.” The Express reported that European officials believed the sabotage network was prepared to inflict “mass casualties” aboard passenger aircraft as well.
In response, the US Transportation Security Administration introduced additional screening rules for certain cargo flown from Europe and former Soviet states, and Transport Canada adopted similar measures. DHL announced “strengthened security measures across all European countries,” while the International Air Transport Association’s 2024 security report described the July incidents as the most significant challenge to air cargo protection since the 2010 Yemen parcel bomb plot.
Wider shadow campaign and future risks
The parcel case is one part of a broader pattern of suspected Russian hybrid operations across Europe. Authorities link the same GRU network to a May 2024 fire that destroyed an IKEA store in Vilnius, and to other attacks and attempted sabotage in Poland, Germany, and the United Kingdom. European officials say more than 100 suspected sabotage incidents were recorded in 2024, ranging from rail disruptions in the Czech Republic to suspected interference with undersea cables in the Baltic Sea.
Ken McCallum, director general of the UK’s domestic security service MI5, warned in October 2024 that Britain had seen “arson, sabotage and more: dangerous actions conducted with increasing recklessness” following UK support for Ukraine. He said MI5 investigations into state-backed threats had risen sharply, and that the GRU runs “a sustained mission to generate mayhem on British and European streets,” increasingly relying on criminal proxies after hundreds of Russian diplomats were expelled from Europe.
The suspected architect of the parcel plot, Mikhailov, left the European Union using forged documents and is now in Azerbaijan. Poland has issued an Interpol Red Notice, backed by the UK, Ukraine, and Lithuania. Western officials told The Washington Post that Russian intelligence chiefs are pressing Baku to return him to Russia rather than extradite him to Poland, a sign of his perceived importance. Azerbaijan has so far refused European requests but is reported to be monitoring him closely and preventing him from leaving.
The operation has unfolded against warnings from NATO planners that Russia could rebuild its forces for a large-scale conventional confrontation with the alliance by the end of the decade. Some European security experts now interpret the parcel fires and related acts of sabotage as groundwork for potential future conflict rather than isolated episodes. With criminal intermediaries still active, accused operatives awaiting trial, and at least one alleged handler out of reach, officials say the network’s infrastructure is only partially dismantled.
For aviation regulators, intelligence services, and cargo operators, the stakes are long term: closing security gaps in global freight systems, deterring state-backed sabotage below the threshold of open war, and preventing the next “test” from becoming a successful attack over the Atlantic.
Sources
BBC News, Mystery parcel fires were ‘test runs’ to target cargo flights, November 5, 2024
VSquare Investigation, Revealed: How Russia’s GRU Plotted Europe’s Parcel Explosions, September 17, 2025
Taipei Times, West suspects Russia in airplane plots, November 7, 2024
CNN, Russia suspected of sending incendiary devices on US-bound planes in Europe, November 4, 2024
Washington Post, Russia, Europe fight for custody of operative linked to DHL parcel plot, November 18, 2025
Financial Times, Russia’s hybrid warfare puts Europe to the test, December 9, 2025