Three unexplained fires broke out at European shipping hubs within a two-day period in July 2024. On July 20, a container caught fire at Leipzig Airport in Germany at 5:45 a.m.
The next day, a truck near Warsaw burned for two hours. On July 22, another package ignited at a Birmingham warehouse in England.
Investigators from three countries launched investigations, but the cause remained a mystery for months.
Lucky Escape
Thomas Haldenwang, Germany’s intelligence chief, revealed how close Europe came to disaster. “It was just luck that the package caught fire on the ground,” he told parliament.
The delay of a Leipzig flight prevented the device from exploding in the air.
The packages held what looked like electric massagers filled with magnesium powder—extremely hard to put out, especially on planes. If timing had been different, a major plane crash could have happened.
Trail to Lithuania
Investigators traced all three packages to Vilnius, Lithuania. Officials discovered the devices shipped through delivery services on July 19, disguised as consumer items headed to the United Kingdom.
Arvydas Pocius, Lithuania’s parliament security chairman, called the incidents part of a “sustained campaign of hybrid attacks aimed at creating chaos, panic, and distrust” across Europe.
The packages contained timers, ignition systems, and nitromethane—a flammable liquid used in explosives. Polish prosecutors found and stopped a fourth device.
International Dragnet
By October 2024, investigators from five countries worked together to solve the case. Poland’s security agency arrested four suspects, while Lithuanian authorities detained more people involved in the plot.
Polish prosecutor Katarzyna Calow-Jaszewska revealed the group’s true goal extended beyond Europe: “The group wanted to test sending such parcels, which were ultimately heading to the United States and Canada.”
UK counter-terrorism police confirmed their Birmingham investigation involved air-shipped packages, raising fears about plane safety.
Russian Coordination
European intelligence agencies announced in November 2024 that Russia’s GRU military intelligence service had organised the operation. Poland’s security agency said “the incidents were initiated and coordinated by Russian special services.”
Lithuanian prosecutors confirmed the plot was “orchestrated by individuals associated with Russian military intelligence.”
The investigative group VSquare revealed that the sabotage network was “managed by the GRU using Telegram,” with handlers using fake names, such as “Jarik Deppa” and “VWarrior,” to recruit operatives across multiple countries. By September 2025, at least 20 people faced terrorism charges in Lithuania and Poland.
Disposable Agents
The accused represented a deliberate GRU strategy: mixed-nationality “disposable agents” with no direct Moscow connections. Lithuania’s indictment named 15 individuals from Russia, Lithuania, Latvia, Estonia, and Ukraine.
Among them were Daniil Gromov (also known as Yaroslav Mikhailov), Lithuanian citizen Aleksandras Šuranovas, and Latvian national Vasilijs Kovačs, arrested in Riga.
The Washington Post quoted Western security officials: “Mikhailov represents a new generation of Russian operatives recruited by the GRU for their connections and capabilities in criminal organisations.” This strategy gave Russia plausible deniability.
Operational Details
VSquare’s investigation revealed the detailed planning behind the month-long operation. In June 2024, GRU handlers used Telegram to order operatives to build incendiary devices using massage pillows, electronic timers, and magnesium powder.
On July 19, four packages were shipped from Vilnius via DHL and DPD networks. Three exploded as planned; the fourth failed due to a technical error. Investigators recovered 6 kilograms of explosives during raids across Lithuania.
The devices were designed to ignite during transatlantic flights, when rescue would be impossible and damage catastrophic.
Transatlantic Target
Western security officials told the Wall Street Journal and CNN that the European fires served as “test runs” for a larger goal: bombing cargo planes to North America.
Polish authorities stated the operation aimed “to test sending such parcels ultimately heading to the United States and Canada.”
US TSA officials confirmed they put in place “enhanced security protocols for certain cargo flown to the US” in response. Canada’s Transport Canada implemented similar measures.
Aviation Threat
Security experts called the plot’s potential impact unprecedented since 9/11. The Financial Times reported that successful mid-air explosions could have caused “more disruption in the aviation sector than any terrorist act since the September 11 attacks.”
The Express quoted European officials stating the sabotage network planned “mass casualties” targeting planes carrying hundreds of passengers.” Unlike the 2010 Yemen cargo bomb plot involving printer cartridges, this operation tested shipping networks systematically across multiple countries.
DHL moves 5,512 pounds of cargo through Leipzig daily, employing 7,000 employees—one successful attack could have killed the crew and disrupted global supply chains for months.
Escape to Azerbaijan
The plot’s alleged leader, 37-year-old Yaroslav Mikhailov, fled Europe using fake passports and found safety in Azerbaijan, exposing problems with international extradition rules. Poland issued an Interpol Red Notice for his arrest, backed by the UK, Ukraine, and Lithuania.
But the heads of Russia’s three intelligence agencies—the FSB, SVR, and GRU—are pushing Baku to send Mikhailov back to Russia instead of allowing extradition to face terrorism charges in Poland.
The Washington Post reported Western officials say this pressure shows Mikhailov’s importance. Azerbaijan rejected the extradition requests but continues to closely monitor him and prevent him from leaving the country.
MI5 Warning
Ken McCallum, director general of the UK’s MI5 security service, issued a stark public warning in October 2024 about Russia’s escalating shadow war.
“We’ve seen arson, sabotage and more: dangerous actions conducted with increasing recklessness” in Britain following UK support for Ukraine, McCallum stated. MI5’s investigations into state-sponsored threats jumped 48% in one year. Over 750 Russian diplomats—”the vast majority of them spies”—have been expelled from Europe since February 2022, forcing Russian intelligence to hire criminal proxies.
“The GRU in particular runs a sustained mission to generate mayhem on British and European streets,” McCallum warned, describing a shift from professional spying to reckless sabotage.
Broader Campaign
The DHL plot represents one part of a larger pattern of Russian hybrid warfare across Europe. In March 2024, arsonists attacked a Ukrainian-owned warehouse in London; seven people now face espionage charges.
In May 2024, a fire destroyed an IKEA store in Vilnius, linked to the same GRU network. Poland arrested nine suspects in May for sabotage acts “ordered by Russian services,” Prime Minister Donald Tusk confirmed. Germany’s Centre for Strategic and International Studies documented the parcel bombs as part of Russia’s “shadow war against the West” targeting critical infrastructure.
European officials confirm over 100 suspected Russian sabotage incidents in 2024 alone, from rail disruptions in the Czech Republic to undersea cable cuts in the Baltic Sea.
Enhanced Security
Aviation authorities worldwide implemented emergency security measures after the plot became public. DHL put in place “strengthened security measures across all European countries” to protect its network and packages.
In August 2024, the US TSA introduced the “Enhanced ACAS Security Filing,” which requires detailed shipper data for all cargo from Europe and former Soviet states before loading onto US-bound aircraft. Transport Canada adopted similar protocols.
The IATA Annual Security Report 2024 called the July incidents “the most significant event impacting air cargo security since the 2010 Yemen incident.” Germany’s intelligence service has warned logistics companies about “unconventional incendiary devices” sent by unknown individuals, urging them to conduct tighter screening of parcels from Eastern Europe.
NATO’s 2029 Warning
The sabotage campaign happens against an ominous strategic backdrop. A classified 2023 NATO Joint Threat Assessment report, later made public by German Defence Minister Boris Pistorius, warned that Russia could be positioned to launch a large-scale conventional war against NATO territory by 2029.
The assessment, based on satellite images tracking Russian production and recruitment, concluded Moscow could field 1.5 million fully equipped troops within five years. Bundeswehr Inspector General Carsten Breuer confirmed “the year wasn’t simply made up, but is based on rigorous analysis.”
NATO Secretary General Mark Rutte warned in December 2025 that “Russia could attack a NATO country within the next five years,” citing Russia’s war economy producing 150 tanks, 550 fighting vehicles, and 120 drones monthly.
Groundwork for War?
European security experts increasingly view the DHL plot not as isolated terrorism but as preparation for future conflict. The Financial Times reported intelligence sources characterise Russia’s sabotage as potentially “leading to more disruption in the aviation sector than any terrorist act since the September 11 attacks” if carried out at scale.
United24 Media noted the campaign may signal “preparations for future conflict” rather than standalone incidents. With 20 accused awaiting trial, Mikhailov unreachable in Azerbaijan, and GRU handlers still operating via encrypted channels, the network’s infrastructure remains partially intact.
The question haunting Western intelligence: Were the July fires a warning shot, or the opening salvo of a conflict already underway beneath the threshold of conventional war?
Sources:
BBC News, Mystery parcel fires were ‘test runs’ to target cargo flights, November 5, 2024
VSquare Investigation, Revealed: How Russia’s GRU Plotted Europe’s Parcel Explosions, September 17, 2025
Taipei Times, West suspects Russia in airplane plots, November 7, 2024
CNN, Russia suspected of sending incendiary devices on US-bound planes in Europe, November 4, 2024
Washington Post, Russia, Europe fight for custody of operative linked to DHL parcel plot, November 18, 2025
Financial Times, Russia’s hybrid warfare puts Europe to the test, December 9, 2025