Fake cosmetics, massage pillows and sex toys. Homemade explosive devices. Russian known as Ratnik. Code word: Maria.
These are key elements of an alleged Russian-led sabotage operation that resulted in the detonation of three packages at courier centers in Britain, Germany and Poland last summer, a source familiar with the Polish investigation told Reuters.
The pillows, packed in packages along with cosmetics and sex toys, contained hidden improvised incendiary devices made from a chemical cocktail that included, among other things, highly reactive magnesium, said a source familiar with the case, who provided the most detailed account of the alleged plot yet.
The chemicals were activated by pre-set detonators, adapted from cheap Chinese electronic devices commonly used to track items such as lost keys. The effect was enhanced by tubes that looked like cosmetics but actually contained a gel made of flammable substances, including nitromethane, the same source said.
“The proceedings in this case relate to criminal activities inspired by the Russian GRU,” the source said, referring to Moscow’s military intelligence service.
Reuters is publishing details of the investigation for the first time, drawing on accounts from sources close to the Polish case and interviews with more than a dozen European security officials. The findings provide a rare glimpse into how sabotage campaigns operate on the ground.
European security officials spoke publicly about the arson attacks in October, describing them as part of a "hybrid war" waged by Russia to destabilize the functioning of countries supporting Ukraine, using tactics such as arson and cyberattacks.
They said the shipments, which caught fire in warehouses and caused fires but did not injure anyone, were a rehearsal for a future Russian plot to detonate similar packages in flight, on cargo planes bound for the US and Canada.
“With the war in Ukraine, these attacks have intensified, become more frequent and more aggressive,” said Nico Popescu, Moldova’s deputy prime minister and foreign minister until early last year and now a senior fellow at the European Council on Foreign Relations.
"Of course, this poses a risk to people, to citizens across the European Union."
The Kremlin has rejected accusations that Russia was behind the fire. “We don’t know anything about it,” spokesman Dmitry Peskov told Reuters. “We don’t rule out the possibility that this is another piece of fake news or a manifestation of blind Russophobia.”
The Kremlin said that European claims of Russian sabotage or hybrid warfare were completely unfounded.
The GRU did not respond to a request for comment.
"We do not exclude the possibility that this is another fake news or a manifestation of blind Russophobia," Kremlin spokesman Dmitry Peskov said.
The package detonations occurred on July 19, 20 and 21, in Birmingham, UK, Leipzig, Germany and near the Polish capital of Warsaw.
Two EU security officials familiar with the alleged attacks, who spoke on condition of anonymity because of the sensitivity of the information, said the cell in Poland was typical of Russian intelligence methods. Russian operatives often hire local criminals to carry out their plans, giving them basic instructions via Telegram and paying them several thousand euros per task.
The ingredients and initiators described in this case can be legally purchased in stores that sell fertilizers or pyrotechnics, said Jaroslav Stelmah, a former explosive device deactivation specialist who runs Safety Project, a consulting firm that, among other things, advises on the security of public facilities.
While small, crudely made devices might only cause a small fire, they can be difficult to detect, he told Reuters. "This is an extremely cheap, very efficient and highly anonymous way of making explosive devices," he added.
Warrior, Marija and the fourth shipment
According to a person familiar with the investigation, the case led by Polish prosecutors is based on testimonies from at least five suspected members of the alleged sabotage cell, as well as confidential findings from security services.
The state prosecutor's office confirmed to Reuters that investigators had also seized a fourth shipment that did not explode at a warehouse in Warsaw, allowing them to examine its contents in detail.
Polish investigators claim that Ukrainian Vladislav D., who lived in southern Poland, played a key role in the European test operation, acting on instructions he received via Telegram from a GRU operative known only as “Ratnik,” the source said.
Russian operatives often hire local criminals to carry out their plans, giving them basic instructions via Telegram and paying them several thousand euros per task.
Polish law does not allow the public disclosure of the surnames of those under criminal proceedings. However, the suspect's full name, Vladislav Derkavec, was disclosed in related court proceedings in Bosnia and Herzegovina, where there are no such restrictions. There, another suspected member of the alleged mail conspiracy faced an extradition request to Poland.
On July 18, Vladislav crossed the border from Katowice to the Lithuanian city of Kaunas in an Opel Astra, where he took more than a dozen items from the trunk of a parked car, according to a source close to the Polish investigation.
The 27-year-old then traveled to Vilnius, where he packed four packages, each containing a pillow and several tubes of cosmetics and sex toys. Before sealing them, he pressed two buttons to activate timers on the devices, the source said, adding that the devices allow detonation to be programmed anywhere from a few seconds to several months in advance.
He handed over the packages to a man in a park in Vilnius on July 19, who used the code word “Maria,” the same source said. The packages were sent from that city on the same day.
Vladislav was arrested in Poland in early August and charged with terrorist acts on behalf of Russian intelligence. In January, a court in Warsaw extended his detention until May while the investigation continues.
Reuters was unable to contact Vladislav in custody, and his official lawyer said he could not comment because he was not familiar with the details of the investigation, which is still in the pre-trial phase.
The state prosecutor's office confirmed to Reuters that the suspect denied the charges, including working for a foreign intelligence service, and that he had given "extensive explanations" for his actions, which the prosecutor's office cannot publish due to the confidentiality of the proceedings.
During questioning after his arrest, Vladislav said that he was introduced to "Ratnik" by a friend and that they communicated exclusively via Telegram, according to a source familiar with the investigation.
Polish prosecutors accuse another man, 44-year-old Aleksander B., of being part of the same Polish cell. His task, it is alleged, was to prepare the ground for attacks on cargo flights to North America by sending packages of sneakers and clothing from Warsaw to Washington and Ottawa, in order to gather information on how and when the shipments were processed.
Aleksandar was a suspect sought by Polish authorities for extradition from Bosnia and Herzegovina. In Bosnia and Herzegovina, his full name was publicly disclosed as Aleksandar Bezrukavi, a Russian citizen from Rostov-on-Don. At a hearing in Sarajevo in January, he stated that he had no connection to or knowledge of any plot targeting warehouses or cargo planes.
Bezrukavi lost his legal battle and was extradited to Poland in February. Reuters was unable to reach him in custody or his lawyer. He has denied the charges, including working for a foreign intelligence service, according to the source.
Prepared by: A. Š.
Bonus video:
