In May 2024, Lithuanian prosecutors allege Russian spies recruited a Ukrainian refugee to conduct an arson attack on an Ikea store in Vilnius as part of Moscow's hybrid warfare campaign.

Military & Paramilitary OperationsUnconventional / ParamilitaryUse of 'little green men' (unmarked soldiers)

Aggressor

Summary

In May 2024, Lithuanian authorities confirmed an attempted arson attack on an Ikea store in Vilnius, Lithuania, orchestrated by Russian intelligence operatives as part of Moscow's hybrid warfare campaign in Europe. A Ukrainian teenager refugee was offered approximately £8,000 (around $11,000) and a BMW vehicle to plant an incendiary device inside the store's bedding department but the fire failed to destroy the building. Communications with the teen were conducted via encrypted Chinese messaging app Zengi, using a codename 'Q' linked to Russian spy tradecraft. The incident is one of multiple attacks attributed to Russian spy networks targeting European infrastructure, including suspicious fires at a munitions factory in Berlin and logistics hubs in the UK and Germany. Lithuanian officials also highlighted broader concerns about Russian infiltration in the Baltics, including arrests of local spies. This case exemplifies Russia's strategy of recruiting vulnerable individuals to conduct sabotage acts to destabilize European nations supporting Ukraine.

Classification

Confidence: High

The article provides clear and detailed description of Russian intelligence operatives recruiting a refugee to conduct an arson attack as part of Moscow's hybrid warfare campaign, supported by official statements and prosecution allegations. No defensive preparatory actions by allies were described.

Source URL

https://ctinsight.net/russian-spies-conduct-hybrid-warfare-in-europe

Open source

Provenance

Publisher: extension
Submitted: Feb 1, 2026, 00:14 UTC
Last updated: Nov 9, 2026, 01:13 UTC
Event time: May 1, 2024, 00:00 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "152b4868-8e6d-458b-8f2d-06b05a7a3872",
  "url": "https://ctinsight.net/russian-spies-conduct-hybrid-warfare-in-europe",
  "source": "extension",
  "status": "approved",
  "category": "Military & Paramilitary Operations",
  "subcategory": "Unconventional / Paramilitary",
  "incident_type": "Use of 'little green men' (unmarked soldiers)",
  "country": "Lithuania",
  "source_reliability": "C",
  "info_credibility": "3",
  "tags": [
    "Russia",
    "Hybrid Warfare",
    "Lithuania",
    "Arson",
    "Espionage",
    "Russian Spies",
    "Ukraine",
    "GRU",
    "Sabotage",
    "baltic sea region"
  ],
  "nodes": [],
  "countries": [],
  "where_text": "Land",
  "headline": null,
  "description": "Lithuanian prosecutors allege that Russian spies recruited a Ukrainian teenager refugee residing in the EU to conduct an arson attack on an Ikea store in Vilnius in May 2024. The teen was offered approximately £8,000 and a BMW in exchange for planting an incendiary device inside the store’s bedding section, although the fire failed to destroy the premises. Communications reportedly used encrypted Chinese messaging app Zengi with the code name 'Q'. Lithuanian security officials see this as part of Russia’s expanding hybrid warfare campaign targeting European stability. Additionally, the incident occurred alongside other suspected Russian sabotage operations across Europe, including suspicious fires at munitions factories in Germany and logistics hubs in the UK. Lithuanian authorities noted that the teen was recruited after crossing into Lithuania from Poland and had also been scoped for potential activity in Siauliai, near a NATO base. Authorities have arrested several alleged local spies working for Russia, reinforcing concerns about Russian espionage networks in the Baltics.",
  "summary_short": "In May 2024, Lithuanian prosecutors allege Russian spies recruited a Ukrainian refugee to conduct an arson attack on an Ikea store in Vilnius as part of Moscow's hybrid warfare campaign.",
  "summary_extended": "In May 2024, Lithuanian authorities confirmed an attempted arson attack on an Ikea store in Vilnius, Lithuania, orchestrated by Russian intelligence operatives as part of Moscow's hybrid warfare campaign in Europe. A Ukrainian teenager refugee was offered approximately £8,000 (around $11,000) and a BMW vehicle to plant an incendiary device inside the store's bedding department but the fire failed to destroy the building. Communications with the teen were conducted via encrypted Chinese messaging app Zengi, using a codename 'Q' linked to Russian spy tradecraft. The incident is one of multiple attacks attributed to Russian spy networks targeting European infrastructure, including suspicious fires at a munitions factory in Berlin and logistics hubs in the UK and Germany. Lithuanian officials also highlighted broader concerns about Russian infiltration in the Baltics, including arrests of local spies. This case exemplifies Russia's strategy of recruiting vulnerable individuals to conduct sabotage acts to destabilize European nations supporting Ukraine.",
  "actor_primary": "Russian spies",
  "target_primary": null,
  "location_text": "Vilnius, Lithuania; Siauliai, Lithuania; also mentions Poland and cities in Germany and UK for related attacks",
  "location_region": null,
  "location_coordinates_lat": 55.169438,
  "location_coordinates_lon": 23.881275,
  "location_precision": "Regional",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The article provides clear and detailed description of Russian intelligence operatives recruiting a refugee to conduct an arson attack as part of Moscow's hybrid warfare campaign, supported by official statements and prosecution allegations. No defensive preparatory actions by allies were described.",
  "event_time_utc": "2024-05-01T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "unknown",
  "created_at": "2026-02-01T00:14:25.015Z",
  "updated_at": "2026-11-09T01:13:38.405Z",
  "reliability_band": "strong",
  "location_precision_band": "regional",
  "time_precision_band": "unknown",
  "severity_band": "moderate",
  "attribution_confidence_band": "high",
  "attribution_basis": "independent_sources"
}

Public assessmentReliability: StrongSeverity: ModerateAttribution: HighIndependence confirmedTime: UnknownLocation: Regional

Source reliability

Info credibility

Event time

May 1, 2024, 00:00 UTC

Event time confidence

unknown

Location

Vilnius, Lithuania; Siauliai, Lithuania; also mentions Poland and cities in Germany and UK for related attacks

Primary actor

Russian spies

Country

Lithuania

Tags

Russia, Hybrid Warfare, Lithuania, Arson, Espionage, Russian Spies, Ukraine, GRU, Sabotage, baltic sea region

Loading signal...

{ "id": "152b4868-8e6d-458b-8f2d-06b05a7a3872", "url": "https://ctinsight.net/russian-spies-conduct-hybrid-warfare-in-europe", "source": "extension", "status": "approved", "category": "Military & Paramilitary Operations", "subcategory": "Unconventional / Paramilitary", "incident_type": "Use of 'little green men' (unmarked soldiers)", "country": "Lithuania", "source_reliability": "C", "info_credibility": "3", "tags": [ "Russia", "Hybrid Warfare", "Lithuania", "Arson", "Espionage", "Russian Spies", "Ukraine", "GRU", "Sabotage", "baltic sea region" ], "nodes": [], "countries": [], "where_text": "Land", "headline": null, "description": "Lithuanian prosecutors allege that Russian spies recruited a Ukrainian teenager refugee residing in the EU to conduct an arson attack on an Ikea store in Vilnius in May 2024. The teen was offered approximately £8,000 and a BMW in exchange for planting an incendiary device inside the store’s bedding section, although the fire failed to destroy the premises. Communications reportedly used encrypted Chinese messaging app Zengi with the code name 'Q'. Lithuanian security officials see this as part of Russia’s expanding hybrid warfare campaign targeting European stability. Additionally, the incident occurred alongside other suspected Russian sabotage operations across Europe, including suspicious fires at munitions factories in Germany and logistics hubs in the UK. Lithuanian authorities noted that the teen was recruited after crossing into Lithuania from Poland and had also been scoped for potential activity in Siauliai, near a NATO base. Authorities have arrested several alleged local spies working for Russia, reinforcing concerns about Russian espionage networks in the Baltics.", "summary_short": "In May 2024, Lithuanian prosecutors allege Russian spies recruited a Ukrainian refugee to conduct an arson attack on an Ikea store in Vilnius as part of Moscow's hybrid warfare campaign.", "summary_extended": "In May 2024, Lithuanian authorities confirmed an attempted arson attack on an Ikea store in Vilnius, Lithuania, orchestrated by Russian intelligence operatives as part of Moscow's hybrid warfare campaign in Europe. A Ukrainian teenager refugee was offered approximately £8,000 (around $11,000) and a BMW vehicle to plant an incendiary device inside the store's bedding department but the fire failed to destroy the building. Communications with the teen were conducted via encrypted Chinese messaging app Zengi, using a codename 'Q' linked to Russian spy tradecraft. The incident is one of multiple attacks attributed to Russian spy networks targeting European infrastructure, including suspicious fires at a munitions factory in Berlin and logistics hubs in the UK and Germany. Lithuanian officials also highlighted broader concerns about Russian infiltration in the Baltics, including arrests of local spies. This case exemplifies Russia's strategy of recruiting vulnerable individuals to conduct sabotage acts to destabilize European nations supporting Ukraine.", "actor_primary": "Russian spies", "target_primary": null, "location_text": "Vilnius, Lithuania; Siauliai, Lithuania; also mentions Poland and cities in Germany and UK for related attacks", "location_region": null, "location_coordinates_lat": 55.169438, "location_coordinates_lon": 23.881275, "location_precision": "Regional", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The article provides clear and detailed description of Russian intelligence operatives recruiting a refugee to conduct an arson attack as part of Moscow's hybrid warfare campaign, supported by official statements and prosecution allegations. No defensive preparatory actions by allies were described.", "event_time_utc": "2024-05-01T00:00:00.000Z", "end_time_utc": null, "event_time_confidence": "unknown", "created_at": "2026-02-01T00:14:25.015Z", "updated_at": "2026-11-09T01:13:38.405Z", "reliability_band": "strong", "location_precision_band": "regional", "time_precision_band": "unknown", "severity_band": "moderate", "attribution_confidence_band": "high", "attribution_basis": "independent_sources" }