{
  "id": "193f4852-c463-4c0d-8199-95484af1423e",
  "url": "https://www.bbc.com/news/articles/cpd83zwqlvno",
  "source": "extension",
  "status": "approved",
  "category": "Terrorism & Criminal Proxy Tactics",
  "subcategory": "Terrorism",
  "incident_type": "Bomb threats, assassination plots, targeted killings",
  "country": "United Kingdom",
  "source_reliability": "A",
  "info_credibility": "3",
  "tags": [
    "Russia",
    "GRU",
    "Incendiary parcels",
    "Sabotage",
    "Hybrid warfare",
    "Lithuania",
    "UK",
    "Poland",
    "Terrorism",
    "Telegram",
    "Organized crime proxies",
    "Cargo fires"
  ],
  "nodes": [
    "Node 1: Borders"
  ],
  "countries": [],
  "where_text": "Land",
  "headline": "Inside the Russian explosives plot that sent incendiary parcels to the UK",
  "description": "In July 2024, Lithuanian national Aleksandr Suranovas was recruited via Telegram by operatives linked to Russian military intelligence (GRU) to courier incendiary parcels containing liquid explosives disguised as cosmetic items from Lithuania to the UK and Poland. Three parcels ignited in transit, causing significant damage but no casualties. Suranovas claims ignorance of the explosives, asserting he was used as an unwitting courier. The operation involved multiple sleeper proxies coordinated remotely from Russia, including persons with criminal backgrounds. The aim appears to have been sabotage and intimidation targeting countries supporting Ukraine. Twenty-two suspects have been arrested across Lithuania and Poland. Russia denies involvement. The plot underscores Moscow's increasing use of proxy criminal networks within Europe following constraints on covert agent deployment after the 2018 Salisbury incident.",
  "summary_short": "In July 2024, Lithuania-based courier Aleksandr Suranovas was involved unknowingly in delivering explosive parcels from Russia-linked actors to the UK and Poland, causing multiple fires; 22 suspects arrested across Europe.",
  "summary_extended": "In a July 2024 incident, Aleksandr Suranovas, recruited via Telegram by Russian military intelligence operatives, transported parcels containing sophisticated incendiary devices disguised within cosmetics from Lithuania to several Western countries including the UK, Poland, and Germany. The devices detonated causing fires in transit hubs, narrowly avoiding greater disaster and resulting in extensive property damage but no injuries. Authorities arrested 22 suspects across Lithuania and Poland after a joint investigation involving UK counter-terrorism. The operation illustrates Russia's shift to outsourcing sabotage and terror acts to proxies within Europe following depletion of traditional intelligence resources after the 2018 Salisbury poisoning. The suspects operated via compartmentalized roles with limited knowledge of the overall plot, emphasizing Moscow's deniability strategy. The UK and US issued diplomatic warnings to Moscow. Suranovas maintains innocence, claiming ignorance of the explosives, but court files reveal prior criminal convictions and skepticism of his role. This case highlights escalating hybrid aggression against Ukraine-supporting nations.",
  "actor_primary": "Aleksandr Suranovas",
  "target_primary": null,
  "location_text": "Vilnius, Lithuania; Leipzig, Germany; Warsaw, Poland; Birmingham, United Kingdom",
  "location_region": null,
  "location_coordinates_lat": 54.6872,
  "location_coordinates_lon": 25.2797,
  "location_precision": "Approximate",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The article explicitly details hostile Russian intelligence (GRU) orchestrated sabotage using proxies to send explosive parcels into NATO/EU countries, constituting a clear aggressor action; no defensive preparations are described in the report.",
  "event_time_utc": "2024-07-20T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "pm24h",
  "created_at": "2026-03-11T12:18:00.150Z",
  "updated_at": "2026-11-10T02:40:12.142Z",
  "reliability_band": "strong",
  "location_precision_band": "approximate",
  "time_precision_band": "within_24h",
  "severity_band": "significant",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}

{
  "id": "193f4852-c463-4c0d-8199-95484af1423e",
  "url": "https://www.bbc.com/news/articles/cpd83zwqlvno",
  "source": "extension",
  "status": "approved",
  "category": "Terrorism & Criminal Proxy Tactics",
  "subcategory": "Terrorism",
  "incident_type": "Bomb threats, assassination plots, targeted killings",
  "country": "United Kingdom",
  "source_reliability": "A",
  "info_credibility": "3",
  "tags": [
    "Russia",
    "GRU",
    "Incendiary parcels",
    "Sabotage",
    "Hybrid warfare",
    "Lithuania",
    "UK",
    "Poland",
    "Terrorism",
    "Telegram",
    "Organized crime proxies",
    "Cargo fires"
  ],
  "nodes": [
    "Node 1: Borders"
  ],
  "countries": [],
  "where_text": "Land",
  "headline": "Inside the Russian explosives plot that sent incendiary parcels to the UK",
  "description": "In July 2024, Lithuanian national Aleksandr Suranovas was recruited via Telegram by operatives linked to Russian military intelligence (GRU) to courier incendiary parcels containing liquid explosives disguised as cosmetic items from Lithuania to the UK and Poland. Three parcels ignited in transit, causing significant damage but no casualties. Suranovas claims ignorance of the explosives, asserting he was used as an unwitting courier. The operation involved multiple sleeper proxies coordinated remotely from Russia, including persons with criminal backgrounds. The aim appears to have been sabotage and intimidation targeting countries supporting Ukraine. Twenty-two suspects have been arrested across Lithuania and Poland. Russia denies involvement. The plot underscores Moscow's increasing use of proxy criminal networks within Europe following constraints on covert agent deployment after the 2018 Salisbury incident.",
  "summary_short": "In July 2024, Lithuania-based courier Aleksandr Suranovas was involved unknowingly in delivering explosive parcels from Russia-linked actors to the UK and Poland, causing multiple fires; 22 suspects arrested across Europe.",
  "summary_extended": "In a July 2024 incident, Aleksandr Suranovas, recruited via Telegram by Russian military intelligence operatives, transported parcels containing sophisticated incendiary devices disguised within cosmetics from Lithuania to several Western countries including the UK, Poland, and Germany. The devices detonated causing fires in transit hubs, narrowly avoiding greater disaster and resulting in extensive property damage but no injuries. Authorities arrested 22 suspects across Lithuania and Poland after a joint investigation involving UK counter-terrorism. The operation illustrates Russia's shift to outsourcing sabotage and terror acts to proxies within Europe following depletion of traditional intelligence resources after the 2018 Salisbury poisoning. The suspects operated via compartmentalized roles with limited knowledge of the overall plot, emphasizing Moscow's deniability strategy. The UK and US issued diplomatic warnings to Moscow. Suranovas maintains innocence, claiming ignorance of the explosives, but court files reveal prior criminal convictions and skepticism of his role. This case highlights escalating hybrid aggression against Ukraine-supporting nations.",
  "actor_primary": "Aleksandr Suranovas",
  "target_primary": null,
  "location_text": "Vilnius, Lithuania; Leipzig, Germany; Warsaw, Poland; Birmingham, United Kingdom",
  "location_region": null,
  "location_coordinates_lat": 54.6872,
  "location_coordinates_lon": 25.2797,
  "location_precision": "Approximate",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The article explicitly details hostile Russian intelligence (GRU) orchestrated sabotage using proxies to send explosive parcels into NATO/EU countries, constituting a clear aggressor action; no defensive preparations are described in the report.",
  "event_time_utc": "2024-07-20T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "pm24h",
  "created_at": "2026-03-11T12:18:00.150Z",
  "updated_at": "2026-11-10T02:40:12.142Z",
  "reliability_band": "strong",
  "location_precision_band": "approximate",
  "time_precision_band": "within_24h",
  "severity_band": "significant",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}