Two cousins in Estonia were found guilty by Harju County Court for burning down a Ukrainian restaurant and a supermarket in January 2024, acts orchestrated by Russian military intelligence GRU.

Military & Paramilitary OperationsUnconventional / ParamilitaryProxy forces, militias, mercenaries (e.g. Wagner-type groups)

Aggressor

Summary

In January 2024, two Moldovan cousins were convicted for arson against the Slava Ukraina Ukrainian restaurant in Tallinn and a supermarket in southeastern Estonia. The Harju County Court ruled these attacks were ordered by Russia's GRU military intelligence as part of sabotage and hybrid warfare targeting NATO and EU countries. The younger cousin, Ivan Chihaiial, was sentenced to six and a half years in prison; he unknowingly worked for Russia and was paid about $2,000 in cryptocurrency. After the attacks, the perpetrators fled Estonia but were captured in Italy through coordinated efforts involving Polish, Lithuanian, and Latvian officers. Estonia's Internal Security Service highlighted these actions as evidence that Russia is having increasing difficulty recruiting collaborators in the region. The investigation links these arson incidents to a broader pattern of GRU sabotage in the Baltic states since 2023.

Classification

Confidence: High

The event reports a court ruling that Russian GRU military intelligence orchestrated arson attacks in Estonia using proxy actors, with specific individuals convicted and linked directly to GRU orders. This is a clear example of hostile aggressor activity involving sabotage and hybrid warfare in the Baltic region.

Source URL

https://tvpworld.com/87624140/cousins-who-burned-down-ukrainian-restaurant-in-estonia-were-russian-pawns-court-heard

Open source

Provenance

Publisher: extension
Submitted: Feb 1, 2026, 00:14 UTC
Last updated: Nov 9, 2026, 00:58 UTC
Event time: Jan 1, 2024, 00:00 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "1f2ae5e0-ad62-4de5-a9b2-723a7115c408",
  "url": "https://tvpworld.com/87624140/cousins-who-burned-down-ukrainian-restaurant-in-estonia-were-russian-pawns-court-heard",
  "source": "extension",
  "status": "approved",
  "category": "Military & Paramilitary Operations",
  "subcategory": "Unconventional / Paramilitary",
  "incident_type": "Proxy forces, militias, mercenaries (e.g. Wagner-type groups)",
  "country": "Estonia",
  "source_reliability": "C",
  "info_credibility": "3",
  "tags": [
    "Russia",
    "GRU",
    "Estonia",
    "Arson",
    "Hybrid Warfare",
    "Sabotage",
    "Moldovan Agents",
    "Internal Security",
    "baltic sea region"
  ],
  "nodes": [
    "Node 1: Borders",
    "Node 2: 5th Column"
  ],
  "countries": [],
  "where_text": "Land",
  "headline": null,
  "description": "The Harju County Court in northeastern Estonia convicted two Moldovan cousins of committing arson attacks in January 2024 under orders from Russia's GRU military intelligence. The men set fire to the Slava Ukraina Ukrainian restaurant in Tallinn and a supermarket in southeastern Estonia. The younger cousin, Ivan Chihaiial, was sentenced to six and a half years in prison. He was unaware he was working for Russia but had been paid nearly $2,000 in cryptocurrency. Following the attacks, both fled Estonia but were apprehended in Italy during a multinational operation involving Polish, Lithuanian, and Latvian security services. Estonia’s Internal Security Service commented that these operations demonstrate Russia’s increasing difficulties recruiting local collaborators. Harju County Court confirmed that these incidents form part of a systematic GRU-orchestrated sabotage campaign in the Baltic states since 2023.",
  "summary_short": "Two cousins in Estonia were found guilty by Harju County Court for burning down a Ukrainian restaurant and a supermarket in January 2024, acts orchestrated by Russian military intelligence GRU.",
  "summary_extended": "In January 2024, two Moldovan cousins were convicted for arson against the Slava Ukraina Ukrainian restaurant in Tallinn and a supermarket in southeastern Estonia. The Harju County Court ruled these attacks were ordered by Russia's GRU military intelligence as part of sabotage and hybrid warfare targeting NATO and EU countries. The younger cousin, Ivan Chihaiial, was sentenced to six and a half years in prison; he unknowingly worked for Russia and was paid about $2,000 in cryptocurrency. After the attacks, the perpetrators fled Estonia but were captured in Italy through coordinated efforts involving Polish, Lithuanian, and Latvian officers. Estonia's Internal Security Service highlighted these actions as evidence that Russia is having increasing difficulty recruiting collaborators in the region. The investigation links these arson incidents to a broader pattern of GRU sabotage in the Baltic states since 2023.",
  "actor_primary": "Russia's GRU military intelligence",
  "target_primary": null,
  "location_text": "Tallinn, capital of Estonia",
  "location_region": "Harju County, northeastern Estonia",
  "location_coordinates_lat": 58.595272,
  "location_coordinates_lon": 25.013607,
  "location_precision": "Regional",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The event reports a court ruling that Russian GRU military intelligence orchestrated arson attacks in Estonia using proxy actors, with specific individuals convicted and linked directly to GRU orders. This is a clear example of hostile aggressor activity involving sabotage and hybrid warfare in the Baltic region.",
  "event_time_utc": "2024-01-01T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "unknown",
  "created_at": "2026-02-01T00:14:26.385Z",
  "updated_at": "2026-11-09T00:58:55.435Z",
  "reliability_band": "strong",
  "location_precision_band": "regional",
  "time_precision_band": "unknown",
  "severity_band": "moderate",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}

Public assessmentReliability: StrongSeverity: ModerateAttribution: HighSingle sourceTime: UnknownLocation: Regional

Source reliability

Info credibility

Event time

Jan 1, 2024, 00:00 UTC

Event time confidence

unknown

Location

Tallinn, capital of Estonia

Region

Harju County, northeastern Estonia

Primary actor

Russia's GRU military intelligence

Country

Estonia

Tags

Russia, GRU, Estonia, Arson, Hybrid Warfare, Sabotage, Moldovan Agents, Internal Security, baltic sea region

Nodes

Node 1: Borders, Node 2: 5th Column

Loading signal...

{ "id": "1f2ae5e0-ad62-4de5-a9b2-723a7115c408", "url": "https://tvpworld.com/87624140/cousins-who-burned-down-ukrainian-restaurant-in-estonia-were-russian-pawns-court-heard", "source": "extension", "status": "approved", "category": "Military & Paramilitary Operations", "subcategory": "Unconventional / Paramilitary", "incident_type": "Proxy forces, militias, mercenaries (e.g. Wagner-type groups)", "country": "Estonia", "source_reliability": "C", "info_credibility": "3", "tags": [ "Russia", "GRU", "Estonia", "Arson", "Hybrid Warfare", "Sabotage", "Moldovan Agents", "Internal Security", "baltic sea region" ], "nodes": [ "Node 1: Borders", "Node 2: 5th Column" ], "countries": [], "where_text": "Land", "headline": null, "description": "The Harju County Court in northeastern Estonia convicted two Moldovan cousins of committing arson attacks in January 2024 under orders from Russia's GRU military intelligence. The men set fire to the Slava Ukraina Ukrainian restaurant in Tallinn and a supermarket in southeastern Estonia. The younger cousin, Ivan Chihaiial, was sentenced to six and a half years in prison. He was unaware he was working for Russia but had been paid nearly $2,000 in cryptocurrency. Following the attacks, both fled Estonia but were apprehended in Italy during a multinational operation involving Polish, Lithuanian, and Latvian security services. Estonia’s Internal Security Service commented that these operations demonstrate Russia’s increasing difficulties recruiting local collaborators. Harju County Court confirmed that these incidents form part of a systematic GRU-orchestrated sabotage campaign in the Baltic states since 2023.", "summary_short": "Two cousins in Estonia were found guilty by Harju County Court for burning down a Ukrainian restaurant and a supermarket in January 2024, acts orchestrated by Russian military intelligence GRU.", "summary_extended": "In January 2024, two Moldovan cousins were convicted for arson against the Slava Ukraina Ukrainian restaurant in Tallinn and a supermarket in southeastern Estonia. The Harju County Court ruled these attacks were ordered by Russia's GRU military intelligence as part of sabotage and hybrid warfare targeting NATO and EU countries. The younger cousin, Ivan Chihaiial, was sentenced to six and a half years in prison; he unknowingly worked for Russia and was paid about $2,000 in cryptocurrency. After the attacks, the perpetrators fled Estonia but were captured in Italy through coordinated efforts involving Polish, Lithuanian, and Latvian officers. Estonia's Internal Security Service highlighted these actions as evidence that Russia is having increasing difficulty recruiting collaborators in the region. The investigation links these arson incidents to a broader pattern of GRU sabotage in the Baltic states since 2023.", "actor_primary": "Russia's GRU military intelligence", "target_primary": null, "location_text": "Tallinn, capital of Estonia", "location_region": "Harju County, northeastern Estonia", "location_coordinates_lat": 58.595272, "location_coordinates_lon": 25.013607, "location_precision": "Regional", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The event reports a court ruling that Russian GRU military intelligence orchestrated arson attacks in Estonia using proxy actors, with specific individuals convicted and linked directly to GRU orders. This is a clear example of hostile aggressor activity involving sabotage and hybrid warfare in the Baltic region.", "event_time_utc": "2024-01-01T00:00:00.000Z", "end_time_utc": null, "event_time_confidence": "unknown", "created_at": "2026-02-01T00:14:26.385Z", "updated_at": "2026-11-09T00:58:55.435Z", "reliability_band": "strong", "location_precision_band": "regional", "time_precision_band": "unknown", "severity_band": "moderate", "attribution_confidence_band": "high", "attribution_basis": "single_source" }