Investigations into a Russian-controlled sabotage network linked to a series of arson attacks in Europe have led to a search in Berlin focused on a Ukrainian suspect living in a former hotel housing Ukrainian refugees.

Terrorism & Criminal Proxy TacticsTerrorismBomb threats, assassination plots, targeted killings

Aggressor

Summary

Polish and Lithuanian investigators identified a Russian-directed network behind several major arson attacks across Europe in 2024 including destruction of large retail complexes in Vilnius and Warsaw, as well as incendiary devices sent via air freight to England, Poland, and Germany. The sabotage network operates in a pyramidal structure with Russian intelligence officials coordinating operations and recruiting disposable agents via Telegram, often unaware of the true origin. Evidence gathered includes a previously unreported search in summer 2024 at a Berlin location housing a Ukrainian man suspected of connections to key suspects in the sabotage network. This man was interrogated extensively, and investigators suspect his address was used to facilitate deliveries into Germany. There are also leads of involvement of Ukrainians recruited by Russia to deflect responsibility and ongoing concerns that further attacks involving explosives and drones are planned. Ongoing investigations in Lithuania and Poland have led to arrests and convictions, including a Ukrainian sentenced for the Vilnius IKEA arson in late 2024. Polish prosecutors have charged several suspects and seek extradition of a Russian believed to be a key link to the intelligence services. The attacks and investigations indicate a continuing escalation threat to European critical infrastructure, including recent explosions on a Polish railway line. German federal prosecutors have declined comment. The network’s disruption is ongoing but sabotage incidents have not ceased.

Classification

Confidence: High

The article explicitly details a sabotage network linked directly to Russian intelligence services conducting hostile arson attacks and sabotage activities across Europe including Germany. It reports arrests, convictions, ongoing investigations, and a specific raid in Berlin targeting individuals suspected of network links, confirming aggressive hostile acts.

Source URL

https://tagesschau.de/investigativ/ndr-wdr/dhl-sabotage-russland-100.html

Open source

Provenance

Publisher: extension
Submitted: Feb 1, 2026, 00:14 UTC
Last updated: Nov 9, 2026, 00:00 UTC
Event time: Jun 1, 2024, 00:00 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "56b1ff1f-4c89-4a25-8a92-2b0ab437fb46",
  "url": "https://tagesschau.de/investigativ/ndr-wdr/dhl-sabotage-russland-100.html",
  "source": "extension",
  "status": "approved",
  "category": "Terrorism & Criminal Proxy Tactics",
  "subcategory": "Terrorism",
  "incident_type": "Bomb threats, assassination plots, targeted killings",
  "country": "Germany",
  "source_reliability": "C",
  "info_credibility": "3",
  "tags": [
    "DHL",
    "Sabotage",
    "Russia",
    "Arson",
    "Air Freight",
    "Hybrid Warfare",
    "Russia-Linked Network",
    "Ukrainian Agents",
    "Telegram",
    "Berlin Raid",
    "Poland",
    "Lithuania",
    "Critical Infrastructure",
    "Explosives",
    "Drone Sabotage"
  ],
  "nodes": [],
  "countries": [],
  "where_text": "Land",
  "headline": null,
  "description": "In 2024, a network orchestrated by Russian intelligence services was identified as responsible for multiple arson attacks and sabotage in Europe affecting critical infrastructure, including major brand-name retail centers in Lithuania and Poland, and bomb attacks sent concealed in air freight parcels targeting England, Poland, and Germany. Polish and Lithuanian authorities have arrested about 20 suspects, including Ukrainian operatives recruited by Russia to obscure responsibility. The sabotage network functions with Kremlin insiders at the top coordinating via Telegram with low-level disposable agents executing attacks. German investigations revealed a previously undisclosed summer 2024 raid on a Ukrainian individual residing in a Berlin hotel housing refugees, suspected of contacts with central figures of the sabotage network and possibly a logistical node for package deliveries into Germany. While this man's exact role remains unclear, suspicions suggest he was involved or exploited for shipments. Concurrent investigations noted further plans for attacks involving drones and explosives, with ongoing arrests and trials in Poland and Lithuania, yet attacks such as recent explosions on Polish railways indicate continued threat escalation. Polish authorities have requested extradition of a key Russian suspect located in Azerbaijan amid reported Russian attempts to secure his release. German authorities including the Federal Prosecutor's Office have not officially commented. The covert sabotage campaign reflects an intensifying hybrid warfare tactic by Moscow targeting European infrastructure and civilian logistics channels.",
  "summary_short": "Investigations into a Russian-controlled sabotage network linked to a series of arson attacks in Europe have led to a search in Berlin focused on a Ukrainian suspect living in a former hotel housing Ukrainian refugees.",
  "summary_extended": "Polish and Lithuanian investigators identified a Russian-directed network behind several major arson attacks across Europe in 2024 including destruction of large retail complexes in Vilnius and Warsaw, as well as incendiary devices sent via air freight to England, Poland, and Germany. The sabotage network operates in a pyramidal structure with Russian intelligence officials coordinating operations and recruiting disposable agents via Telegram, often unaware of the true origin. Evidence gathered includes a previously unreported search in summer 2024 at a Berlin location housing a Ukrainian man suspected of connections to key suspects in the sabotage network. This man was interrogated extensively, and investigators suspect his address was used to facilitate deliveries into Germany. There are also leads of involvement of Ukrainians recruited by Russia to deflect responsibility and ongoing concerns that further attacks involving explosives and drones are planned. Ongoing investigations in Lithuania and Poland have led to arrests and convictions, including a Ukrainian sentenced for the Vilnius IKEA arson in late 2024. Polish prosecutors have charged several suspects and seek extradition of a Russian believed to be a key link to the intelligence services. The attacks and investigations indicate a continuing escalation threat to European critical infrastructure, including recent explosions on a Polish railway line. German federal prosecutors have declined comment. The network’s disruption is ongoing but sabotage incidents have not ceased.",
  "actor_primary": "Russian intelligence officers",
  "target_primary": null,
  "location_text": "Berlin, Germany",
  "location_region": null,
  "location_coordinates_lat": 51.165691,
  "location_coordinates_lon": 10.451526,
  "location_precision": "Regional",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The article explicitly details a sabotage network linked directly to Russian intelligence services conducting hostile arson attacks and sabotage activities across Europe including Germany. It reports arrests, convictions, ongoing investigations, and a specific raid in Berlin targeting individuals suspected of network links, confirming aggressive hostile acts.",
  "event_time_utc": "2024-06-01T00:00:00.000Z",
  "end_time_utc": "2024-08-31T23:59:59.000Z",
  "event_time_confidence": "pm24h",
  "created_at": "2026-02-01T00:14:33.258Z",
  "updated_at": "2026-11-09T00:00:16.330Z",
  "reliability_band": "strong",
  "location_precision_band": "regional",
  "time_precision_band": "within_24h",
  "severity_band": "significant",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}

Public assessmentReliability: StrongSeverity: SignificantAttribution: HighSingle sourceTime: Same dayLocation: Regional

Source reliability

Info credibility

Event time

Jun 1, 2024, 00:00 UTC

End time

Aug 31, 2024, 23:59 UTC

Event time confidence

pm24h

Location

Berlin, Germany

Primary actor

Russian intelligence officers

Country

Germany

Tags

DHL, Sabotage, Russia, Arson, Air Freight, Hybrid Warfare, Russia-Linked Network, Ukrainian Agents, Telegram, Berlin Raid, Poland, Lithuania, Critical Infrastructure, Explosives, Drone Sabotage

Loading signal...

{ "id": "56b1ff1f-4c89-4a25-8a92-2b0ab437fb46", "url": "https://tagesschau.de/investigativ/ndr-wdr/dhl-sabotage-russland-100.html", "source": "extension", "status": "approved", "category": "Terrorism & Criminal Proxy Tactics", "subcategory": "Terrorism", "incident_type": "Bomb threats, assassination plots, targeted killings", "country": "Germany", "source_reliability": "C", "info_credibility": "3", "tags": [ "DHL", "Sabotage", "Russia", "Arson", "Air Freight", "Hybrid Warfare", "Russia-Linked Network", "Ukrainian Agents", "Telegram", "Berlin Raid", "Poland", "Lithuania", "Critical Infrastructure", "Explosives", "Drone Sabotage" ], "nodes": [], "countries": [], "where_text": "Land", "headline": null, "description": "In 2024, a network orchestrated by Russian intelligence services was identified as responsible for multiple arson attacks and sabotage in Europe affecting critical infrastructure, including major brand-name retail centers in Lithuania and Poland, and bomb attacks sent concealed in air freight parcels targeting England, Poland, and Germany. Polish and Lithuanian authorities have arrested about 20 suspects, including Ukrainian operatives recruited by Russia to obscure responsibility. The sabotage network functions with Kremlin insiders at the top coordinating via Telegram with low-level disposable agents executing attacks. German investigations revealed a previously undisclosed summer 2024 raid on a Ukrainian individual residing in a Berlin hotel housing refugees, suspected of contacts with central figures of the sabotage network and possibly a logistical node for package deliveries into Germany. While this man's exact role remains unclear, suspicions suggest he was involved or exploited for shipments. Concurrent investigations noted further plans for attacks involving drones and explosives, with ongoing arrests and trials in Poland and Lithuania, yet attacks such as recent explosions on Polish railways indicate continued threat escalation. Polish authorities have requested extradition of a key Russian suspect located in Azerbaijan amid reported Russian attempts to secure his release. German authorities including the Federal Prosecutor's Office have not officially commented. The covert sabotage campaign reflects an intensifying hybrid warfare tactic by Moscow targeting European infrastructure and civilian logistics channels.", "summary_short": "Investigations into a Russian-controlled sabotage network linked to a series of arson attacks in Europe have led to a search in Berlin focused on a Ukrainian suspect living in a former hotel housing Ukrainian refugees.", "summary_extended": "Polish and Lithuanian investigators identified a Russian-directed network behind several major arson attacks across Europe in 2024 including destruction of large retail complexes in Vilnius and Warsaw, as well as incendiary devices sent via air freight to England, Poland, and Germany. The sabotage network operates in a pyramidal structure with Russian intelligence officials coordinating operations and recruiting disposable agents via Telegram, often unaware of the true origin. Evidence gathered includes a previously unreported search in summer 2024 at a Berlin location housing a Ukrainian man suspected of connections to key suspects in the sabotage network. This man was interrogated extensively, and investigators suspect his address was used to facilitate deliveries into Germany. There are also leads of involvement of Ukrainians recruited by Russia to deflect responsibility and ongoing concerns that further attacks involving explosives and drones are planned. Ongoing investigations in Lithuania and Poland have led to arrests and convictions, including a Ukrainian sentenced for the Vilnius IKEA arson in late 2024. Polish prosecutors have charged several suspects and seek extradition of a Russian believed to be a key link to the intelligence services. The attacks and investigations indicate a continuing escalation threat to European critical infrastructure, including recent explosions on a Polish railway line. German federal prosecutors have declined comment. The network’s disruption is ongoing but sabotage incidents have not ceased.", "actor_primary": "Russian intelligence officers", "target_primary": null, "location_text": "Berlin, Germany", "location_region": null, "location_coordinates_lat": 51.165691, "location_coordinates_lon": 10.451526, "location_precision": "Regional", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The article explicitly details a sabotage network linked directly to Russian intelligence services conducting hostile arson attacks and sabotage activities across Europe including Germany. It reports arrests, convictions, ongoing investigations, and a specific raid in Berlin targeting individuals suspected of network links, confirming aggressive hostile acts.", "event_time_utc": "2024-06-01T00:00:00.000Z", "end_time_utc": "2024-08-31T23:59:59.000Z", "event_time_confidence": "pm24h", "created_at": "2026-02-01T00:14:33.258Z", "updated_at": "2026-11-09T00:00:16.330Z", "reliability_band": "strong", "location_precision_band": "regional", "time_precision_band": "within_24h", "severity_band": "significant", "attribution_confidence_band": "high", "attribution_basis": "single_source" }