Russian intelligence ordered an arson attack on a Ukrainian restaurant in Tallinn by two Moldovan citizens linked to the GRU.

Terrorism & Criminal Proxy TacticsOrganized CrimeUnknown

Aggressor

Summary

An arson attack on the Slava Ukraina restaurant in Tallinn on January 31, 2025, was directed by Russian military intelligence (GRU) and executed by two Moldovan cousins named Ivan Chihaial. The younger suspect, recruited by the GRU in summer 2024, previously committed arson on a supermarket near a military area and was paid in cryptocurrency likely originating from the GRU. They conducted reconnaissance from January 27-29 before the attack. The older suspect performed the fire-setting act, while the younger filmed it; the footage was published by the GRU. Both suspects were arrested in Italy on February 11, 2025. Estonian prosecutors noted the attack fits a series of Russian attempts to polarize and destabilize Baltic societies by targeting monuments, officials, and Ukrainian interests. The Internal Security Service highlighted increasing challenges for Russian intelligence to recruit operatives inside Estonia, leading to hiring foreign convicts imprisoned in Russia. The younger Chihaial received a 6.5-year sentence; the older, six months.

Classification

Confidence: High

Clear evidence from court proceedings and law enforcement linking the arson attacks to Russian military intelligence (GRU), leveraging foreign nationals to conduct sabotage and influence operations on Estonian soil.

Source URL

https://news.err.ee/1609735683/arson-attack-on-ukrainian-restaurant-in-estonia-ordered-by-russian-intelligence

Open source

Provenance

Publisher: extension
Submitted: Feb 13, 2026, 19:25 UTC
Last updated: Nov 8, 2026, 20:50 UTC
Event time: Jan 31, 2025, 02:30 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "79c858fa-2243-4a4a-b309-405fb2a8a6da",
  "url": "https://news.err.ee/1609735683/arson-attack-on-ukrainian-restaurant-in-estonia-ordered-by-russian-intelligence",
  "source": "extension",
  "status": "approved",
  "category": "Terrorism & Criminal Proxy Tactics",
  "subcategory": "Organized Crime",
  "incident_type": "Unknown",
  "country": "Estonia",
  "source_reliability": "C",
  "info_credibility": "3",
  "tags": [
    "russian intelligence operations",
    "GRU",
    "arson",
    "Estonia",
    "Tallinn",
    "Ukrainian restaurant",
    "influence operation",
    "organized crime",
    "hybrid warfare"
  ],
  "nodes": [
    "Node 2: 5th Column"
  ],
  "countries": [
    "Estonia"
  ],
  "where_text": "Land",
  "headline": null,
  "description": "An arson attack on the Ukrainian restaurant 'Slava Ukraina' in Tallinn, Estonia, was an influence operation ordered by Russian military intelligence (GRU) and executed by two Moldovan men. The younger defendant admitted to ties with GRU and involvement in two arson attacks: one at a supermarket in Osula village near a military training area, and another at the restaurant. The attack at 'Slava Ukraina' involved smashing a window, throwing gasoline inside, and setting it on fire, with the act filmed and later uploaded by the GRU. The younger man will serve six and a half years in prison, while the older accomplice, with unclear knowledge of the GRU involvement, received a six-month sentence. This is part of an ongoing pattern of Russian sabotage and influence operations in Estonia.",
  "summary_short": "Russian intelligence ordered an arson attack on a Ukrainian restaurant in Tallinn by two Moldovan citizens linked to the GRU.",
  "summary_extended": "An arson attack on the Slava Ukraina restaurant in Tallinn on January 31, 2025, was directed by Russian military intelligence (GRU) and executed by two Moldovan cousins named Ivan Chihaial. The younger suspect, recruited by the GRU in summer 2024, previously committed arson on a supermarket near a military area and was paid in cryptocurrency likely originating from the GRU. They conducted reconnaissance from January 27-29 before the attack. The older suspect performed the fire-setting act, while the younger filmed it; the footage was published by the GRU. Both suspects were arrested in Italy on February 11, 2025. Estonian prosecutors noted the attack fits a series of Russian attempts to polarize and destabilize Baltic societies by targeting monuments, officials, and Ukrainian interests. The Internal Security Service highlighted increasing challenges for Russian intelligence to recruit operatives inside Estonia, leading to hiring foreign convicts imprisoned in Russia. The younger Chihaial received a 6.5-year sentence; the older, six months.",
  "actor_primary": "Russian military intelligence (GRU)",
  "target_primary": null,
  "location_text": "Slava Ukraina restaurant, Telliskivi district, Tallinn",
  "location_region": "Harju County",
  "location_coordinates_lat": 59.4326,
  "location_coordinates_lon": 24.7149,
  "location_precision": "Exact",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "Clear evidence from court proceedings and law enforcement linking the arson attacks to Russian military intelligence (GRU), leveraging foreign nationals to conduct sabotage and influence operations on Estonian soil.",
  "event_time_utc": "2025-01-31T02:30:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "exact",
  "created_at": "2026-02-13T19:25:08.238Z",
  "updated_at": "2026-11-08T20:50:10.120Z",
  "reliability_band": "strong",
  "location_precision_band": "exact",
  "time_precision_band": "exact",
  "severity_band": "moderate",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}

Public assessmentReliability: StrongSeverity: ModerateAttribution: HighSingle sourceTime: ExactLocation: Exact

Source reliability

Info credibility

Event time

Jan 31, 2025, 02:30 UTC

Event time confidence

exact

Location

Slava Ukraina restaurant, Telliskivi district, Tallinn

Region

Harju County

Primary actor

Russian military intelligence (GRU)

Country

Estonia

Countries

Estonia

Tags

russian intelligence operations, GRU, arson, Estonia, Tallinn, Ukrainian restaurant, influence operation, organized crime, hybrid warfare

Nodes

Node 2: 5th Column

Loading signal...

{ "id": "79c858fa-2243-4a4a-b309-405fb2a8a6da", "url": "https://news.err.ee/1609735683/arson-attack-on-ukrainian-restaurant-in-estonia-ordered-by-russian-intelligence", "source": "extension", "status": "approved", "category": "Terrorism & Criminal Proxy Tactics", "subcategory": "Organized Crime", "incident_type": "Unknown", "country": "Estonia", "source_reliability": "C", "info_credibility": "3", "tags": [ "russian intelligence operations", "GRU", "arson", "Estonia", "Tallinn", "Ukrainian restaurant", "influence operation", "organized crime", "hybrid warfare" ], "nodes": [ "Node 2: 5th Column" ], "countries": [ "Estonia" ], "where_text": "Land", "headline": null, "description": "An arson attack on the Ukrainian restaurant 'Slava Ukraina' in Tallinn, Estonia, was an influence operation ordered by Russian military intelligence (GRU) and executed by two Moldovan men. The younger defendant admitted to ties with GRU and involvement in two arson attacks: one at a supermarket in Osula village near a military training area, and another at the restaurant. The attack at 'Slava Ukraina' involved smashing a window, throwing gasoline inside, and setting it on fire, with the act filmed and later uploaded by the GRU. The younger man will serve six and a half years in prison, while the older accomplice, with unclear knowledge of the GRU involvement, received a six-month sentence. This is part of an ongoing pattern of Russian sabotage and influence operations in Estonia.", "summary_short": "Russian intelligence ordered an arson attack on a Ukrainian restaurant in Tallinn by two Moldovan citizens linked to the GRU.", "summary_extended": "An arson attack on the Slava Ukraina restaurant in Tallinn on January 31, 2025, was directed by Russian military intelligence (GRU) and executed by two Moldovan cousins named Ivan Chihaial. The younger suspect, recruited by the GRU in summer 2024, previously committed arson on a supermarket near a military area and was paid in cryptocurrency likely originating from the GRU. They conducted reconnaissance from January 27-29 before the attack. The older suspect performed the fire-setting act, while the younger filmed it; the footage was published by the GRU. Both suspects were arrested in Italy on February 11, 2025. Estonian prosecutors noted the attack fits a series of Russian attempts to polarize and destabilize Baltic societies by targeting monuments, officials, and Ukrainian interests. The Internal Security Service highlighted increasing challenges for Russian intelligence to recruit operatives inside Estonia, leading to hiring foreign convicts imprisoned in Russia. The younger Chihaial received a 6.5-year sentence; the older, six months.", "actor_primary": "Russian military intelligence (GRU)", "target_primary": null, "location_text": "Slava Ukraina restaurant, Telliskivi district, Tallinn", "location_region": "Harju County", "location_coordinates_lat": 59.4326, "location_coordinates_lon": 24.7149, "location_precision": "Exact", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "Clear evidence from court proceedings and law enforcement linking the arson attacks to Russian military intelligence (GRU), leveraging foreign nationals to conduct sabotage and influence operations on Estonian soil.", "event_time_utc": "2025-01-31T02:30:00.000Z", "end_time_utc": null, "event_time_confidence": "exact", "created_at": "2026-02-13T19:25:08.238Z", "updated_at": "2026-11-08T20:50:10.120Z", "reliability_band": "strong", "location_precision_band": "exact", "time_precision_band": "exact", "severity_band": "moderate", "attribution_confidence_band": "high", "attribution_basis": "single_source" }