Lithuanian police arrested a Ukrainian 17-year-old carrying remote-controlled detonators in a luggage locker package linked to Russian sabotage efforts in April 2024.

Terrorism & Criminal Proxy TacticsTerrorismBomb threats, assassination plots, targeted killings

AggressorDefense

Summary

In April 2024, Lithuanian authorities uncovered and disrupted a clandestine Russian sabotage operation in Europe involving a Ukrainian courier, Anna, who was recruited via Telegram to pick up and transport a package containing remote-controlled detonators hidden inside a remote-controlled car box and other components. Under police surveillance, the package was exchanged through train station lockers in Vilnius. The final recipient, Daniil Bardadim, a 17-year-old Ukrainian from Russian-occupied Kherson, was arrested near Panevėžys while traveling by bus to Riga, Latvia, with the package. Bardadim confessed to prior arson attacks and collaboration with a criminal network linked to pro-Russian figures in the occupied region. Lithuanian counterterrorism efforts foiled this plot, highlighting the use of young, expendable agents recruited online for sabotage linked to the Russian hybrid warfare strategy. This operation is part of a broader campaign utilizing 'single-use agents' to conduct acts of vandalism, sabotage, and information operations targeting European countries supporting Ukraine.

Classification

Confidence: High

The event describes a concrete Russian-linked sabotage operation targeting Lithuania, involving proxy agents and resulting in an arrest by Lithuanian counterterrorism forces conducting a sting operation, thus showing both aggressor activity and allied defense response.

Source URL

https://archive.is/XF77K

Open source

Provenance

Publisher: extension
Submitted: Feb 14, 2026, 12:22 UTC
Last updated: Nov 10, 2026, 02:40 UTC
Event time: Apr 1, 2024, 00:00 UTC

Published as a Defense Preparations signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "d68460f3-6f7d-40d0-be0f-f38b8b54659a",
  "url": "https://archive.is/XF77K",
  "source": "extension",
  "status": "approved",
  "category": "Terrorism & Criminal Proxy Tactics",
  "subcategory": "Terrorism",
  "incident_type": "Bomb threats, assassination plots, targeted killings",
  "country": "Lithuania",
  "source_reliability": "B",
  "info_credibility": "3",
  "tags": [
    "Russian sabotage",
    "counterterrorism",
    "Lithuania",
    "Ukraine",
    "hybrid warfare",
    "Telegram",
    "remote detonators",
    "single-use agents",
    "Kherson occupation",
    "Eastern Europe"
  ],
  "nodes": [
    "Node 1: Borders",
    "Node 2: 5th Column"
  ],
  "countries": [],
  "where_text": "Land",
  "headline": null,
  "description": "In April 2024, Lithuanian counterterrorism police thwarted a Russian-organized sabotage campaign involving a Ukrainian courier, Anna, who unknowingly transported devices disguised in an IKEA bag that contained remote-controlled detonators. After initial delivery at a Vilnius train station luggage locker and photo exchange via Telegram under surveillance, the package was retrieved by a 17-year-old Ukrainian, Daniil Bardadim, on a bus headed to Riga, Latvia. Lithuanian security forces intercepted and arrested Bardadim near Panevėžys, preventing a planned sabotage attack. Bardadim admitted involvement in multiple arson acts and recruitment by a criminal circle associated with pro-Russian occupation forces from Kherson, Ukraine. This incident exemplifies Russia's covert use of 'single-use agents'—often recruited via Telegram—and layered sabotage in Europe.",
  "summary_short": "Lithuanian police arrested a Ukrainian 17-year-old carrying remote-controlled detonators in a luggage locker package linked to Russian sabotage efforts in April 2024.",
  "summary_extended": "In April 2024, Lithuanian authorities uncovered and disrupted a clandestine Russian sabotage operation in Europe involving a Ukrainian courier, Anna, who was recruited via Telegram to pick up and transport a package containing remote-controlled detonators hidden inside a remote-controlled car box and other components. Under police surveillance, the package was exchanged through train station lockers in Vilnius. The final recipient, Daniil Bardadim, a 17-year-old Ukrainian from Russian-occupied Kherson, was arrested near Panevėžys while traveling by bus to Riga, Latvia, with the package. Bardadim confessed to prior arson attacks and collaboration with a criminal network linked to pro-Russian figures in the occupied region. Lithuanian counterterrorism efforts foiled this plot, highlighting the use of young, expendable agents recruited online for sabotage linked to the Russian hybrid warfare strategy. This operation is part of a broader campaign utilizing 'single-use agents' to conduct acts of vandalism, sabotage, and information operations targeting European countries supporting Ukraine.",
  "actor_primary": "Lithuanian counterterrorism police",
  "target_primary": null,
  "location_text": "Train station and gas station near Panevėžys, northern Lithuania",
  "location_region": "Panevėžys region",
  "location_coordinates_lat": null,
  "location_coordinates_lon": null,
  "location_precision": "Approximate",
  "is_aggressor_signal": true,
  "signal_type": "DEFENSE_PREP_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The event describes a concrete Russian-linked sabotage operation targeting Lithuania, involving proxy agents and resulting in an arrest by Lithuanian counterterrorism forces conducting a sting operation, thus showing both aggressor activity and allied defense response.",
  "event_time_utc": "2024-04-01T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "pm24h",
  "created_at": "2026-02-14T12:22:55.217Z",
  "updated_at": "2026-11-10T02:40:02.346Z",
  "reliability_band": "strong",
  "location_precision_band": "approximate",
  "time_precision_band": "within_24h",
  "severity_band": "moderate",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}

Public assessmentReliability: StrongSeverity: ModerateAttribution: HighSingle sourceTime: Same dayLocation: Approximate

Source reliability

Info credibility

Event time

Apr 1, 2024, 00:00 UTC

Event time confidence

pm24h

Location

Train station and gas station near Panevėžys, northern Lithuania

Region

Panevėžys region

Primary actor

Lithuanian counterterrorism police

Country

Lithuania

Tags

Russian sabotage, counterterrorism, Lithuania, Ukraine, hybrid warfare, Telegram, remote detonators, single-use agents, Kherson occupation, Eastern Europe

Nodes

Node 1: Borders, Node 2: 5th Column

Loading signal...

{ "id": "d68460f3-6f7d-40d0-be0f-f38b8b54659a", "url": "https://archive.is/XF77K", "source": "extension", "status": "approved", "category": "Terrorism & Criminal Proxy Tactics", "subcategory": "Terrorism", "incident_type": "Bomb threats, assassination plots, targeted killings", "country": "Lithuania", "source_reliability": "B", "info_credibility": "3", "tags": [ "Russian sabotage", "counterterrorism", "Lithuania", "Ukraine", "hybrid warfare", "Telegram", "remote detonators", "single-use agents", "Kherson occupation", "Eastern Europe" ], "nodes": [ "Node 1: Borders", "Node 2: 5th Column" ], "countries": [], "where_text": "Land", "headline": null, "description": "In April 2024, Lithuanian counterterrorism police thwarted a Russian-organized sabotage campaign involving a Ukrainian courier, Anna, who unknowingly transported devices disguised in an IKEA bag that contained remote-controlled detonators. After initial delivery at a Vilnius train station luggage locker and photo exchange via Telegram under surveillance, the package was retrieved by a 17-year-old Ukrainian, Daniil Bardadim, on a bus headed to Riga, Latvia. Lithuanian security forces intercepted and arrested Bardadim near Panevėžys, preventing a planned sabotage attack. Bardadim admitted involvement in multiple arson acts and recruitment by a criminal circle associated with pro-Russian occupation forces from Kherson, Ukraine. This incident exemplifies Russia's covert use of 'single-use agents'—often recruited via Telegram—and layered sabotage in Europe.", "summary_short": "Lithuanian police arrested a Ukrainian 17-year-old carrying remote-controlled detonators in a luggage locker package linked to Russian sabotage efforts in April 2024.", "summary_extended": "In April 2024, Lithuanian authorities uncovered and disrupted a clandestine Russian sabotage operation in Europe involving a Ukrainian courier, Anna, who was recruited via Telegram to pick up and transport a package containing remote-controlled detonators hidden inside a remote-controlled car box and other components. Under police surveillance, the package was exchanged through train station lockers in Vilnius. The final recipient, Daniil Bardadim, a 17-year-old Ukrainian from Russian-occupied Kherson, was arrested near Panevėžys while traveling by bus to Riga, Latvia, with the package. Bardadim confessed to prior arson attacks and collaboration with a criminal network linked to pro-Russian figures in the occupied region. Lithuanian counterterrorism efforts foiled this plot, highlighting the use of young, expendable agents recruited online for sabotage linked to the Russian hybrid warfare strategy. This operation is part of a broader campaign utilizing 'single-use agents' to conduct acts of vandalism, sabotage, and information operations targeting European countries supporting Ukraine.", "actor_primary": "Lithuanian counterterrorism police", "target_primary": null, "location_text": "Train station and gas station near Panevėžys, northern Lithuania", "location_region": "Panevėžys region", "location_coordinates_lat": null, "location_coordinates_lon": null, "location_precision": "Approximate", "is_aggressor_signal": true, "signal_type": "DEFENSE_PREP_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The event describes a concrete Russian-linked sabotage operation targeting Lithuania, involving proxy agents and resulting in an arrest by Lithuanian counterterrorism forces conducting a sting operation, thus showing both aggressor activity and allied defense response.", "event_time_utc": "2024-04-01T00:00:00.000Z", "end_time_utc": null, "event_time_confidence": "pm24h", "created_at": "2026-02-14T12:22:55.217Z", "updated_at": "2026-11-10T02:40:02.346Z", "reliability_band": "strong", "location_precision_band": "approximate", "time_precision_band": "within_24h", "severity_band": "moderate", "attribution_confidence_band": "high", "attribution_basis": "single_source" }