In November 2011, Russian military intelligence unit GRU Unit 29155 conducted its first known act of sabotage against NATO by bombing an ammunition depot in Lovnidol, Bulgaria, which contained Soviet-era 152mm artillery shells destined for Georgia. The unit, led by Gen. Andrey Averyanov, used improvised radio-controlled detonators disguised inside everyday objects such as a WiFi router casing, an apple juice container, and a cell phone, developed during a covert workshop in Krasnodar, Russia. Key operatives including Lt. Col. Nikolay Ezhov, Lt. Col. Sergey Romanov, Col. Alexey Kapinos, Col. Rustam Dzhafarov, and Col. Anatoly Chepiga traveled through Central Europe in October-November 2011 to prepare and execute the attack. The explosions caused prolonged fires and secondary blasts, killing or injuring civilians and destabilizing regional security. Bulgarian prosecutors closed the case in 2014 citing insufficient evidence, though subsequent investigations point to continued sabotage activities by the same unit in Bulgaria and Czechia, including the infamous 2014 Vrbětice depot explosion. Internal leaked emails, travel records, burner phone metadata, and forensic reports detail the technical specifics of the remote detonators and the careful planning behind the operations. The attacks ultimately led to diplomatic expulsions and underscore the ongoing covert warfare posture of Russian intelligence targeting critical infrastructure within NATO and EU territories.

In November 2011, Russian military intelligence unit GRU Unit 29155 conducted its first known act of sabotage against NATO by bombing an ammunition depot in Lovnidol, Bulgaria, which contained Soviet-era 152mm artillery shells destined for Georgia. The unit, led by Gen. Andrey Averyanov, used improvised radio-controlled detonators disguised inside everyday objects such as a WiFi router casing, an apple juice container, and a cell phone, developed during a covert workshop in Krasnodar, Russia. Key operatives including Lt. Col. Nikolay Ezhov, Lt. Col. Sergey Romanov, Col. Alexey Kapinos, Col. Rustam Dzhafarov, and Col. Anatoly Chepiga traveled through Central Europe in October-November 2011 to prepare and execute the attack. The explosions caused prolonged fires and secondary blasts, killing or injuring civilians and destabilizing regional security. Bulgarian prosecutors closed the case in 2014 citing insufficient evidence, though subsequent investigations point to continued sabotage activities by the same unit in Bulgaria and Czechia, including the infamous 2014 Vrbětice depot explosion. Internal leaked emails, travel records, burner phone metadata, and forensic reports detail the technical specifics of the remote detonators and the careful planning behind the operations. The attacks ultimately led to diplomatic expulsions and underscore the ongoing covert warfare posture of Russian intelligence targeting critical infrastructure within NATO and EU territories.