Russia’s spy agencies and Western security services are engaged in a secret struggle to gain custody of a Russian operative suspected of coordinating attacks last year that caused air cargo packages to burst into flames in Europe, according to security officials and investigators from five Western countries.
At the center of this tug-of-war is Yaroslav Mikhailov, a Russian national who is suspected of helping to design the incendiary devices used in the plot, directing the operation from within Europe and using a fake passport to flee to Azerbaijan, the officials said.
In a measure of his importance to the Kremlin, Western security officials said, the heads of all three Russian intelligence services — the FSB, SVR and GRU — have been directly involved in pressuring Azerbaijan to return Mikhailov to Russia rather than grant an extradition request from Poland.
In turn, Poland, the United Kingdom, Ukraine and Lithuania have lobbied the government in Baku in an effort to prevent his return to Russia, officials said.
This article is based on interviews with more than two dozen Western security officials, as well as investigative documents obtained or reviewed by The Washington Post. Among them is a secret Interpol application submitted by Poland seeking Mikhailov’s arrest for “terrorist” operations he pursued under direction from the “secret intelligence services of the Russian Federation.” The officials spoke on the condition of anonymity to discuss sensitive intelligence.
Kremlin spokesman Dmitry Peskov did not directly respond to questions from The Post, saying: “There is nothing for us to comment on here.”
The intervention by Moscow’s intelligence services reflects the importance they attach to trusted proxies who are playing an increasingly important role in Russia’s “hybrid warfare” campaign against Western adversaries, officials said.
In the air cargo operation in July last year, packages rigged with timers and a flammable magnesium compound escaped detection in Lithuania and were delivered to depots in Germany, Poland and England, where they caused fires that spread quickly before being extinguished.
Mikhailov “represents a new breed of Russian operative recruited by the GRU from criminal organizations for their contacts and capabilities,” said a senior European security official, using the acronym for Russia’s military intelligence service.
Mikhailov previously faced criminal charges in Russia for smuggling. Attempts to contact him were unsuccessful. A woman who acknowledged that she is Mikhailov’s sister refused to answer questions after answering a call from a Post reporter, saying it was a personal matter before hanging up.
The extent of Russia’s reliance on Mikhailov, 37, to anchor the parcel plot and efforts to extract him from Azerbaijan have not been previously reported. A senior European investigator described him as “the most important” operative still at-large because of his role as a conduit between GRU agents in Russia and low-level recruits in Europe who were enlisted to collect, assemble and ship the rigged packages.
At least 20 suspects are facing terrorism or other charges in Lithuania and Poland for involvement in the plot.
Azerbaijan has so far rebuffed the competing demands for Mikhailov, who used the alias “Jarik Deppa” on Telegram, officials said. As a result, he has spent much of the past year in a state of limbo, not formally detained but under surveillance and not allowed to leave the country, officials said.
A spokesman for the Azerbaijani Foreign Ministry did not respond to requests for comment.
Investigators have also identified a suspected GRU agent who used variations of the online pseudonym “Warrior” and was Mikhailov’s main point of contact in Russia, according to security officials. After Mikhailov was tasked with the plot, officials said, he sent detailed messages to Russia outlining the dimensions and materials he believed were necessary to ensure the devices would escape detection.
The Warrior accounts have been traced to Aleksey Kolosovskiy, a suspected member of a Russian hacking consortium known as Killnet, an organization with close ties to Russian intelligence that wages online attacks against perceived adversaries of the Kremlin, according to Western security officials. Kolosovskiy is believed to have been in direct contact with the GRU, officials said. His connection to the cargo plot has not been previously reported.
In text messages with a reporter for The Post, Kolosovskiy denied knowing Mikhailov, being involved in Killnet or any connection to the cargo plot. “I don’t know why you are asking me these questions,” he said. “This is some kind of nonsense.”
The air cargo attack rattled U.S. and Western security officials, who described it as the most reckless and potentially dangerous plot that Russia has pursued in an ongoing campaign of sabotage, arson and assassination aimed at punishing countries supporting Ukraine.
The attacks caused no injuries but led to fires at depots in Leipzig, Warsaw and Birmingham. Officials in Berlin said the time-set devices were powerful enough to cause a plane to plunge from the sky had they detonated during flights, raising the prospect of significant casualties.
There were also indications that Russia was planning to target the United States and Canada with similar packages. U.S. officials including then-CIA Director William J. Burns last year confronted counterparts in Moscow after intelligence indicated that the fires in Europe had been a “test run” for using similar devices on transatlantic cargo shipments, according to current and former U.S. officials.
Mikhailov was a linchpin in key aspects of the plot, officials said, traveling widely in Europe as he coordinated the shipments that caught fire and directed other recruits to send test packages without flammable components to addresses in Washington and Ottawa — an apparent effort to gather information on the security, routes and timing of transatlantic deliveries.
Despite Mikhailov’s ties to that operation, the U.S. has not played a significant role in seeking his extradition to Poland, according to Western security officials. It is not clear whether the Trump administration raised the issue during the U.S.-brokered peace talks earlier this year between Azerbaijan and Armenia that culminated in a ceasefire signing ceremony at the White House in August attended by Azerbaijani President Ilham Aliyev.
A White House spokeswoman would not comment on whether the administration had discussed the extradition request with Azerbaijan.
Western security officials said prospects for securing Mikhailov’s extradition are unclear, but they noted that Azerbaijan, a former Soviet republic, has sought closer ties with Europe after ruptures with Russia.
Relations were particularly damaged last year by the downing of an Azerbaijani jetliner over Russian airspace, killing 38 people. Russian President Vladimir Putin initially refused to acknowledge Russian responsibility but admitted in a summit meeting with Aliyev last month that Russian air defense batteries had mistakenly fired on the aircraft.
Experts said Russia’s desires to gain custody of Mikhailov and prevent damaging disclosures that might accompany a trial in Europe were likely factors in Putin’s recent efforts to mend ties with Baku. Russia has submitted its own extradition request, officials said, describing Mikhailov as a wanted criminal, a ploy that Moscow has used in other cases to seek custody of operatives.
The push for custody of Mikhailov comes amid signs that Moscow’s campaign of hybrid attacks in Europe may be surging again after a lull that followed Donald Trump’s return to the White House. Denmark, Norway, Belgium and other countries have in recent weeks been forced to ground flights after incursions into restricted airspace by drones that officials have said were probably operated by a state adversary.
Moscow is also suspected of orchestrating a new plot with echoes of the air cargo operation. Poland and Romania last month arrested three people suspected of planning to send explosive packages to Ukraine through ground-based shipping channels, according to Polish officials.
Moscow has issued blanket denials of involvement in attacks on Europe, including the 2024 air cargo plot, even while warning Western governments of unspecified consequences for their support to Ukraine.
A Lithuanian investigative document obtained by The Post places Mikhailov near the center of a spider-web-style diagram of accomplices in the operation. Among them is a former Russian submarine officer suspected of helping to smuggle the flammable devices into Europe; recruits accused of moving detonators and other components to safe houses and “dead drop” sites; and a Lithuanian national charged with bringing the packages — their combustible contents hidden in tubes of cosmetics and sex toys — to a DHL storefront in Vilnius.
The documents suggest Russia planned to use this same network for additional waves of violence. As investigators retraced the steps of accused plotters, they found cans containing hexogen, a potent material used in military explosives, disguised as ordinary containers of grocery store corn and hidden in a Lithuanian cemetery. At another location, authorities found brackets matching the cans’ dimensions, raising concern that Russia intended to deploy crude bombs on drones or other vehicles at airports, military installations or other targets.
Overall, the materials provide a blueprint to how Russia has tapped criminal networks to reconstitute capabilities that were degraded when European governments expelled hundreds of suspected Russian intelligence officers after the full-scale invasion of Ukraine began in February 2022. A year later, the GRU established a new unit, the Department of Special Tasks, to oversee operations against Ukraine’s Western allies, officials said.
Mikhailov occupied an important layer in the GRU’s proxy network, officials said, taking orders from handlers in Russia and relaying instructions through Telegram to a constellation of subordinates. Many were young males with criminal records willing to perform tasks for modest cryptocurrency payments, the officials said. Details of the operation, and Mikhailov’s involvement, were reported by a consortium of European news organizations earlier this year.
Russia has mounted dozens of attacks across Europe using this outsourcing model, including arson attacks on shopping centers in Poland and Lithuania, as well as a London home owned by British Prime Minister Keir Starmer, according to authorities. The approach gives the Kremlin a veneer of deniability and shields its own spies from consequences — a point that European security officials have sought to emphasize.
“If you are a proxy, you’re disposable,” Ken McCallum, director of Britain’s MI5 domestic security service, said in a speech on threats last month. “You may well be ‘ghosted’ on payday. When you’re caught, you’ll be abandoned. You will not feature in a prisoner exchange. You’re on your own.”
Russia’s effort to extract Mikhailov suggests there is a special tier of this operational hierarchy for Russian nationals and trusted proxies, according to officials and experts.
“Throughout his tenure, Putin has taken a personal interest in bringing home ‘patriots’ who got in trouble overseas while working on behalf of the Russian intelligence services,” said Eric Ciaramella, a former CIA analyst and a Russia expert at the Carnegie Endowment for International Peace. “A core tenet of his moral code is that if you undertake risky missions abroad on the state’s behalf, you won’t be abandoned.”
Mikhailov’s background is murky but marked by sequences that are often associated with recruitment by Russian intelligence, officials said.
In 2015, he appeared on a wanted list for the FSB domestic security service, accused of violating laws against the “smuggling of pathogenic biological agents” and “potent, poisonous, explosive or radioactive substances,” according to Russian criminal records. The case was closed a year later for reasons that remain unclear, a sign that it may have been dropped as part of a deal with Russian intelligence services, officials said.
Mikhailov has since employed an array of aliases and forged passports — including two purportedly from Ukraine — that enabled him to travel extensively in Europe, according to materials compiled by investigators. Cellphone records indicate that Mikhailov spent time in at least 10 countries last year, including Austria, Germany, Poland, Belarus, Romania and Turkey.
By early 2024, he had been tapped to help orchestrate the air cargo attack, officials said. The components for the packages came from Russia, assembled from electronics and flammable substances available off-the-shelf, officials said. But Mikhailov had significant say in the specifications for the devices, officials said, indicating skills that may account for the GRU’s decision to entrust him with the job.
The packages were smuggled into Europe by former Russian submarine officers, including one who operates a transport company specializing in shipments from St. Petersburg to Baltic states, officials said. The devices were then conveyed through an elaborate sequence of handoffs until they were assembled, packed and picked up by the Lithuanian national who allegedly brought them to a DHL office in Vilnius on July 19.
Over the next three days, fires broke out at cargo hubs in Germany, Poland and England. A fourth device failed to detonate, enabling Polish authorities to examine its design. Mikhailov eluded an ensuing dragnet by using false documents to fly from Poland to Turkey and then Azerbaijan, where he was detained on suspicion of traveling with false documents, according to investigators.
It is not clear why, having reached Istanbul, Mikhailov did not proceed directly to Russia. Officials said he may have feared repercussions for his role in an operation that risked a major escalation in Russia’s conflict with the U.S. and Europe, one considered so reckless that security officials have questioned whether the Kremlin was fully aware of the plot before the devices were detonated.
The post Russia, Europe fight for custody of operative linked to DHL bomb plot
appeared first on Washington Post.
