The plots, say Western security officials, are part of a shadow war by Russia’s intelligence services. An arson attack that destroyed more than 1,000 businesses outside Warsaw. Another that burned an IKEA in Lithuania. A plan to put incendiary devices on cargo planes in Britain, Germany and Poland.
But a key figure in these plots, the officials say, is not an intelligence operative. He is a scruffy former taxi driver who lives in Russian farm country.
Aleksei Vladimirovich Kolosovsky, 42, who has ties to criminal groups involved in hacking, selling fake IDs and car theft, has made himself an essential player in this new form of unconventional conflict. With the help of Russian intelligence officers, he has overseen the planning and execution of recent plots in Poland, Lithuania, Britain, Germany and perhaps elsewhere, according to court documents and interviews with more than a dozen security officials from five European nations.
Mr. Kolosovsky’s role is a novel one, said the security officials. He is not a trained officer or an asset embedded in a foreign government. He is more of a service provider, the officials said, working closely with intelligence officers — most of them from the G.R.U., Russia’s military intelligence service, which has primary responsibility for sabotage operations.
Operatives like Mr. Kolosovsky have become more common in the Kremlin’s evolving and increasingly violent sabotage campaign, which has escalated from petty vandalism to bombings, arson and murder. The goal, the security officials said, is to tear at Western unity.
Mr. Kolosovsky, they said, brings to the fight an extensive network of criminals who know how to move goods and people without drawing the attention of law enforcement. Most important, these contacts reside and can travel in Europe, something that has become increasingly difficult for Russia’s professional intelligence officers since President Vladimir V. Putin launched his full-scale invasion of Ukraine.
“We are now operating in a space between peace and war,” Blaise Metreweli, who leads Britain’s spy agency, known as MI6, said in a speech. “Russia is testing us in the gray zone with tactics that are just below the threshold of war.”
New Recruits
Husky and often unshaven, Mr. Kolosovsky first came to the attention of Western intelligence services after a pair of arson attacks in May 2024, two of the security officials said.
Using an account on the messaging service Telegram, under variations of the name “Warrior,” he recruited a web of agents, including a Ukrainian teenager, to plant incendiary devices at an IKEA store in the Lithuanian capital, Vilnius, and at a large commercial center outside Warsaw, according to the officials, as well as court records.
From his base in Krasnodar, a city in southern Russia, Mr. Kolosovsky orchestrated the delivery of detonators and bomb-making equipment to lockers in train stations, where often-unwitting recruits retrieved them, according to security officials from two Western countries and court documents.
On May 8, 2024, the Ukrainian teenager, Daniil Bardadim, placed an incendiary device rigged with a remote timer in the mattress section of an IKEA store. The device ignited in the early hours of May 9, intentionally timed, prosecutors said, for the day when Moscow celebrates the Soviet Union’s victory over Nazi Germany.
Mr. Bardadim was arrested a few days later. He was pulled from a bus in Lithuania while on his way to the Latvian capital, Riga. He had a bag filled with items that he planned to use to make a bomb, including a remote-controlled toy car, two vibrators and six mobile phones, according to the court documents. He had planned to set off a device in Riga similar to one he had placed at the IKEA in Vilnius. Before his arrest, he had been given an older model BMW as compensation for the Vilnius attack.
Around the same time, a different set of accomplices linked to Mr. Kolosovsky started a blaze outside Warsaw that destroyed more than 1,000 small businesses. Later, Donald Tusk, Poland’s prime minister, said the authorities knew “for sure” that Russia’s intelligence services were responsible. In response to the sabotage plots, Poland shut down all of the Kremlin’s consulates in the country, hampering the work of its spies.
“The actions were coordinated by a person staying in Russia,” Mr. Tusk said.
Mr. Kolosovsky did not respond to several requests for comment. The Kremlin has repeatedly denied involvement in sabotage.
The services provided by Mr. Kolosovsky and others like him are a matter of necessity for Russia. Since the invasion of Ukraine, more than 750 Russian diplomats have been expelled from Europe, “the great majority of them spies,” Ken McCallum, the head of the British domestic security agency MI5, said in a speech in 2024.
“We sent home almost all the Russians,” Michal Koudelka, the director of the Czech Security Information Service, the country’s external spy service, said in an interview. “The ability of Russians to operate on Czech territory under traditional cover is very limited.”
The expulsions left the Kremlin partly blind and unable to react as Western nations began flooding Ukraine with weapons and materiel to combat Russian forces. In response, Mr. Putin turned to the G.R.U., which had long been the primary agency for overseas covert action.
Before the 2022 invasion of Ukraine, G.R.U. operatives from a specialized group known as Unit 29155 carried out assassinations, plotted coups and blew up weapons depots in Europe.
After the invasion, the G.R.U. expanded this effort, making Unit 29155’s commander, Gen. Andrei Averyanov, a deputy head of the entire agency. His elevation was seen by Western intelligence officials as a reflection of how important sabotage was to Mr. Putin’s conflict with the West.
General Averyanov now oversees a G.R.U. branch called the Special Activities Service, known in Western intelligence circles by its Russian acronym, S.S.D. It includes a number of subunits with varying specialties, including cyberwarfare, explosives and assassination, security officials from four European countries said. Unit 29155, some of them said, is now overseen by Gen. Vyacheslav Stafeyev, a veteran special operator with expertise in cyberwarfare.
A list of people connected to Russia’s sabotage operations, reviewed by The New York Times and confirmed by several Western intelligence agencies, has more than 300 names, mostly of Russian officers. The list includes photographs of some officers as well as passport numbers and cover names, including those used by General Stafeyev and other senior members of the S.S.D.
“Servicemen of this unit are involved in the organization, planning and direct execution of terrorist acts and sabotage and terrorist operations on the territory of Ukraine, the European Union and other countries outside Russia,” said a note attached to the list, which was circulated among more than three dozen intelligence services.
Sabotage is nothing new for the G.R.U. Training manuals dating to the 1930s describe the concept of “deep battle,” which includes sabotage operations far behind enemy lines.
But those operations were meant to be carried out by professional officers in wartime. Now, Russia is relying on a motley crew of criminals, Ukrainian refugees and others desperate for cash.
“During the Cold War there was at least some level of accountability and professionalism,” said Sean Wiswesser, a former C.I.A. officer who has written a book about Russia’s spy services, which he spent decades working against. “But now everything seems to be in the realm of possibility. We’ve never seen this level of recklessness.”
A Spy Network
Nothing about Mr. Kolosovsky’s public profile suggests a life of secret intrigue.
He appears to live modestly and is often in debt, according to security officials from one European country. His social media accounts feature a lot of cars, though not flashy ones. His last post on one account was on Dec. 15, 2020, his birthday. It featured a photograph with his mother.
Western security officials and researchers who have dug into his background found evidence of another life, hidden from view.
Mr. Kolosovsky seems to have been associated with a professional car thief named Daniil Oleynik, who used the online moniker Wasp Killer. Western security officials have linked both men to a channel on Telegram — Mr. Kolosovsky under the alias LexTER — that was a platform for extracting ransom payments from people whose vehicles had been stolen. Mr. Oleynik was arrested in Italy and extradited to Ukraine in August 2024 on car theft charges.
It is unclear whether Mr. Kolosovsky was also a car thief. But researchers and security officials have connected his phone numbers to a network of channels and groups on Telegram involved in smuggling and doxxing, as well as selling fake IDs and equipment used to steal cars. His number was often saved in people’s phones as “Aleksei” plus the name of a car brand, like Lexus, Ford or Toyota.
Mr. Kolosovsky is also a sophisticated cyberoperator. He was associated with a hacker collective called KillNet, according to security officials in one European country. Since the invasion, KillNet has focused on attacking the websites of Ukrainian and European companies. In 2024, the group claimed to have hacked a French asset management company.
“Nothing personal, we’re just against the support of Nazis,” KillNet posted on social media, using a favored Kremlin slur for the Ukrainian government.
Often, the group ended its communications with: “Our enemies fall at our feet. Long Live Russia.”
A leak by a rival hacker group in 2024 linked Mr. Kolosovsky to the online handle @warriorkillnet.
In 2021, Mr. Kolosovsky was briefly detained by the Russian authorities, though it is not clear why. It was then, the security officials said, that he was likely recruited by the intelligence services, which often troll prisons looking for potentially useful inmates willing to work for them in exchange for freedom.
After Mr. Kolosovsky was detained, his associate, Mr. Oleynik, implored followers to delete their communications because the authorities had confiscated Mr. Kolosovsky’s electronic devices, according to the security officials. Telegram channels, possibly linked to Mr. Kolosovsky, also disappeared, the officials said.
His mother, who often posts photographs of her family on social media, has posted none of Mr. Kolosovsky since at least 2021. When asked about his whereabouts in a comment on a Russian social media post in July 2022, she responded that he was on a business trip.
A Growing Backlash
Early in the morning of July 20, 2024, a shipping container being loaded onto a DHL cargo plane in Leipzig, Germany, burst into flames. Less than 24 hours later, a package on a freight truck driving through Poland ignited. A day after that, in Birmingham, England, the same thing happened on a forklift at a DHL shipping facility, which was carrying a pallet of packages.
The coordinated attacks rattled Western governments more than the previous sabotage efforts, since they had the potential to blow cargo planes out of the sky and cause mass casualties. An enormous investigation involving nine countries later determined that the G.R.U. was behind the plots and that a vast network of operatives in Europe had carried them out, “adhering to a very strict conspiracy,” according to prosecutors in Lithuania, where the parcel bombs originated.
At the center of the attacks, say security officials in two European countries, was Mr. Kolosovsky.
He coordinated the recruitment of the network that helped oversee the transport and distribution of materials used to make the incendiary devices, according to the European security officials and court documents. The network, the documents said, used a military-grade incendiary material called thermite to make the devices, which were hidden inside massage pads fitted with electronic timers.
(The Washington Post previously disclosed Mr. Kolosovsky’s possible involvement with the G.R.U. and his connection to the plot to place incendiary devices on cargo planes.)
The attacks marked a drastic escalation of Russia’s shadow war, indicating a greater willingness to use violence to achieve its national security objectives, security officials from the five European countries said. Had the DHL cargo plane in Leipzig not been delayed, the officials said, the device likely would have gone off in midair. So alarmed was the White House that President Joseph R. Biden Jr.’s national security adviser and the head of the C.I.A. contacted their Russian counterparts with a message to halt such actions immediately.
“The Russians have taken state-sponsored murder and sabotage to a new level,” Mr. Wiswesser said. “They’re using it to accomplish strategic aims.”
While the attacks sent an ominous message, the blowback for Russia has been intense.
Lithuanian prosecutors moved aggressively to deconstruct the plot and charged more than a dozen people, several of whom were also implicated in the attack on the IKEA store. Among them was a Russian citizen named Yaroslav Mikhailov.
Security officials from two European countries say Mr. Mikhailov is a longtime friend of Mr. Kolosovsky, who recruited him specifically for the DHL operation. Mr. Mikhailov is now caught in a diplomatic tug of war. Currently detained in Azerbaijan, he is wanted in Poland, which issued a “red notice” through Interpol asking for his arrest. Russia has filed a counterapplication with Interpol, a move that it often uses to retrieve its arrested spies and agents.
The Kremlin’s interest in his case demonstrates Mr. Mikhailov’s importance, the officials said. Mr. Mikhailov sent a letter to Sergei Naryshkin, the head of Russia’s foreign intelligence service, asking for his help in returning to Russia, according to officials in one of the countries.
Mr. Kolosovsky has not forgotten his friend. He has lobbied his handlers in Russian intelligence services to help free Mr. Mikhailov, according to the officials.
But Mr. Kolosovsky appears to have his own problems.
After the DHL operation, he was called into the local office of the F.S.B., Russia’s domestic security agency, in Krasnodar, where his devices were searched, according to the security officials. The officials have varying explanations for this. It is possible, some say, that the publicity around some of his activities, especially the DHL plot, drew blowback from the Kremlin.
Officials also said there were signs that Mr. Kolosovsky had been having money troubles. There is evidence that he used his own cash to finance some of his operations, these officials said, and may have tried to compensate himself with funds allocated by the intelligence services.
Though he has not traveled abroad since the invasion of Ukraine, he recently conducted an online search for real estate in London, said officials in two European countries — an indication that he might be looking for a future retirement home, or a way out of Russia.
Tomas Dapkus contributed reporting from Vilnius, Lithuania.
Michael Schwirtz is the global intelligence correspondent for The Times based in London.
The post The Ex-Taxi Driver at the Center of Russia’s Shadow War appeared first on New York Times.
