The life that Vasilij Kovacs —a Ukrainian living in Latvia—had known came to an abrupt end: late on the evening of the 1st of March, 2025, he was arrested for his involvement in organizing a terrorist act, reports Politico.Officers from Latvia’s State Security Service searched his property and seized several mobile phones, SIM cards, documents, a handgun with a filed-off serial number, a bayonet for an AK-47 assault rifle, and a mobile signal jammer. Kovacs, who had resided in Latvia for over 30 years, was taken into custody. In March, he was extradited to Lithuania, where he—along with four other individuals—faces charges of planning a terrorist act. Another five individuals are standing trial in Warsaw. Prosecutors in Lithuania and Poland accuse ten men of planning and executing arson attacks involving parcels, acting on behalf of Russia’s military intelligence service (GRU).One of the incidents involving explosive-laden parcels drew significant attention in Germany. In the early hours of the 20th of July, 2024, at the Leipzig airport, a parcel caught fire just before it was to be loaded onto a DHL cargo plane. A fire did not break out on the plane only because the flight was delayed.All the accused have stated that they were unaware they were working for the GRU, and they deny the terrorism charges. According to investigative documents from the Lithuanian Prosecutor General’s Office, Kovacs is an example of a type of asset increasingly used by Russian intelligence services—what Western intelligence agencies refer to as “low-level” or “disposable” agents. The 63-year-old Kovacs is considered a small cog in a much larger machine. Investigators have indicated that he transported massage cushions from Latvia to Lithuania—cushions that had been modified to conceal incendiary devices.Since the full-scale invasion of Ukraine, it has become increasingly difficult for the GRU to operate in Europe; consequently, the Russians rely on intermediaries who recruit individuals via messaging apps such as Telegram. The motivation is often financial, and these expendable agents carry out specific, isolated tasks—taking a photograph, sending a package, or moving an item from point A to point B. At times, however, the assignments are far more dangerous. Those recruited know little about the broader operation, and anyone who gets caught can simply be replaced. Much has been written about these agents and the shadow war taking place in Europe, yet the question of who these individuals are—and how they became pawns in the new Cold War—typically remains unanswered.Journalists from Politico spoke with Kovacs on several occasions, interviewed his daughter, and examined thousands of pages of investigative documents. Together, these findings reveal a sabotage network where meticulous planning by intelligence services goes hand in hand with human incompetence—and where ordinary people are easily replaceable.In September 2026, Kovacs—who typically reserves his limited phone time for his family—spoke with Politico several times. He stated that he, too, wants to understand how he ended up in prison, adding that the issue concerns not just him, but the broader question of justice. While much of what Kovacs says remains unclear, there is one point on which his account and that of the investigators align: he did, in fact, participate in the transport of a package. Where they diverge is on whether he knew what the package contained, who it was intended for, and who was behind the operation.According to Lithuanian investigative documents, Kovacs’s involvement began on the 27th of June, 2024, when he was contacted via Telegram. He barely knew the person who reached out, but they had been introduced by a mutual friend—Andrei Baburov, a former Russian submarine commander who was also the godfather to Kovacs’s 11-year-old son. The two men had bonded over a shared passion: the sea. Kovacs is a mariner who occasionally earned money by delivering yachts to their owners; he first met Baburov while transporting a yacht from St. Petersburg to Königsberg.The request from Baburov’s acquaintance sounded harmless. The courier had reportedly fallen ill, and Kovacs was asked to retrieve a package from a parcel locker and deliver it urgently to Vilnius—a four-hour drive away. He agreed and, using the provided code, collected the package. Kovacs insists that he received no payment; he claims that when he helps someone he knows, he does so for free. That same day, Kovacs traveled to Vilnius with his nephew. His contact on Telegram specified an underground parking garage as the destination. Kovačs parked the car outside and, leaving it unlocked, walked away with his nephew. When they returned, the package was gone. Kovacs stated that he had gone to buy a charger for his phone.At that point, Kovacs had completed his task, but the operation—which investigators link to the GRU—was only just beginning.Lithuanian investigators have reconstructed the path taken by the devices used in the operation in minute detail, questioning witnesses and suspects, reviewing surveillance camera footage, and analyzing DNA traces. By compiling information from agencies in Lithuania, Latvia, Poland, Estonia, the United Kingdom, and Germany, the criminal investigation files have grown to approximately 8,000 pages. They reveal a convoluted route through the Baltic states, involving a series of intermediaries.Investigators from Poland and Lithuania believe that a Ukrainian man—who had previously served five years in a Russian prison for rape—retrieved a package from Kovacs’s vehicle. In the summer of 2024, he was living in Poland and receiving instructions from an individual via Telegram. He had been promised 4,000 euros per month for carrying out these tasks. The day after retrieving the package from the vehicle, he took it to a vacation rental apartment that had been booked using a false identity. He also possessed cosmetic tubes filled with nitromethane, a substance that can be explosive. Videos filmed inside the Airbnb apartment—recovered from the man’s mobile phone—show four boxes containing massage cushions and cosmetic tubes.According to Lithuanian investigative documents, another intermediary was supposed to collect the packages but could not locate the entrance to the apartment complex. At that point, the Ukrainian’s handler changed the plan and ordered him to activate the devices himself. The Ukrainian refused, and the operation had to be reorganized. Over the next few days, the boxes passed into the hands of several other individuals, and at a certain point, Lithuanian investigators lost track of them. It is believed that the shipments subsequently moved through Moldova. On the 13th of July, 2024, they reappeared in Riga, and Kovacs was brought into the operation for a second time. He once again received a call via Telegram from a friend of Baburov; this time, Baburov himself could reportedly be heard in the background. He was asked to transport high-quality massage pillows to Vilnius, and on the 17th of July, he set off for Vilnius accompanied by his nephew. There, the package was collected by a man who then transported it to Kaunas. On the 18th of July, the package was picked up in Kaunas by another Ukrainian, who had arrived from Poland. He, too, had a criminal past—having been convicted in Poland of cyber-fraud and money laundering—and he received instructions via Telegram from an individual who referred to himself as “Warrior.”A Ukrainian man packed four shipments containing massage pillows, cosmetic packaging filled with a potentially explosive substance, and sex toys—items that investigators believe were included to serve as a distraction. The man set a timer and handed the packages to an individual who had previously failed to gain access to an Airbnb apartment. This intermediary then delivered the packages to a DHL office in Vilnius. They were addressed to Wimbledon (London) and Birmingham.On the 20th of July, at 3:17 a.m., customs officials at Leipzig Airport inspected the package bound for London but found nothing suspicious. The package was slated to be loaded onto a plane headed for London, but at 5:45 a.m., it caught fire while still on the ground. A report by experts from the German Federal Criminal Police Office, dated the 30th of August, 2024, states that the fire was likely set intentionally.On the 22nd of July, 2024, a package caught fire at a warehouse in Birmingham. This shipment had also been inspected in Leipzig and had not raised any suspicions.The same Ukrainian man also sent two packages to Poland via DPD. On the morning of the 21st of July, one of them caught fire inside a truck near Warsaw. Investigators managed to find the second one before it could catch fire.For investigators, the case of the packages serves as an example of how the GRU currently conducts operations in Europe. For years, the GRU sent its own agents to carry out covert operations. However, this has become more difficult following the failed 2018 assassination attempt on Russian double agent Sergei Skripal in the UK, and the full-scale invasion of Ukraine in 2022. Now, the GRU leaves the “dirty work” to others, relying increasingly on recruited individuals who receive orders through several intermediaries.At the top of this scheme, however, remain officers from Russian intelligence services. A Lithuanian report identifies Denis Smolyanov, who used social media for recruitment purposes. The Lithuanian State Security Department considers it highly likely that Smolyanov and two other GRU officers were involved in the operation involving the shipments.Lithuanian investigative documents provide insight into how the system functions. One of the organizers was Baburov, who—leveraging long-standing contacts, including former naval colleagues and acquaintances in the Baltic states—arranged for the transport of the modified massage cushions from Russia. According to the Lithuanian State Security Department, the use of personal contacts in this manner is typical. Recruited individuals are often linked through family or social ties. Many face financial difficulties, are unemployed, or have a criminal past. They are recruited for specific tasks, and they do not always know who is behind the operation—the less the operative knows, the less they can reveal if detained. Furthermore, anyone who is detained can be quickly replaced.Two years after the incidents involving packages, attacks of this nature are becoming an increasing source of concern for European security agencies. In August 2026, two explosive-laden drones detonated at Leipzig Airport, while a third crashed into a Ukrainian cargo plane. An acquaintance of Smolyanov is among the suspects.Shortly after the incident in Leipzig, two Bulgarian nationals planted explosives near defense-sector facilities in Munich. Investigators believe the GRU is behind these events. In Romania, a fire broke out next to an arms factory. In Poland and Bulgaria, Starlink stations were set on fire. The GRU has adapted the “disposable agent” model for use in large-scale operations.Speaking by phone with Politico, Kovacs sounds agitated. He attempts to justify his actions but keeps returning to the same point: he views himself as the victim of a conspiracy, claiming that the Russians deliberately drew him into the operation—thereby making him, a Ukrainian citizen, a convenient scapegoat. Kovacs asserted that European investigators have merely identified the most visible participants, while failing to pursue those who actually directed the operation. He indicated that Baburov had lured him into a trap, though he does not believe his former friend was working for the Kremlin. He claims that Baburov, too, was “thrown under the bus” and is an opponent of the Russian government.Kovacs is reluctant to answer questions about himself, preferring instead to discuss discrepancies in the investigation. He noted that the weight of the cushions he transported did not match the weight of the packages that were subsequently sent; he has compiled detailed notes raising numerous questions. Why are the key figures in the operation being tried in Warsaw rather than Vilnius? What information was withheld from the Lithuanian court? And if the packages passed through Moldova, why were they not inspected at the border? Admittedly, there are matters Kovacs prefers not to discuss—such as a pistol with an obliterated serial number or a mobile phone signal jammer. He maintains that he merely rented the property and that these items did not belong to him.Kovacs’s daughter, 37-year-old Viola Lisija, recounted that her father arrived in Latvia during the collapse of the Soviet Union. Initially, he worked in the forestry sector before venturing into business—buying and selling forests and acquiring shares in Russian companies, including a footwear factory and an ice cream manufacturer. Around 2014, Russian authorities accused Kovacs of spying for Ukraine. He could no longer travel to Russia and was forced to relinquish his stakes in various companies. In Latvia, he earned an income by occasionally transporting yachts from one port to another.Kovacs’s background may help explain why he became of interest to the individuals who organized the shipment operation. He had contacts in Russia, traveled between the Baltic states, and occasionally took on various assignments. Kovacs’s daughter believes that his past conflicts with Russian authorities also made him an easy target. Yet, parts of her father’s life remain shrouded in mystery—even to her. Did he operate within suspicious circles? Lisija has no clear answer to that. She noted that, following the collapse of the Soviet Union, the business world and the criminal underworld were closely intertwined; however, she never saw her father with a weapon, nor did he ever make any remarks suggesting that he was disappearing to engage in anything illicit.
using ordinary people for dirty work
