Russian Saboteurs Sent Exploding DHL Packages in Europe via Riga
One of the packages sent by Russian intelligence services caught fire in Birmingham. Its route also went through Riga. Source: The Guardian
Re:Baltica uncovers the path of the sabotage packages masterminded by Russian special services through Latvian capital Riga and their coordinator with at least two forged passports. The Latvian non-citizen, who was arrested for delivering the packages to Vilnius, could face a life sentence.
In July 2024, a series of mysterious incidents shook Europe. In Germany, Great Britain, and Poland, packages sent by international cargo carriers burst into flames within days of each other. The electronic neck massagers found in the shipments turned out to have a built-in self-ignition mechanism. They were part of a Russian-organized sabotage operation whose goal was to intimidate Westerners and diminish support for Ukraine.
Until now, it was believed that the dangerous packages were sent from Vilnius. Now, Re:Baltica together with its partners – Lithuanian public broadcaster LRT, Russia’s The Insider, Estonia’s Delfi, and Poland’s Frontstory – using documents from NATO state security services and interviews with relatives of the perpetrators, show for the first time that these packages also traveled through Riga. In fact, they circulated undetected across the borders of various European countries for nearly a month.
Our investigation not only reveals the route of the packages but also identifies the person who coordinated this and other sabotage operations in Europe, as well as planned similar diversions in the USA and Canada. To do this, this Russian citizen with a criminal past traveled through Europe with at least two forged Ukrainian passports and recruited perpetrators, or so-called “disposable agents,” on the Telegram platform.
Observed by Drones Before Arrest
This March, a scene worthy of a thriller unfolded at a rural property in the Vidzeme region in Latvia. More than ten masked men from the State Security Service (VDD) broke down the gate and arrested Latvian non-citizen Vasilijs Kovačs (62). The Lithuanian Prosecutor General’s Office requested the arrest. The Vilnius court had issued the arrest warrant back in December. The security services had likely been observing the property in the interim, as Kovačs’s neighbors had noticed drones flying above it. One of them even installed video surveillance cameras, fearing burglars.
Simultaneously with Kovačs’s arrest, his sister’s sons — both in their twenties — Roman and Vadim Borsuk from Ukraine, were taken off an intercity bus in Vilnius and arrested. They and their mother had come to Latvia to escape the war. Lithuanian investigators believe that the brothers and Kovačs repeatedly transported packages intended for sabotage from Riga to Vilnius in June and July 2024.
Later in Riga, pensioner Alexander Katser, a former submarine helmsman who was another link in the package delivery chain, was also arrested.
When the Commander Asks
The Latvian branch of the DHL package sabotage scheme stood out for its recruitment method. Russian special services usually used anonymous Telegram contacts, but this time they recruited through acquaintances from the Soviet army.
The story begins in the summer of 2024, when a fellow serviceman called Andrey Baburov, a former submarine fleet officer in St. Petersburg. He had spoken with their former submarine commander, who asked him to find someone in Riga who could pick up a package from a bus and deliver it to his relatives in Vilnius.
In a phone interview with Re:Baltica, Baburov said he couldn’t refuse because “the commander asked.” He contacted Kovačs, who lives in Latvia and whose son is his godson. An old friendship bound the two.
Kovačs initially hesitated but eventually agreed to help. However, on the day the package was to be sent, he didn’t answer his phone. As it later turned out, he had been in a motorcycle accident.
In a hurry, Baburov brought in another former fleet comrade, now a pensioner living in Riga, Alexander Katser. From other sources, Re:Baltica learned that he sent sentimental photos from their service days to convince his comrade. It worked. Katser agreed. His relative collected the package at the Riga bus station and later handed it over to Kovačs, who had reappeared.
Together with his nephews, Kovačs delivered the package to Vilnius.
In a phone interview with Re:Baltica, Baburov justified his actions by saying he felt guilty about what happened and didn’t want to get Kovačs into trouble. The Lithuanian police have also issued an international warrant for Baburov.
Publicly available information shows that Baburov is a former captain of the USSR Northern Fleet submarine. Since the early 1990s, he has run his logistics company, Baltic Escort, in St. Petersburg. Lately, it has been offering clients help in circumventing Western sanctions, promising an “individual approach.”
It is no longer possible to contact the commander, who could have been the starting point of the recruitment chain — he died of cancer earlier this year. Kovačs himself did not serve in the Soviet fleet but knows how to operate small-sized ships. More on that later.
Delivered Twice
Baburov’s story initially sounds logical — a former comrade simply helping out a friend. But Re:Baltica and its partners uncovered a crucial detail he failed to mention.
The arrested Kovačs and his nephews delivered the packages to Vilnius not once, but twice.
Kovačs also confirmed this fact to Re:Baltica through a family member. The relative requested anonymity as the family is still in shock over the events. Kovačs stated that he agreed to help because he trusted Baburov. The former captain had once provided shelter to orphans, which led Kovačs to consider him “a good person.”
By compiling information from several sources, the following chain of events emerges.
The first package arrived in Latvia via the Estonian postal service Omniva. An unknown individual sent it from Narva, a city on the border of Estonia and Russia, on June 24, 2024. In the Latvian capital of Riga, Kovačs picked it up on June 27 and, together with his nephews, took it to Vilnius.
Kovačs claims he never saw the recipient. He went to charge his phone in Vilnius and left the car unlocked so the recipient could retrieve the package from the trunk. And that is precisely what happened.
Lithuanian investigators believe that on that day, the package was picked up by a Ukrainian citizen, Vyacheslav Chebanenko, nicknamed Doughnut due to his stout build. He had previously spent five years in a Russian prison for beating his wife and mother-in-law, according to The Guardian. The next day, Doughnut activated the package’s ignition devices in a rented apartment. They were supposed to be collected by a Lithuanian citizen, Alexander Shuranov, who was once involved in one of the largest pyramid schemes in Poland.
This time, the task was simple—collect the packages and send them to Great Britain and Poland. However, Shuranov got lost and couldn’t find the correct address. Ponchik received an order to return to the apartment and deactivate the devices. Later, he handed the package over to a Ukrainian recruited on a Telegram channel, who delivered it to Poland by car. A few days later, the package, by means unknown to us, ended up in Moldova. From there, it traveled back to Riga for the second time — this time by bus.
It arrived at the bus station on the night of July 12. It was planned that Kovačs would collect it this time as well. Since he allegedly did not answer his phone due to an accident, a relative of another submarine fleet veteran, Katser, got involved and later handed it over to Kovačs’s nephew.
On July 17, together with his nephews, Kovačs delivered the second package to Vilnius. They stopped by the side of the road, where a man and a young woman were waiting for them. She took a photo of their car (most likely for a report to their handlers). Investigators believe the package was picked up from the side of the road by the same Ukrainian recruited via Telegram. He took it in his Lexus to Kaunas and left it, along with the car, at some garages.
As far as Re:Baltica knows, the package contained four black electronic neck and shoulder massagers with a built-in self-ignition charge, tubes of body care products with nitromethane, and two mobile phones.
On July 19, another Ukrainian recruited via Telegram, Vladislav Derkavets, arrived at the garages to pick up the shipment. He took it to Vilnius, where he personally activated the self-ignition charges placed inside the massagers in the city center. He later brought them to the Stay Express hotel, where he packed them into four separate boxes.
The next day, July 20, Derkavets handed the packages over to the Lithuanian man, Shuranov. On the same day, Shuranov, using a fake name, sent two of the packages via DHL to Great Britain and the other two to Poland. The rest of the story has been widely reported — the first package, on its way to Great Britain, burst into flames the next morning in Leipzig; the next one near Warsaw; and the third in Birmingham. The Polish security services intercepted the fourth.
Sabotage Coordinated from the “Aquarium”
This branch, which began in Latvia and primarily united former Soviet submarine fleet members, was part of a major sabotage operation by the Russian military intelligence service (GRU). It was coordinated through Telegram channels, where two profiles were of crucial importance: Jarik Deppa and Warrior. Re:Baltica partners have found out who is hiding behind these pseudonyms.
With a strong build, a crew cut, and deep-set eyes, that is what 37-year-old Russian citizen Yaroslav Mikhailov looks like. He used the Jarik Deppa account. He traveled across Europe with at least two forged passports. It is known that the Russian Federal Security Service (FSB) had been searching for him since 2015 for smuggling weapons, explosives, or radioactive materials. In 2022, he was arrested and, most likely, recruited. Mikhailov is currently a fugitive from Lithuanian investigators and is possibly in Azerbaijan.
European security services believe that Mikhailov also directed the attempt to set fire to an IKEA store in Vilnius from his Telegram account last spring. A minor Ukrainian citizen was recruited for the arson in Vilnius; after starting the fire, he was on his way to Riga to commit a similar crime there. He was arrested en route by Lithuanian investigators.
However, Mikhailov was not the author of these acts of sabotage. Decisions were made at a higher level—in a glasshouse on the outskirts of Moscow, nicknamed the “aquarium.” From here, the second Telegram account involved in the sabotage, Warrior, is controlled, according to sources in European special services. It was Warrior who gave the orders to Derkavets, who activated the firebombs in Vilnius.
A special unit of Russia’s military intelligence service (GRU), established in 2023, operates out of the “aquarium.” Following Russia’s invasion of Ukraine, many Western countries massively expelled staff from Russian diplomatic missions, including intelligence officers who operated under diplomatic cover. This caused the Kremlin to lose its agent networks in Europe, so it began to rely heavily on remote recruitment, primarily through Telegram channels. It started involving short-term and easily replaceable “disposable” agents in its operations. Re:Baltica has already written about a similar case.
This GRU unit is engaged in planning diversions in the West. The Associated Press news agency has estimated that since 2022, Russia has been linked to at least 60 sabotage attempts in Europe — from fires at strategically important facilities to cyberattacks and military intelligence operations.
Among its most prominent officers are Denis Smolianinov and Vladimir Lipchenko. According to the London-based Russian opposition analysis center, Dossier Center, Lipchenko led the attempt to set fire to the Museum of the Occupation in Riga in 2024. International media reports that Lipchenko and Smolianinov also coordinated the DHL package sabotage operation.
The goal of the operation was twofold: to cause panic and test the security of logistics chains. Russian intelligence services wanted to find out how effectively customs and border control, as well as courier and parcel locker systems, operate when dangerous shipments enter them. In parallel with the firebomb operation in Europe, the service carried out another operation, sending packages without explosives from Poland to the USA and Canada. The Polish Prosecutor’s Office is currently investigating both operations.
The Enigmatic Kovačs
If the Lithuanian Prosecutor’s Office proves Kovačs’s guilt in court, he could face a life sentence. He is suspected of participating in the organized activities of a terrorist group, which carries a sentence of 20 years to life in prison.
Kovačs denies his guilt and insists that the case against him is fabricated.
However, he does not seem like an ordinary Latvian citizen who goes to work every day and fishing on weekends.
There is little public information about him. Kovačs has no social media profiles, and he owns no property. Unlike the other individuals involved in the Latvian branch of the operation, he did not serve in the Soviet submarine forces. Internet archives turn up only two pieces of information about him. In 2007, he participated in a rally, but professionals familiar with the motorsport scene told Re:Baltica that they do not remember him. Fifteen years ago, the regional newspaper reported that the Speaker of the Parliament had awarded him a commemorative medal for his participation in the 1991 Barricades — a series of non-violent protests where Latvian civilians defended strategic locations against the Soviet military. Kovačs was among the recipients.
Re:Baltica learned that Kovačs arrived in Latvia from Ukraine in the 1980s to work in construction. He started a family here. After Latvia regained independence, he established a business related to trade in Russia. A family member says that about 15 years ago, Kovačs wanted to sell it but was no longer allowed into Russia, and his business was illegally taken from him there. Re:Baltica was unable to confirm this, as documents from that far back are not available in Russian company databases.
The Lursoft database shows that from 2006 to 2016, Kovačs held shares in the Latvian company Covertt Baltija, which listed its business activity as trading in electronics and telecommunications equipment. He also manages a horse farm that belongs to a relative. Periodically, Kovačs earned income as a captain, transporting small-sized ships from Spain to Cuba, Cape Verde in the Atlantic Ocean, and Mallorca.
According to a relative, Kovačs has always been physically active with a wide range of interests. Before his arrest, he rode sport motorcycles several times a week. A photograph that Re:Baltica saw but which the family declined to publish shows a medium-height, athletic man with dark hair and a trim beard.
But there is another strange detail in the case that does not reflect well on Kovačs.
During a search of his home, the VDD found a pistol with a filed-off serial number under the kitchen sink among dishwasher pods. Investigators also confiscated an item that resembled a mobile signal-jamming device.
The case files on the murder of the Latvian criminal authority Gennady Valyagin were also found during the search. Valyagin was shot in a residential district in capital Riga in 2022, and two Lithuanian citizens were convicted of his murder. According to Kovačs’s version of events, someone left the materials in his home mailbox in the hope that he could “help.” How exactly? Kovačs cannot logically explain. He also claims he does not know how the pistol ended up in the kitchen.
Kovačs is the only person involved in the Latvian branch who remains in custody. Lithuanian investigators released his nephews after a few months. This summer, the pensioner Katser, whose relative collected the package from the bus in Riga at midnight, was also released from custody.
The Latvian Security Service (VDD) confirmed to Re:Baltica that, at the request of their Lithuanian colleagues, they had detained Kovačs and searched locations associated with him. The VDD declined to provide more information, as the case is under the jurisdiction of the Lithuanian Prosecutor’s Office. Lithuanian investigators also refused to comment, but on the eve of this cross-border investigation’s publication, they issued their own press release instead of answering our questions. In it, they provided general information about the investigation, creating the impression that they conducted the operation on their own. We know that Polish special services also made a significant contribution to solving the case.
INDEPENDENT JOURNALISM NEEDS INDEPENDENT FINANCING If you like our work, support us! LV38RIKO0001060112712
