Polish prosecutors have charged five men — four Ukrainian citizens and one Russian — over an alleged sabotage operation linked to Russia’s intelligence services, involving parcels intended for delivery to the United Kingdom, the United States, Canada, Poland and other destinations.
The National Prosecutor’s Office said the accused acted “on behalf of the intelligence services of the Russian Federation” and targeted logistics and aviation infrastructure. If convicted, they could face sentences up to life imprisonment.
Prosecutors said the alleged method was simple and difficult to detect: small devices hidden inside ordinary consignments and moved through commercial courier networks. The parcels were disguised among items such as massage pillows, cosmetics and sex toys. Three parcels detonated in courier depots in Britain, Germany and Poland in 2024, according to the Polish account.
Poland Detains Saboteurs Sending Incendiary Packages Across EU and UK
The Polish prosecution statement outlined distinct roles. One suspect, identified as Vladyslav D., was accused of planning to prepare parcels containing concealed incendiary devices and explosives, with intended deliveries in Britain and Poland. A second man, Vyacheslav S., was accused of planning further sabotage actions, including sending two “test” parcels to the US and Canada. A third, Vladyslav B., was accused of receiving, storing and transporting parcels, including movements between Vilnius and Kaunas in Lithuania. Prosecutors said they had filed five indictments and the case is now before a court.
Poland is also seeking the extradition of a sixth Russian suspect from Azerbaijan, Reuters reported.
Ukraine’s Foreign Ministry said the suspects were identified and detained in co-operation with Ukrainian authorities, and urged Ukrainians to ignore offers of “easy money” from Russian intelligence approaches.
The “gig economy” problem
Investigators and analysts increasingly describe these cases as a security version of gig work: short, task-based jobs offered at distance, with money as the main lever and limited need for specialist training.
A recent Royal United Services Institute (RUSI) paper argues that Russian sabotage has become organised around “gig-economy” principles, relying on intermediaries and “disposable agents” — often recruited online — to carry out low-cost tasks that create disruption while insulating organisers from exposure.
In practice, the tasks alleged in Poland and elsewhere look like courier-side piecework: preparing parcels, moving them between cities, dropping them at depots, scouting sites, or testing routes. The entry barrier is low; the operational risk is carried by the recruit.
Recruited proxies: examples from other European cases
Lithuania has provided some of the clearest publicly described examples of recruitment-by-payment. In March 2025, Lithuanian prosecutors accused Russia’s GRU military intelligence of orchestrating an arson attack on an IKEA store in Vilnius in May 2024. They said the operation ran through a chain of more than 20 intermediaries, and that two Ukrainian citizens — one under 20 and one under 18 at the time — were offered €10,000 and a used BMW to carry it out. One was detained in Lithuania, the other in Poland, and both were expected to face trial in those countries.
On Friday, Lithuanian authorities announced a separate case, accusing the GRU of orchestrating attempted arson attacks in 2024 on a Lithuanian plant supplying radio-wave scanners to Ukraine’s armed forces. Six people — nationals of Spain, Colombia, Cuba, Russia and Belarus — were arrested and charged, Lithuanian officials said. They added that the group, which included Colombian and Cuban citizens living in Russia, was suspected of similar attacks in Poland, Romania and the Czech Republic, and that those involved were allegedly paid €5,000 to €10,000.
Germany, meanwhile, has described another logistics-centred model: using test parcels to map routes before attempting more destructive shipments. On 13 January 2026, German prosecutors said two Ukrainians had been indicted over an alleged plot carried out on behalf of Russian spy services to detonate packages while they were being transported across Europe. Prosecutors said the suspects sent parcels with GPS trackers from Cologne to Ukraine in March 2025 to study logistics routes, with the aim of later sending packages containing incendiary devices that would ignite in Germany or elsewhere en route, “causing as much damage as possible”.
Romania has also publicly described suspected recruitment and direction. In October 2025, Reuters reported that Poland and Romania detained suspects over an alleged plot involving parcels intended to ignite or explode during transport, and quoted Romania’s intelligence service as saying it had prevented sabotage by two Ukrainian citizens “under direct coordination of some representatives of Russian secret services”, aimed at setting fire to a delivery company office in Bucharest.
Across these cases, the alleged pattern is consistent: recruits offered sums that can look like quick cash; instructions delivered remotely; targets chosen for their role in supply chains, transport nodes and symbolic commercial sites; and organisers kept at distance through layers of intermediaries. Russia has predictably denied involvement in sabotage attacks in Europe.
Russia’s Covert Sabotage Campaign Uncovered: A New Threat to European Security
