Law enforcement agencies from Ukraine and several European states have disrupted an alleged Russian-directed network suspected of preparing contract killings, sabotage and provocations in the European Union, according to Ukrainian and Lithuanian authorities.
Ukraine’s Office of the Prosecutor General said on Monday that prosecutors, National Police investigators and foreign law enforcement partners had carried out an international operation targeting a group allegedly acting in the interests of Russian special services. The Ukrainian prosecutor’s office said the network had been active since August 2024, using intermediaries, false documents and financial channels designed to conceal the origin of funds.
One of the principal alleged operations concerned planned contract killings in Lithuania. According to Ukrainian prosecutors, members of the group conducted prolonged covert surveillance of two intended targets: a Russian civic activist who had left Russia and obtained political asylum in Lithuania, and a Lithuanian citizen known for supporting Ukraine. Investigators said the suspects collected information on their homes, travel routes, daily routines and other details needed to prepare an attack.
Lithuanian authorities have charged 13 people from several countries over two attempted murders in Vilnius, which police said were linked to Russia’s GRU military intelligence agency. According to Reuters, Lithuanian criminal police chief Saulius Briginas said the investigation had identified the suspects as acting in the interests of the GRU. Moscow has generally denied involvement in sabotage and covert operations attributed to Russian intelligence services.
The suspected network allegedly drew in nationals of Ukraine, Russia, Belarus, Georgia, Latvia, Moldova and Greece. Ukrainian prosecutors said different members had separate functions, including surveillance, recruitment of potential attackers, logistics, communications and financing. Some alleged participants were recruited through intermediaries, including among people with criminal backgrounds.
The Ukrainian Prosecutor General’s Office said an attempted killing in Lithuania had been prevented. Some alleged perpetrators were detained, while others reportedly withdrew from participation. One suspect was arrested while preparing an attack. Subsequent analysis of mobile devices and other investigative material allegedly showed that the network’s activities extended beyond Lithuania and included possible sabotage and provocation plans in other European countries.
According to the Ukrainian authorities, members of the group gathered information in one EU state on military facilities and equipment prepared for transfer to Ukraine. In another country, they allegedly examined scenarios involving provocations and arson attacks on infrastructure. Prosecutors also said sabotage activity had been recorded at a military enterprise.
The investigation also concerns possible violent acts against military and public figures in Ukraine. Ukrainian officials said dozens of people had been involved in carrying out tasks for the network, whose activity covered several European countries.
As part of the international operation, arrests and searches were conducted in EU territory. Lithuanian law enforcement agencies have notified 13 people of suspicion; nine have been detained, while European arrest warrants have been issued for four others. Three suspects detained abroad have already been transferred to Lithuania, and transfer procedures are continuing in relation to two more people.
The case forms part of a wider pattern of European investigations into alleged Russian covert activity since the start of Moscow’s full-scale invasion of Ukraine. Lithuanian authorities in January accused Russia’s GRU of organising attempted arson attacks in 2024 against a plant supplying equipment to Ukraine’s military. Reuters reported that suspects in that case came from several countries and that alleged associated operations also touched Poland, Romania and the Czech Republic.
European authorities have also investigated explosive parcel incidents in courier networks. In March, Reuters reported that investigators had identified 22 suspects allegedly linked to parcel bomb attacks in Europe in 2024, with Lithuanian prosecutors charging five people with terrorism. The investigation involved Germany, Poland, the Netherlands, Britain and Lithuania, and concerned devices sent from Vilnius that ignited or detonated in courier facilities in several countries.
The latest case underlines the growing security focus on low-cost covert operations, including surveillance, arson, recruitment of criminal intermediaries and attacks on infrastructure connected to military aid for Ukraine. Ukrainian prosecutors said international cooperation in the case is continuing, with investigators seeking to establish the full list of participants, their links and any additional episodes of criminal activity.
Image source: Prosecurot Genera’s office.
Poland and Romania foil alleged parcel-borne sabotage scheme linked to Russian intelligence
