Inside the Russian explosives plot that targeted the UK

32 minutes ago

ShareSave

Sarah RainsfordSouthern and Eastern Europe correspondent, Vilnius, Lithuania

ShareSave

Matthew Goddard / BBC

Aleksandr Suranovas has been charged with terrorism in Lithuania

Sex toys, body lotion and massage cushions were not the kind of delivery Aleksandr Suranovas usually handled.

“What?” he messaged, when he was sent a photograph of the items he was being asked to post in four parcels from Lithuania to the UK and Poland.

“It’s what they need, and they’re offering regular work,” the response came over the messaging app Telegram. The pay was decent: €150 (£130/$173) for a couple of hours’ work, so Suranovas agreed. “If that’s what’s needed, fine by me,” he typed back.

But each parcel contained a sophisticated incendiary device. The tubes of cosmetics had been re-filled with a liquid high explosive called nitromethane and the ignition devices were so well hidden inside the cushions even an airport scanner didn’t detect them. Suranovas maintains he had no idea of this.

The parcel contents: Face creams carried explosive liquids and timers hidden inside massage cushions

When he was handed the items in a Vilnius park in July 2024 the timers inside were already counting down. Over the next two days, three of the parcels would go up in flames, one just before it was loaded onto a cargo plane for London. Any later and the consequences could have been disastrous.

That August, Suranovas was arrested and charged with carrying out an act of terrorism on behalf of Russian military intelligence, the GRU. Twenty-two people are now in custody in Lithuania and Poland after an international investigation involving UK counter-terrorism officers. It concluded that the operation was run by Russia, an allegation consistently denied by Moscow. This is the first time anyone involved in the parcel plot has spoken publicly.

Last year, I wrote to several of the suspects in prison as part of my own ongoing investigation into a wave of sabotage attacks across Europe following Russia’s full-scale invasion of Ukraine, that has included arson and derailed trains as well as the parcel plot. Suranovas replied at length and, when he was released on remand recently, agreed to meet.

His account, together with the many case documents I have seen and other sources, give a unique insight into an extraordinary plot that targeted the UK and several other countries, in an apparent attempt to shatter support for Kyiv.They help expose how Russia is now actively recruiting individuals within Europe, accused of increasingly serious attacks.

“I wouldn’t call it a shadow war. I think this is active aggression against our nations,” Vilmantas Vitkauskas, head of Lithuania’s National Crisis Management Centre, warns. “It’s a clear message that those who support Ukraine will be hit by the Russians. I think it’s very dangerous and we are very close to… situations where a lot of people would be suffering.”

The first time Suranovas tried to pick up the parcels - from an Airbnb in Vilnius - he failed to find the flat. Using untrained proxies, as a former European diplomat to Russia puts it, adds “a layer of unpredictability - and incompetence”. But three weeks later, the job was back on.

The apartment block from where Suranovas was initially meant to collect the parcels - but he couldn’t find the correct flat

Suranovas told me he had been hired by an old acquaintance in Russia known as HK, who communicated via Telegram. His instructions, many of which I have seen, were to collect the boxes and send them on to addresses in London, Birmingham and Warsaw using the DHL and DPD courier companies.

The police investigation reveals he was the last link in a long chain, co-ordinated remotely from Russia. Each person had a specific task, from hand-carrying the ignition devices into the EU, to supplying cars. Some seem unaware of the full picture.

Lithuania’s former Defence Minister Dovile Sakaliene says that is Russia’s signature style, designed for deniability.

“The further the proxies who execute certain actions are from the initiators…[and] the more clueless people participating are, the more difficult it is to ensure efficient investigation.”

Even so, investigators have identified several suspected co-ordinators from Russia. One, known as Warrior, is also believed to have organised an arson attack on an Ikea branch in Vilnius in May 2024.

On the rescheduled delivery day, HK greeted Suranovas cheerily by text and told him he was transferring about €500 (£433, $580) for the postage costs, in cryptocurrency. He then forwarded a photograph of a square in central Vilnius. “The man” would meet him there with the parcels, he wrote. Suranovas sounded uneasy.

“Next time, let them use the post office. Meetings like this are not for me,” he typed. “The guy’s neutral. It’s nothing illegal,” HK assured him.

But across town a young Ukrainian, Vladislav Derkavets, was already activating the four incendiary devices, chain-smoking to steady his nerves. He has since been arrested. The case files show that his own handler, Warrior, was sending him instructions via Telegram.

With the timers set, Derkavets was directed to wipe clean everything he had handled. He then packed the massage cushions into boxes with the tubes of liquid explosive, alongside compression tights and vibrators, possibly intended as a distraction. They were now ready to hand over to Suranovas.

Suranovas came to our meeting in central Vilnius wearing an electronic tag on one leg. After 18 months in custody, he is now under “intensive supervision”, only allowed to leave home for a few hours a day until his trial.

Born in then-Soviet Lithuania, the 53-year-old - tall, stocky, talkative - describes himself as ethnically Russian. We spoke in Russian, his first language.

He admits to sending the parcels - he was filmed by CCTV cameras in the offices of DHL and DPD - but insists he had no idea about the devices concealed inside. “I would never have agreed to that, because I think it’s awful,” he told me. “I was used.”

CCTV footage of Suranovas carrying two of the packages at a DHL office in Vilnius

Suranovas was officially unemployed when he was arrested by armed police. But he says he has sold cars to customers in Belarus and Russia for years and picked up a sideline in other deliveries. “People knew me,” he says. “So I’d help them. For a fee.” He mentioned clothes and electronics but was vague on the details.

That is how he first met HK online, he says, but he claims not to know his contact’s name. “We call each other ‘brother’ or ‘mate’,” is all he would give me. I sensed some nerves. “I know he knows where I live,” Suranovas mentioned at one point.

Investigators believe HK is Moldovan, living in Krasnodar, southern Russia, though they haven’t made his identity public. It is the same city where Warrior is reportedly based.

Asked about the allegations in this case, the Russian Embassy in London said there was “nothing resembling credible evidence” of Moscow’s involvement in sabotage operations and dismissed all such claims as an “anti-Russian” narrative.

Suranovas calls the war on Ukraine “idiotic” and tells me he doesn’t like Putin.

But he is most passionate about insisting he would never knowingly have handled explosives. “Not for a million dollars,” he said. “No sum can compensate for your freedom.”

A close relative of his remembers their initial “hysterical laughter” on learning that Suranovas had been accused of terrorism. Then there was shock. “He’s a speculator, he buys and sells,” they told me. “This is really scary.”

Suranovas does already have a criminal record, something he brought up himself, but he consistently downplayed his own role. He has been on bail since 2022 on a fraud charge for a pyramid scheme in Poland with links to Russia, and in 2016 he was convicted in Denmark of attempting to obtain jewellery with stolen credit cards. Suranovas still insists he was just the driver, but I checked the court files and the judge did not believe him. He got 18 months.

I suggested his work in the shadowlands, and the money troubles he mentions, made him an ideal saboteur-for-hire for Russia. “I wasn’t part of this, I don’t work for the GRU,” he shot back. “I am no spy.”

The square in Vilnius where Suranovas was given the parcels

It was a hot summer’s day when Suranovas was driven into Vilnius by his wife to collect the parcels. She pulled up beside the square while he headed for a bench beneath some trees to wait for the courier. HK continued messaging instructions. “He’ll be in shorts,” he wrote. “With 4 boxes.”

The man was late, messed up the codeword and took a photograph of Suranovas as he left. “This is some dodgy shit”, Suranovas fumed to HK in another text.

He insists that he checked repeatedly there was “nothing illegal, nothing banned” in the delivery. In the chat I have seen with HK he asks that directly once. He is also told not to ask too many questions: “then everything will be smooth”.

Suranovas spent about 40 minutes at the DHL office close to Vilnius airport where a member of staff checked every item in his boxes. A tube of cream had split and she sealed it up, unaware the leaking liquid was an explosive.

“There was nothing out of the ordinary at all. No little cables hanging out or anything,” Suranovas says.

His wife then drove him on to DPD to post the remaining two parcels to Warsaw. “There are cameras everywhere. Wouldn’t I have come in a hire car or something? With some kind of beard?” he reasons. He did use a fake name for the sender’s details - to avoid spam, he claims - but stresses that he paid with his own debit card. He says he has been unable to restore access to his account to demonstrate that.

That evening, parcels on their way, HK told him he was getting a bonus. In total, he appears to have been paid €280 (£242, $326).

Suranovas told me the group had plans for more parcels. “They were asking about me sending three or four a month,” he says. He had been due to make another delivery the week he was arrested.

Moscow’s ability to deploy fully-fledged intelligence agents to the field was hugely curtailed after the 2018 Salisbury poisonings, when Russia deployed a nerve agent. The UK, EU and US expelled so many Russian agents then, a former European diplomat tells me they did “systematic damage” to Russia’s spy capacity.

That is when Moscow began recruiting people within Europe to do its dirty work. I have seen some cases where they have been hooked through harmless-sounding job offers on Telegram. But in the parcel plot, many were brought in by acquaintances in criminal networks.

“Russia is ramping up its operations so they’re turning to this model of contracting organised crime. It’s something they’ve done prolifically inside Russia for years,” says Elijah Glantz, from the Royal United Services Institute (RUSI) security think tank.

The man who handed the parcels to Suranovas has a fraud conviction in Poland. Another suspect, who supplied vehicles, is under investigation for car theft across Europe. A third, who handled the explosives, served time for rape.

“There is a litany of online groups willing to do just about anything for the right price - and that’s what we’re seeing,” Glantz says. He points out that in organised crime operations, groups do not disclose full details of a job and those hired “very often” have limited information. “One question smugglers will never ask is: ‘What’s in the lorry?’ It’s kind of the way it goes.”

On 20 July, the first parcel Suranovas had posted burst into flames at Leipzig airport in Germany. It was the package bound for London, about to be placed on a DHL cargo flight. A second device went off before dawn the next day in a DPD truck just outside Warsaw, and one malfunctioned. The last ignited at a DHL warehouse in Birmingham.

No-one was hurt, but the damage was extensive.

The incidents were not publicised at first as investigators across Europe went to work, and the Telegram chat shows the Russian handlers were unsure what had happened. HK wanted Suranovas to call DHL and ask why a parcel had stalled in Leipzig.

Meanwhile, other deliveries continued. Two more suspicious parcels were sent from Warsaw to the US and Canada, then another two from Amsterdam to the same addresses. There were no explosives this time, so it is thought the group was testing new routes.

Investigators cannot be sure whether Russia’s ultimate aim was to bring down a plane, or to intimidate and sow fear in countries aiding Ukraine. But the White House was so concerned it contacted Russia “at a high level”, a former senior official under President Biden has told the BBC. The message went out to “knock it off” or face “consequences”.

Dovile Sakaliene, the former Defence Minister in Vilnius, remembers thinking the parcel plot was a wake-up call for Lithuania’s allies. “Because… not everybody was on board about the level of the threat we are facing through hybrid attacks.”

When Lithuanian police began rounding up members of the parcel plot they discovered a further cache of explosives, buried in food cans at a cemetery. There were drone parts, too, including mounts the cans could fit on.

Towards the end of our interview, I asked Suranovas what he thought Russia had wanted to achieve. He paused a moment.

“I think… it was probably a test of something; that they were preparing something bigger,” he said. “It was to show that their arms can reach deep and far. That they can do many things, and you won’t even know.”

Europe

Russia

Poland