Courier at center of explosive parcel plot says he was
Aleksandr Suranovas, a Lithuanian-based courier, says he had no idea the packages he posted to the UK and Poland contained hidden explosives.
The parcels, disguised as toiletries and massage cushions, turned out to contain sophisticated incendiary devices that later ignited at several European hubs.
Suranovas says he was offered work through Telegram and accepted because the pay — roughly €280 in total — seemed reasonable for a few hours of effort. He maintains he believed he was sending harmless goods and would never have agreed to handle anything dangerous knowingly.
Investigators say the cosmetics tubes were filled with nitromethane, a powerful explosive, and that ignition mechanisms were concealed so well they escaped routine screening.
Over three days in July, packages combusted at Leipzig airport, in a DPD truck near Warsaw, and at a DHL facility in Birmingham, damaging property but causing no injuries. Lithuanian and Polish police have arrested 22 people in connection with the scheme.
Authorities allege the operation was orchestrated remotely from Russia and run through a network of handlers and couriers.
Moscow has repeatedly denied involvement. Court documents and messages reviewed by journalists show the operation used layered roles: operatives smuggled components into the EU, others prepared devices, and local couriers dropped parcels into courier networks.
Some participants appear to have known only part of the plan.
Two alleged handlers are identified in case files by online handles — HK and Warrior — who reportedly coordinated instructions via Telegram. Investigators believe some coordinators are based in southern Russia, though identities have not been publicly confirmed.
Suranovas describes his contact with HK as informal and says he referred to him as "brother." He was filmed at DHL and DPD offices while posting packages and says staff checked items before dispatch without spotting anything suspicious.
He used a false sender name, he says, but paid postage with his own bank card. After the first package ignited at Leipzig just before being loaded onto a cargo flight, investigators launched a wider probe.
Further suspicious parcels were later sent on transatlantic routes, apparently as route tests, and police found additional explosives and drone parts hidden in a cemetery.
Lithuania's security officials and analysts say the scheme fits a pattern in which Russia increasingly relies on criminal networks and local contractors to carry out sabotage, a shift they link to the fallout from earlier diplomatic expulsions that reduced Moscow's on-the-ground spy presence. Security experts warn the tactic gives deniability while allowing operations to reach deep into Europe.
A former EU diplomat said using untrained intermediaries increases unpredictability and complicates investigations, but it also helps mask the origin of orders.
Suranovas, 53, has a criminal past that includes fraud allegations and a prior conviction in Denmark for payment card offenses. He is now free under strict supervision with an electronic tag while awaiting trial on terrorism-related charges.
He insists he was only a delivery man and denies working for Russian intelligence.
Authorities say the plot may have aimed either to cause catastrophic damage or to intimidate countries supporting Ukraine. U.S.
officials reportedly warned Moscow to stop such operations after the incidents drew international alarm.
The parcel attacks are part of a wider wave of sabotage across Europe since Russia's invasion of Ukraine, including arson and rail disruptions. For now, investigators continue to piece together the chain of command that turned ordinary courier routes into a channel for hidden explosives.
Suranovas says he fears what the operation might have become if the timers had not failed and stresses he would never have taken part had he known the true nature of the cargo.
His case is set to test how European courts handle transnational plots that combine criminal networks and geopolitical aims.
The parcels, disguised as toiletries and massage cushions, turned out to contain sophisticated incendiary devices that later ignited at several European hubs.
Suranovas says he was offered work through Telegram and accepted because the pay — roughly €280 in total — seemed reasonable for a few hours of effort. He maintains he believed he was sending harmless goods and would never have agreed to handle anything dangerous knowingly.
Investigators say the cosmetics tubes were filled with nitromethane, a powerful explosive, and that ignition mechanisms were concealed so well they escaped routine screening.
Over three days in July, packages combusted at Leipzig airport, in a DPD truck near Warsaw, and at a DHL facility in Birmingham, damaging property but causing no injuries. Lithuanian and Polish police have arrested 22 people in connection with the scheme.
Authorities allege the operation was orchestrated remotely from Russia and run through a network of handlers and couriers.
Moscow has repeatedly denied involvement. Court documents and messages reviewed by journalists show the operation used layered roles: operatives smuggled components into the EU, others prepared devices, and local couriers dropped parcels into courier networks.
Some participants appear to have known only part of the plan.
Two alleged handlers are identified in case files by online handles — HK and Warrior — who reportedly coordinated instructions via Telegram. Investigators believe some coordinators are based in southern Russia, though identities have not been publicly confirmed.
Suranovas describes his contact with HK as informal and says he referred to him as "brother." He was filmed at DHL and DPD offices while posting packages and says staff checked items before dispatch without spotting anything suspicious.
He used a false sender name, he says, but paid postage with his own bank card. After the first package ignited at Leipzig just before being loaded onto a cargo flight, investigators launched a wider probe.
Further suspicious parcels were later sent on transatlantic routes, apparently as route tests, and police found additional explosives and drone parts hidden in a cemetery.
Lithuania's security officials and analysts say the scheme fits a pattern in which Russia increasingly relies on criminal networks and local contractors to carry out sabotage, a shift they link to the fallout from earlier diplomatic expulsions that reduced Moscow's on-the-ground spy presence. Security experts warn the tactic gives deniability while allowing operations to reach deep into Europe.
A former EU diplomat said using untrained intermediaries increases unpredictability and complicates investigations, but it also helps mask the origin of orders.
Suranovas, 53, has a criminal past that includes fraud allegations and a prior conviction in Denmark for payment card offenses. He is now free under strict supervision with an electronic tag while awaiting trial on terrorism-related charges.
He insists he was only a delivery man and denies working for Russian intelligence.
Authorities say the plot may have aimed either to cause catastrophic damage or to intimidate countries supporting Ukraine. U.S.
officials reportedly warned Moscow to stop such operations after the incidents drew international alarm.
The parcel attacks are part of a wider wave of sabotage across Europe since Russia's invasion of Ukraine, including arson and rail disruptions. For now, investigators continue to piece together the chain of command that turned ordinary courier routes into a channel for hidden explosives.
Suranovas says he fears what the operation might have become if the timers had not failed and stresses he would never have taken part had he known the true nature of the cargo.
His case is set to test how European courts handle transnational plots that combine criminal networks and geopolitical aims.
