For Aleksandr Suranovas, the task of shipping sex toys, body lotion, and massage cushions was an unusual one, far removed from his typical deliveries.
He queried the unusual cargo via a messaging app, receiving the reply that this was “what they need, and they’re offering regular work.” The compensation, €150 (approximately £130 or $173) for a couple of hours’ effort, was enough for Suranovas to agree. “If that’s what’s needed, fine by me,” he typed back.
However, each parcel concealed a sophisticated incendiary device. Cosmetics tubes had been refilled with nitromethane, a liquid high explosive, and the ignition mechanisms were ingeniously hidden within cushions, evading detection even by airport scanners. Suranovas maintains he was unaware of their true contents.
Upon receiving the items in a Vilnius park in July 2024, the timers within the devices were already counting down. Over the subsequent two days, three of these parcels would ignite, one just moments before being loaded onto a cargo plane bound for London. Had the timing been any different, the consequences could have been catastrophic.
In August of that year, Suranovas was apprehended and charged with orchestrating an act of terrorism on behalf of Russia’s military intelligence agency, the GRU. An extensive international investigation, involving UK counter-terrorism officers, has led to twenty-two individuals now being held in custody in Lithuania and Poland. The operation was concluded to be directed by Russia, an accusation consistently denied by Moscow.
Firsthand Account of the Parcel Plot
This marks the first time an individual implicated in the parcel plot has spoken publicly about their involvement.
The previous year, as part of an ongoing investigation into a series of sabotage attacks across Europe following Russia’s full-scale invasion of Ukraine—incidents that included arson and derailed trains—I contacted several suspects imprisoned at that time. Suranovas provided a lengthy response and, following his recent release on remand, agreed to an interview.
His testimony, corroborated by numerous case documents and other sources I have reviewed, offers a unique perspective on an extraordinary scheme targeting the UK and several other nations, seemingly in an effort to undermine support for Kyiv. These accounts shed light on how Russia is now actively recruiting individuals within Europe, who are subsequently accused of increasingly serious acts of sabotage.
“I wouldn’t refer to it as a shadow war. In my view, this is active aggression against our nations,” stated Vilmantas Vitkauskas, the head of Lithuania’s National Crisis Management Centre. “It sends a clear message that those who support Ukraine will face repercussions from the Russians. I believe it’s highly perilous, and we are very close to situations where numerous people could suffer.”
Exploiting Proxies and Incompetence
The initial attempt by Suranovas to collect the parcels, from an Airbnb in Vilnius, proved unsuccessful as he could not locate the designated flat. Using untrained proxies, as a former European diplomat to Russia noted, introduces “a layer of unpredictability—and incompetence.” Despite this setback, the operation was revived three weeks later.
Suranovas explained that he was hired by an old acquaintance in Russia known only as HK, who communicated exclusively via Telegram. The instructions, many of which I have examined, directed him to collect the packages and dispatch them to addresses in London, Birmingham, and Warsaw using courier services DHL and DPD.
The police investigation revealed that Suranovas was the final link in a protracted chain of command, coordinated remotely from Russia. Each participant had a distinct role, ranging from transporting ignition devices into the EU to supplying vehicles. The degree of awareness among these individuals regarding the full scope of the operation appears to vary.
Dovile Sakaliene, Lithuania’s former Minister of National Defence, identified this decentralized approach as a characteristic tactic of Russia, designed to facilitate plausible deniability.
“The further the proxies carrying out certain actions are from the initiators… [and] the more clueless the individuals involved are, the more challenging it becomes to ensure an effective investigation.”
Nevertheless, investigators have managed to identify several suspected coordinators from Russia. One individual, identified as “Warrior,” is also believed to have been involved in organizing an arson attack on an Ikea store in Vilnius in May 2024.
The Meeting and the Devices
On the rescheduled delivery day, HK sent Suranovas a cheerful text message, informing him of a cryptocurrency transfer of approximately €500 (around £433 or $580) to cover postage costs. He then forwarded a photograph of a public square in central Vilnius, stating that “The man” would meet him there with the parcels. Suranovas expressed unease in his reply.
“Next time, let them use the post office. Meetings like this are not for me,” he typed. HK reassured him: “The guy’s neutral. It’s nothing illegal.”
Meanwhile, across town, a young Ukrainian named Vladislav Derkavets was activating four incendiary devices, chain-smoking to calm his nerves. Derkavets has since been arrested. Case files indicate that his handler, Warrior, was relaying instructions to him via Telegram.
With the timers set, Derkavets was instructed to thoroughly clean any surfaces he had contacted. He then packed the massage cushions into boxes alongside tubes of liquid explosive, compression tights, and vibrators, which may have been intended as a diversion. The parcels were then ready for handover to Suranovas.
Suranovas’s Account and Criminal History
Suranovas arrived at our meeting in central Vilnius wearing an electronic monitoring tag on one leg. After eighteen months in detention, he is currently under “intensive supervision,” permitted to leave his residence only for a few hours daily until his trial.
Born in what was then Soviet Lithuania, the 53-year-old Suranovas—described as tall, stocky, and talkative—identifies as ethnically Russian. Our conversation took place in Russian, his native language.
He admits to sending the parcels, with CCTV footage confirming his presence at DHL and DPD offices. However, he vehemently denies any knowledge of the concealed devices. “I would never have agreed to that, because I think it’s awful,” he told me. “I was used.”
At the time of his arrest by armed police, Suranovas was officially unemployed. He stated that he had been selling cars to clients in Belarus and Russia for years, supplementing his income with other delivery services. “People knew me,” he said. “So I’d help them. For a fee.” He vaguely mentioned clothing and electronics but provided few specifics.
This is how he initially encountered HK online, he claims, though he maintains he does not know his contact’s real name. “We call each other ‘brother’ or ‘mate’,” was all he offered, betraying some nervousness. “I know he knows where I live,” Suranovas remarked at one point.
Investigators believe HK to be Moldovan, residing in Krasnodar, southern Russia, though his identity has not been publicly disclosed. This is reportedly the same city where Warrior is based.
When questioned regarding the allegations in this case, the Russian Embassy in London asserted that there was “nothing resembling credible evidence” of Moscow’s involvement in sabotage operations, dismissing all such claims as an “anti-Russian” narrative.
Suranovas referred to the war in Ukraine as “idiotic” and expressed his dislike for Putin.
However, he is most emphatic about his refusal to handle explosives knowingly. “Not for a million dollars,” he stated. “No sum can compensate for your freedom.”
A close relative recalled their initial “hysterical laughter” upon learning of Suranovas’s terrorism charges, followed by shock. “He’s a speculator, he buys and sells,” the relative told me. “This is really scary.”
Suranovas does have a prior criminal record, a fact he voluntarily brought up, but he consistently downplayed his involvement. Since 2022, he has been on bail for a fraud charge related to a pyramid scheme in Poland with Russian connections. In 2016, he was convicted in Denmark for attempting to obtain jewelry using stolen credit cards. Suranovas maintains he was merely the driver, but court records show the judge did not accept his testimony, resulting in an 18-month sentence.
When I suggested that his precarious financial situation and involvement in clandestine activities might have made him a suitable candidate for Russia’s network of hired saboteurs, he retorted, “I wasn’t part of this, I don’t work for the GRU. I am no spy.”
The Handover and the Deception
On a sweltering summer day, Suranovas’s wife drove him to Vilnius to collect the parcels. She stopped the car near the designated square while he proceeded to a bench under some trees to await the courier. HK continued sending instructions via text. “He’ll be in shorts,” he wrote. “With 4 boxes.”
The individual was late, miscommunicated the codeword, and then took a photograph of Suranovas as he departed. “This is some dodgy shit,” Suranovas fumed in another text to HK.
He insists that he repeatedly verified that the delivery contained “nothing illegal, nothing banned.” In the chat log with HK that I have reviewed, he directly asks this question once. He is also instructed not to ask too many questions: “then everything will be smooth.”
Suranovas spent approximately 40 minutes at a DHL office near Vilnius Airport, where a staff member inspected all items in his boxes. One tube of cream had split, and the employee resealed it, unaware that the leaking liquid was an explosive.
“There was nothing out of the ordinary at all. No little cables hanging out or anything,” Suranovas stated.
His wife then drove him to a DPD location to post the remaining two parcels to Warsaw. “There are cameras everywhere. Wouldn’t I have come in a hire car or something? With some kind of beard?” he reasoned. He admits to using a fake sender’s name, claiming it was to avoid spam, but emphasizes that he paid with his own debit card. He states he has been unable to regain access to his account to provide proof of this.
That evening, with the parcels en route, HK informed him he would receive a bonus. In total, he apparently received €280 (approximately £242 or $326).
Suranovas told me the group had plans for further shipments. “They were asking about me sending three or four a month,” he said. He was scheduled to make another delivery the week he was arrested.
Russia’s Recruitment Strategy
Moscow’s capacity to deploy seasoned intelligence agents into the field was significantly hampered following the 2018 Salisbury poisonings, where Russia employed a nerve agent. The subsequent expulsions of numerous Russian agents by the UK, EU, and US, according to a former European diplomat, inflicted “systematic damage” on Russia’s intelligence capabilities.
This period marked a shift for Moscow, prompting it to begin recruiting individuals within Europe to carry out its clandestine operations. I have encountered cases where individuals were ensnared through seemingly innocuous job advertisements on Telegram. However, in the parcel plot, many were recruited through existing contacts within criminal networks.
“Russia is escalating its operations, leading them to adopt this model of contracting organized crime. This is something they have extensively practiced within Russia for years,” commented Elijah Glantz of the Royal United Services Institute (RUSI) security think tank.
The individual who handed the parcels to Suranovas has a fraud conviction in Poland. Another suspect, responsible for supplying vehicles, is under investigation for car theft across Europe. A third individual, involved with the explosives, had previously served time for rape.
“There’s a plethora of online groups willing to undertake virtually any task for the right price—and that’s precisely what we are observing,” Glantz stated. He pointed out that in organized crime operations, groups typically do not disclose the full details of a job, and those hired “very often” possess limited information. “One question smugglers will never ask is, ‘What’s in the lorry?’ It’s simply the nature of the business.”
The Explosions and the Investigation
On July 20, the first parcel Suranovas had dispatched ignited at Leipzig Airport in Germany. This was the package destined for London, moments from being loaded onto a DHL cargo flight. The following day, before dawn, a second device detonated in a DPD truck just outside Warsaw, while another malfunctioned. The final device ignited at a DHL warehouse in Birmingham.
While no one was harmed, the damage incurred was substantial.
Initially, these incidents were not publicly disclosed as investigators across Europe commenced their work. The Telegram chat logs reveal uncertainty among the Russian handlers regarding the events. HK instructed Suranovas to contact DHL and inquire about the reasons for a parcel being stalled in Leipzig.
Concurrently, other deliveries proceeded. Two additional suspicious parcels were sent from Warsaw to the United States and Canada, followed by another two from Amsterdam to the same destinations. These shipments did not contain explosives, suggesting the group was testing new routes.
Investigators remain uncertain whether Russia’s ultimate objective was to bring down an aircraft or to instill intimidation and fear in nations supporting Ukraine. However, the White House expressed significant concern, contacting Russia “at a high level,” as revealed by a former senior official under President Biden to the BBC. The unequivocal message was to “knock it off” or face “consequences.”
Dovile Sakaliene, Lithuania’s former Minister of National Defence, recalled viewing the parcel plot as a critical wake-up call for Lithuania’s allies. “Because… not everyone was fully on board regarding the extent of the threat we are facing through hybrid attacks.”
As Lithuanian police began apprehending members of the parcel plot, they uncovered an additional cache of explosives, concealed within food cans at a cemetery. Drone components, including mounts for the cans, were also discovered.
Towards the end of our interview, I asked Suranovas for his thoughts on Russia’s objectives. He paused briefly.
“I believe… it was likely a test of something; that they were preparing something larger,” he stated. “It was intended to demonstrate that their reach is deep and far. That they are capable of many things, and you wouldn’t even know.”