Lithuania’s probe into Russia-linked parcel bomb plot expands

Lithuanian authorities have escalated their investigation into a sophisticated Russian-orchestrated terrorist plot involving explosive parcels shipped across Europe, naming 16 suspects to date – one of whom is currently detained in Estonia awaiting extradition. The case, which first surfaced with fires at international logistics hubs in 2024, underscores growing concerns over Moscow’s hybrid warfare tactics targeting Western infrastructure and aviation.

Prosecutor General Nida Grunskienė confirmed the update on Tuesday (18 November), highlighting the probe’s international scope amid fears the attacks were a “test run” for broader sabotage against cargo flights to North America.

“This suspect status has been granted to 16 individuals at present, nine of whom have been authorized for detention by court order,” Grunskienė told journalists in Vilnius. “We are awaiting the execution of a European Arrest Warrant from Estonia, where the individual has been detained. The matter is being resolved, and we expect handover soon.”

She declined to disclose the nationalities of those held in Lithuania but noted the ongoing extradition process could conclude imminently, pending Estonian approval.

The investigation, coordinated through a multinational team at Eurojust, builds on a September 2025 breakthrough when Lithuanian police dismantled what they described as a Russia-linked terrorist network plotting at least four attacks across the continent.

At that time, 15 suspects – citizens of Russia, Lithuania, Latvia, Estonia, and Ukraine – faced charges of organizing a terrorist group and executing acts of terrorism.

The latest addition brings the total to 16, reflecting intensified scrutiny and cross-border raids that have seized over 6 kilograms of explosives hidden in everyday containers like canned goods.

The plot unfolds: from Vilnius to European skies

The scheme’s origins trace back to 19 July 2024, when Lithuanian national Aleksandras Šuranovas, born in 1973 and acting with accomplices, dispatched four parcels containing homemade incendiary-explosive devices from Vilnius using major couriers DHL and DPD.

Two packages, bound for the United Kingdom via DHL air cargo, ignited en route: one at Leipzig Airport in Germany before boarding a flight, and another at a DHL warehouse in Birmingham, where flames damaged sorting equipment but caused no injuries.

The remaining two, trucked to Poland via DPD, saw one erupt in a delivery vehicle – prompting an emergency stop and hazmat response – while the fourth fizzled out due to a faulty detonator.

Investigators quickly linked the incidents to Russia’s Main Intelligence Directorate (GRU), with evidence showing coordination via encrypted Telegram channels and direct ties to Russian military intelligence operatives.

“These were not random acts but a staged operation to probe vulnerabilities in global supply chains,” a senior Lithuanian security official told LRT in September, revealing how the plot was delayed when a Vilnius-based suspect grew suspicious of surveillance.

Western intelligence, including from the UK and US, suspects the parcels were prototypes for smuggling devices onto transatlantic flights, potentially targeting North American hubs as retaliation for sanctions.

Sweeping raids and global cooperation

The probe’s momentum surged with over 30 searches across Lithuania, Latvia, Estonia, and Poland, yielding detonators, prepared explosives, and digital footprints of GRU handlers.

A joint investigation team, launched at Eurojust in The Hague, now includes experts from eight nations: Lithuania, Poland, the UK, Germany, the Netherlands, Latvia, Estonia, the US, and Canada.

This collaboration has been hailed as a model for countering hybrid threats, with US officials praising the “seamless intelligence-sharing” that thwarted potential escalations.

Media reports, including from The Guardian and Reuters, have amplified evidence of Kremlin involvement, with counter-terrorism units in the UK probing whether Russian agents physically planted devices during transit.

Lithuanian President Gitanas Nausėda, addressing the UN General Assembly in September, framed the plot as “part of Russia’s shadow war on Europe,” urging stronger sanctions against GRU-linked networks.

As the extradition from Estonia hangs in the balance, Grunskienė emphasized the case’s gravity: “This is a direct assault on civilian infrastructure, coordinated from afar to sow chaos without fingerprints.” Experts warn that without sustained international pressure, similar GRU operations – blending cyber, sabotage, and proxy actors – could proliferate amid Russia’s Ukraine invasion

With additional reporting from Lrt.lt

Caption: The logo of the courier company DHL is pictured on a van in Berlin, Germany, 5 August 2025. EPA/CLEMENS BILAN