The former taxi driver who was involved in Russian secret services operations in Europe

The plots, Western security officials say, are part of a shadow war waged by Russian secret services. One arson attack destroyed more than 1.000 businesses outside Warsaw. Another burned down an IKEA store in Lithuania. A plan to plant incendiary devices on transport planes in Britain, Germany and Poland was also uncovered.

But the key figure in these plans, officials say, is not some secret service officer. He is a scruffy-looking former taxi driver living in rural Russia.

Aleksei Vladimirovich Kolosovsky, 42, has ties to criminal groups involved in hacking, selling fake documents and stealing cars. He has become a key figure in this new form of unconventional conflict. With the help of Russian intelligence officers, he has directed the planning and execution of attacks in Poland, Lithuania, Britain, Germany and possibly other countries. This is based on court documents and interviews with more than a dozen security officials from five European countries.

According to officials, his role is unusual. He is not a trained officer nor an undercover agent for any foreign government. He acts more as a service provider. He works closely with intelligence officers, mostly from the GRU, the Russian military intelligence service that deals primarily with sabotage operations.

People like Kolosovsky are becoming increasingly common in the Kremlin's growing campaign of sabotage. The campaign has ranged from minor vandalism to bombings, arson and assassinations. The aim, officials say, is to weaken the unity of Western countries.

also World 15 Tues 2026 Courier involved in Russian plot against Britain says he was used without his knowledge

New recruits

Tough-looking and often unkempt, Kolosovsky first attracted the attention of Western intelligence services after two arson attacks in May 2024, according to two security officials.

Using a Telegram account with a variant name of “Warrior,” he recruited a network of people, including a Ukrainian teenager, to plant incendiary devices in an IKEA store in Vilnius, the capital of Lithuania, and in a large shopping mall near Warsaw, according to statements from officials and court documents.

From his base in Krasnodar, in southern Russia, Kolosovsky arranged for detonators and bomb-making equipment to be delivered to train station lockers. Recruits, often without fully understanding the danger, would pick up the equipment there.

On May 8, 2024, Ukrainian teenager Daniil Bardadim placed a timed detonator in the mattress section of an IKEA store. The device exploded in the early hours of May 9 — the day Moscow celebrates the Soviet Union's victory over Nazi Germany.

Bardadim was arrested a few days later, while traveling by bus to Riga, the capital of Latvia. In his bag were found materials for building a bomb: a remote-controlled toy car, two vibrators and six mobile phones. According to court documents, he was planning a similar attack in Riga. Before his arrest, he had received an old-model BMW as a reward for the attack in Vilnius.

At the same time, other associates linked to Kolosovsky caused a major fire near Warsaw, which destroyed over 1.000 small businesses. Later, Polish Prime Minister Donald Tusk stated that authorities were “certain” of the involvement of Russian intelligence services. In response, Poland closed all Russian consulates in the country, restricting their activities.

"The actions were coordinated by a person located in Russia," Tusk said.

Kolosovsky did not respond to requests for comment. The Kremlin has consistently denied involvement in acts of sabotage.

Services like those Kolosovsky provided have become indispensable to Russia. Since the invasion of Ukraine, more than 750 Russian diplomats have been expelled from Europe. “The vast majority of them were spies,” said Ken McCallum, head of Britain’s domestic security service.

Even Michal Koudelka, the director of the Czech intelligence service, said that Russia now has very little opportunity to operate on Czech territory with traditional diplomatic cover.

These expulsions left the Kremlin partially blindsided, as Western countries began supplying Ukraine with weapons and military equipment. In response, Russian President Vladimir Putin turned more to the military intelligence service, the GRU, which historically handles covert operations abroad.

Before the 2022 invasion, a specialized GRU unit, known as Unit 29155, had carried out assassinations, planned coups, and blown up weapons depots in Europe.

After the invasion, the GRU expanded this activity. The commander of Unit 29155, General Andrei Averyanov, was appointed deputy head of the entire agency - a sign of the importance that sabotage has for the Kremlin in confronting the West.

Today, Averyanov oversees a branch of the GRU called the Special Activities Service (SSD). According to European security officials, this branch includes sub-units specializing in cyber warfare, explosives and assassinations. Some of them say that Unit 29155 is now headed by General Vyacheslav Stafeyev, an experienced special operations officer and cyber expert.

A spy network

Nothing on Kolosovsky's public profile suggests a life full of secrets. According to security officials in a European country, he appears to live simply and is often in debt. He often posts pictures of cars on social media, but not luxury ones. His last post on an account is dated December 15, 2020, his birthday, in which he appears in a photo with his mother.

However, Western officials and scholars who have investigated his past have uncovered another, hidden life.

He appears to have had ties to a professional car thief, Daniil Oleynik, known online as the “Wasp Killer.” Western officials have linked the two to a Telegram channel — where Kolosovsky used the alias LexTER — that was used to collect ransom payments from people whose vehicles had been stolen. Oleynik was arrested in Italy and extradited to Ukraine in August 2024 on charges of car theft.

It is not clear whether Kolosovsky was a car thief himself. But investigators have linked his phone numbers to a network of Telegram channels and groups involved in smuggling, doxxing, and selling fake documents and car theft equipment. His number was often saved in other people's phones as "Aleksei" along with car brand names like Lexus, Ford, and Toyota.

Kolosovsky is also considered a skilled cyber operator. He has been linked to a hacking group called KillNet, according to security officials in a European country. Since the invasion of Ukraine, KillNet has focused on attacks on the websites of Ukrainian and European companies. In 2024, the group claimed to have hacked a French asset management company.

also World July 15, 2026 Lithuania says Russia is planning attacks on infrastructure

"Nothing personal, we are simply against supporting Nazis," KillNet wrote on social media, using an insulting term that the Kremlin often uses for the Ukrainian government.

Often, the group's messages ended with the words: "Our enemies fall at our feet. Long live Russia."

A leak from a rival hacking group in 2024 linked Kolosovsky to the alias @warriorkillnet.

In 2021, Kolosovsky was briefly detained by Russian authorities, although the reason is unknown. According to security officials, it is likely that he was recruited at that time by intelligence services, which often search prisons for people willing to cooperate in exchange for freedom.

After his arrest, accomplice Oleynik asked followers to delete communications, after authorities seized Kolosovsky's electronic devices. Several Telegram channels allegedly linked to him also disappeared.

His mother, who often posts family photos on social media, has not posted a photo of him since 2021. When asked about his whereabouts in a comment in July 2022, she replied that he was on a business trip.

A growing reaction

In the early hours of July 20, 2024, a shipping container being loaded onto a DHL cargo plane in Leipzig, Germany, burst into flames. Less than 24 hours later, a package on a freight truck traveling through Poland caught fire. The following day, in Birmingham, England, the same thing happened at a DHL delivery center.

These coordinated attacks shocked Western governments more than previous sabotage attempts because there was a risk that cargo planes would explode in midair and cause mass casualties. A wide-ranging investigation, involving nine countries, concluded that the GRU, Russia's military intelligence service, was behind the plans. According to prosecutors in Lithuania - where the package bombs originated - the operation was carried out by a large network of operatives across Europe, operating in close collaboration.

At the center of these attacks, according to security officials in two European countries, was Kolosovsky.

He coordinated the recruitment of the network that oversaw the transportation and distribution of materials to build the incendiary devices. According to court documents, the network used a highly potent military material called thermite to build the bombs, which were hidden inside massage pillows with electronic timers.

The Washington Post had previously reported on Kolosovsky's possible involvement with the GRU and his connection to the plan to plant incendiary devices on cargo planes.

The attacks marked a major escalation of Russia's "shadow war," demonstrating a greater willingness to use violence to achieve its national security objectives, officials from five European countries said. Had the cargo plane in Leipzig not been delayed, the device would have exploded in midair, they said.

The situation was so alarming that US President Joe Biden's national security adviser and the CIA director contacted their Russian counterparts to demand an immediate halt to these actions.

Although the attacks sent a threatening message, the reaction to Russia has been strong.

Lithuanian prosecutors moved quickly to unravel the plot and charged more than a dozen people, some of whom were also involved in the IKEA attack. Among them was a Russian national, Yaroslav Mikhailov.

According to security officials in two European countries, Mikhailov is a longtime friend of Kolosovsky and was recruited specifically for the DHL operation. He is currently in Azerbaijan and is wanted by Poland, which has issued a “red notice” for his arrest through Interpol. Russia, on the other hand, has filed a counter-request with Interpol, a practice often used to return its arrested agents.

The Kremlin's interest in his case, officials say, shows the importance he holds. Mikhailov has sent a letter to Sergei Naryshkin, the head of Russia's foreign intelligence service, asking for help in returning to Russia.

Kolosovsky, according to officials, lobbied his contacts in the Russian secret services to help his friend.

But it seems that Kolosovsky himself has problems too.

After the DHL operation, he was summoned to the local FSB office in Krasnodar, where his electronic devices were searched. Officials have offered various explanations for the move. Some believe that the publicity surrounding his activities, particularly the cargo plane plot, may have angered the Kremlin.

also World June 9, 2026 “They are isolated… they are alone” - Zelensky speaks about Russia and Putin's lies

According to officials, there are signs that he also had financial problems. It is suspected that he used money from his own pocket to finance some operations and may have tried to compensate himself with funds allocated by the intelligence services.

Although he has not traveled abroad since the invasion of Ukraine, he has recently been doing online searches for real estate in London - an indication that he may be thinking about a future outside of Russia.