Disposable: The ordinary people doing Russia’s dirty work

The life Vasilij Kovacs knew ended with a bang. It was late afternoon on March 1, 2025, when an armored vehicle smashed through the metal gate of the old farmhouse where he lived southeast of the Latvian capital, Riga.

Masked men emerged with their guns drawn. They belonged to Latvia’s State Security Service, the country’s counterintelligence agency. The officers searched the property, seizing several mobile phones, SIM cards and documents, along with a pistol with its serial number filed off, a bayonet from an AK-47 and a cellphone jammer, according to a search report later filed by the authorities.

They arrested Kovacs, a Ukrainian man in his 60s who has lived in Latvia for more than 30 years. In March, Kovacs was transferred to stand trial in Lithuania, where he is accused of planning terrorist attacks, alongside four alleged accomplices. Five others face trial in Warsaw.

Lithuanian and Polish prosecutors accuse the ten men of planning and carrying out arson attacks involving cargo parcels across several European countries on behalf of Russia’s military intelligence agency, the GRU.

One of those incidents made headlines across Germany. In the early hours of July 20, 2024, a parcel caught fire at Leipzig Airport just before it was due to be loaded onto a DHL cargo plane. The flames engulfed an airfreight container.

It was probably only because the aircraft was delayed that the fire did not break out on board. All ten men say they did not knowingly work for Russian intelligence and say they are innocent of the terrorism charges.

Disposable agents

According to investigative files from the Office of the Prosecutor General of Lithuania, Kovacs is an example of an increasingly common category of Russian intelligence asset — the kind Western intelligence agencies call “low-level agents,” or, more tellingly, disposable agents.

The 63-year-old Ukrainian national is alleged to have been a small cog in a much larger machine. Investigators say he transported massage pillows modified to be able to conceal incendiary devices from Latvia to Lithuania.

With its own officers finding it harder to operate in Europe since Russia’s invasion of Ukraine, the GRU increasingly relies on intermediaries to recruit people through messaging services such as Telegram, according to investigative files from Lithuania’s State Security Department obtained by the Axel Springer Global Reporters Network, of which POLITICO is a part.

Often motivated by money, these disposable agents carry out individual assignments: Take a photograph. Mail a parcel. Move something from A to B. Sometimes the tasks are far more dangerous. Recruits may know little about the wider operation. Anyone who gets caught can be replaced.

A convoluted journey

The man believed by Polish and Lithuanian investigators to have collected the package from Kovacs’ car was another Ukrainian, a trained chef who had spent five years in a Russian penal colony after being convicted of rape. By the summer of 2024, he was living in Poland and receiving instructions through Telegram from a handler who promised him €4,000 a month.

The following day, the chef allegedly took the massage pillows to a holiday apartment rented under a false name. He also had tubes of cosmetics filled with potentially explosive nitromethane.

A video filmed inside the Airbnb apartment and later found on a suspect’s phone shows four boxes containing the massage devices and cosmetic products. According to the Lithuanian investigative files, another intermediary was supposed to come and get the devices but could not find the entrance to the apartment complex.

The chef’s handler changed the plan and ordered him to activate the ignition devices himself. The chef refused, according to an indictment filed by Poland’s National Prosecutor’s Office, obtained by the Global Reporters Network. The operation had to be reorganized.

Over the following days, the boxes passed through several more hands. At one point, Lithuanian investigators lost track of them altogether. They suspected they might have traveled through Moldova. On July 13, 2024, they resurfaced in Riga, where Kovacs was drawn into the operation for a second time.

From courier to arsonist

Once again, according to his account, Kovacs received a Telegram call from the acquaintance he barely knew. This time, he said, he thought he could hear Baburov in the background. He was asked to transport another shipment to Lithuania, described as “high-quality massage pillows.”

On July 17, he drove to Vilnius with his nephew. There, another man collected his package and drove it to Kaunas, where on July 18 a Ukrainian who had traveled from Poland to Lithuania retrieved it.

He, too, had a criminal past, having been convicted in Poland of cyber fraud and money laundering. His instructions came from a Telegram contact calling himself “Warrior.”

The Ukrainian packed four parcels containing the massage devices, tubes of potentially explosive cosmetics and various sex toys investigators believe were included as a distraction. He activated a timer and handed the parcels to the man who had previously failed to find the entrance to the holiday apartment.

That afternoon, the man dropped off two parcels at a DHL office in Vilnius. They were addressed to Wimbledon in London and to Birmingham. Top left, the charred massage pillow that caught fire in Leipzig. Next, four parcels marked with their destination cities in the trunk of a car, in a photograph taken by one of the accused; a Lithuanian intermediary dropping off the parcels at a DHL branch; and the fire at the DPD warehouse in Birmingham on July 22, 2024.