How Vilnius became the hub of GRU’s parcel bomb plot – LRT investigation 30

A planned Russian military intelligence operation to send parcel bombs through international shipping companies was delayed after a recruited Lithuanian courier became lost in a newly built apartment complex in Vilnius, according to a months-long investigation by an international team of journalists.

This article is a summary of a more extensive story available in Lithuanian

The explosives, hidden in massage pillows, sex toys and cosmetic tubes filled with nitromethane, were meant to detonate in Germany, the United Kingdom and Poland in late June 2024. But the plot failed when the courier, Lithuanian citizen Aleksandras Šuranovas, could not locate a rented Airbnb apartment where the devices were stored.

The bombs were later deactivated, averting casualties in the Vilnius complex, which stands next to the TwinsBet Arena.

The operation was relaunched a month later. In July 2024, explosive parcels sent via DHL ignited at Leipzig Airport in Germany and at a DHL warehouse in Birmingham, UK. A separate package sent through DPD caught fire in a Polish warehouse near Warsaw. A fourth package was intercepted by Polish security services.

Lithuanian courier tied to GRU operations

Šuranovas, who is now being held in a Kaunas prison, has been linked to other Russian GRU sabotage operations. According to law enforcement, he was connected to the May 2024 arson attacks that destroyed Warsaw’s Marywilska shopping centre and triggered a blaze at an IKEA store in Vilnius. A then-underage Ukrainian recruited by Russian operatives carried out the attacks but was later arrested en route to Riga with additional incendiary devices supplied by Šuranovas.

Šuranovas’ involvement with Russian operations dates back further. Investigations by LRT and Poland’s Frontstory.pl revealed he had earlier served as a front director for the company Recyclix, tied to a multimillion-euro money-laundering scheme in Poland.

Explosives traced to Soviet submarine veterans

Journalists from Lithuania, Poland, Latvia, Estonia and Russia’s exiled outlet The Insider traced the origins of the Vilnius parcel bombs back to contacts of a deceased former Soviet submarine commander, Aleksandr Miroshnikov. Using a network of ex-sailors, Miroshnikov arranged for a shipment of massage pillows to reach Vilnius under the guise of deliveries for relatives.

The logistics involved former submarine officers and associates, including Andrei Baburov, who now runs a St. Petersburg company that helps Russian firms bypass Western sanctions. Baburov told Latvian investigative outlet Re:Baltica he was unaware the parcels contained explosives.

The packages eventually reached Vilnius through intermediaries, including Ukrainian national Viacheslav “Ponchik” Chebanenko, who assembled four separate parcel bombs in an Airbnb apartment. Šuranovas was meant to collect and forward them but failed to find the flat, forcing Chebanenko to deactivate the devices and relocate them to Kaunas warehouses.

The bombs later resurfaced in Vilnius and were activated by another Ukrainian, Vladyslav Derkavets, before Šuranovas shipped them abroad using false documents.

July detonations across Europe

• July 20, 5:45 am – A parcel ignited at Leipzig Airport, Germany.
• July 21, 2:15 am – A DPD truck caught fire near Warsaw.
• July 22, 3:36 am – A DHL facility in Birmingham, U.K., was set ablaze.
• A fourth parcel was seized by Polish security, who found a timed device hidden in a massage pillow.

Coordinators identified

Investigators linked the operation’s coordination to a Telegram account “Jarik Deppa”, controlled by 37-year-old Russian Yaroslav Mikhailov, wanted in Russia since 2015 for arms trafficking. European security sources believe he was later recruited by the GRU. Mikhailov is accused of directing multiple sabotage operations in Europe, including the Warsaw and Vilnius arson attacks, from abroad. Lithuania has issued an international warrant for his arrest.

Authorities have also issued search notices for Baburov and Lithuanian-Russian dual citizen Tomas Dovgan Stabačinskas, suspected of aiding in the IKEA arson.

Lithuania has detained Šuranovas, Chebanenko’s associate Vasilijus Kovačas, and the underage Ukrainian arsonist. Poland and Estonia have arrested additional suspects tied to the parcel-bomb network.

Official response

Lithuania’s General Prosecutor’s Office preemptively disclosed details of the case after receiving detailed questions from the LRT Investigation Team.

Arūnas Maskoliūnas, head of Lithuania’s Criminal Police Bureau, praised law enforcement’s coordination.

“I am glad that Lithuania’s institutions – police, intelligence services and prosecutors – are passing these tests and handling the challenges,” Maskoliūnas told LRT’s Investigations Team. “How we work today determines how we will live tomorrow.”

This report is part of an international investigation with contributions from:

Daniel Flis, Anna Gielewska, Alicja Pawłowska, FRONTSTORY (Poland), VSquare

Inga Spriņģe, Re:Baltica (Latvia)

Indrė Makaraitytė, LRT (Lithuania)

Holger Roonemaa, Delfi (Estonia)

Michael Weiss, Kato Kopaleishvili, Christo Grozev, The Insider