The former taxi driver at the center of Russia’s ‘secret war’

The plans, Western security officials say, are part of a shadow war waged by Russia’s intelligence services. An arson attack that destroyed more than 1,000 businesses on the outskirts of Warsaw, Poland. Another who burned down an IKEA store in Lithuania. A plan to place incendiary devices on cargo planes in the United Kingdom, Germany and Poland.

But a key figure in those plans, authorities say, is not an intelligence agent. He is a slovenly former taxi driver who lives in an agricultural region of Russia.

Aleksei Vladimirovich Kolosovsky, 42, who has ties to criminal groups involved in hacking, selling fake identities and car theft, has become a key character in this unconventional conflict. With the help of Russian intelligence officials, he coordinated the planning and execution of recent attacks in Poland, Lithuania, the United Kingdom, Germany and possibly elsewhere, according to court documents and interviews with more than a dozen security officials from five European countries.

Kolosovsky’s role is something new, these officials said. He is neither a trained officer nor an asset infiltrated by a foreign government. It is another service provider, they said, that works closely with intelligence agents — most of them from the GRU, Russia’s military intelligence service, mainly responsible for sabotage operations.

Operators like Kolosovsky have become more common in the Kremlin’s evolving, increasingly violent sabotage campaign, which has escalated from small acts of vandalism to bombings, arson and assassinations. The objective, according to authorities, is to shake the unity of the West.

Kolosovsky, they said, brings to this dispute a wide network of criminals who know how to move goods and people without attracting the attention of authorities. Most importantly, these contacts live in and can travel throughout Europe, something that has become increasingly difficult for Russia’s professional intelligence agents since President Vladimir Putin launched the full-scale invasion of Ukraine.

“We are now operating in a space between peace and war,” Blaise Metreweli, head of the British spy agency known as MI6, said in a speech. “Russia is testing us in the gray zone with tactics just below the threshold of war.”

New recruits

Burly and often unshaven, Kolosovsky first came to the attention of Western intelligence services after a pair of arson attacks in May 2024, two of the security officials said.

Using an account on the messaging app Telegram under variations of the name “Warrior,” he recruited a web of agents, including a Ukrainian teenager, to plant incendiary devices at an IKEA store in the Lithuanian capital Vilnius and a large shopping center outside Warsaw, according to authorities and court records.

From his base in the southern Russian city of Krasnodar, Kolosovsky orchestrated the shipment of detonators and bomb-making materials to parcel lockers at train stations, where recruits often unaware of the plan took them, according to security officials in two Western countries and court documents.

On May 8, 2024, Ukrainian teenager Daniil Bardadim placed an incendiary device with a remote timer in the mattress section of an IKEA store. The device was activated in the early hours of May 9, intentionally timed, prosecutors said, to the day Moscow celebrates the Soviet Union’s victory over Nazi Germany.

Bardadim was arrested a few days later. He was removed from a bus in Lithuania on his way to the Latvian capital, Riga. He was carrying a bag full of items he intended to use to make a bomb, including a remote-controlled car, two vibrators and six cellphones, according to court documents. He planned to detonate an artifact in Riga similar to the one he had placed in the IKEA store. Before his arrest, he had received an old-model BMW as payment for the attack in Vilnius.

Around the same time, another group of accomplices linked to Kolosovsky started a fire on the outskirts of Warsaw that destroyed more than 1,000 small businesses. Afterwards, Donald Tusk, Prime Minister of Poland, stated that authorities knew “with certainty” that Russian intelligence services were responsible. In response to the sabotage plans, Poland closed all Kremlin consulates in the country, hampering the work of its spies.

“The actions were coordinated by a person who is in Russia,” said Tusk.

Kolosovsky did not respond to multiple requests for comment. The Kremlin has repeatedly denied any involvement in sabotage.

The services provided by Kolosovsky and others like him are a matter of necessity for Russia. Since the invasion of Ukraine, more than 750 Russian diplomats have been expelled from Europe, “the vast majority of them spies,” said Ken McCallum, head of the British internal security agency MI5, in a speech in 2024.

“We sent almost all Russians back home,” Michal Koudelka, director of the Czech Security Information Service, the country’s foreign intelligence service, said in an interview. “The ability of the Russians to operate on Czech territory under traditional cover is very limited.”

The expulsions left the Kremlin partially blind and unable to react as Western nations began sending large quantities of weapons and equipment to Ukraine to confront Russian forces. In response, Putin turned to the GRU, which has long been the main agency for covert operations abroad.

Before the 2022 invasion of Ukraine, GRU operatives from a specialized group known as Unit 29155 carried out assassinations, planned coups and blew up weapons depots in Europe.

After the invasion, the GRU expanded this effort, promoting the commander of Unit 29155, General Andrei Averyanov, to deputy head of the entire agency. His rise was seen by Western intelligence officials as a reflection of how important sabotage had become to Putin’s conflict with the West.

Sabotage is nothing new for the GRU. Training manuals dating back to the 1930s describe the concept of “deep battle,” which includes sabotage operations far behind enemy lines.

But these operations should be carried out by professional officers in times of war. Now Russia depends on a motley crew of criminals, Ukrainian refugees and other people desperate for money.

“During the Cold War, there was at least some level of accountability and professionalism,” said Sean Wiswesser, a former CIA officer who wrote a book about the Russian intelligence services he worked against for decades. “But now everything seems within the realm of possibility. We have never seen this level of recklessness.”

A spy network

Nothing in Kolosovsky’s public profile suggests a life of secret intrigue.

He appears to live modestly and is often in debt, according to security officials in one European country. His social media accounts feature a lot of cars, although they are not flashy models. His last post on one of these accounts was on December 15, 2020, his birthday. She had a photograph with her mother.

Western security authorities and researchers who investigated his past found evidence of another, hidden life.

Kolosovsky appears to have been associated with a professional car thief named Daniil Oleynik, who went by the online nickname Wasp Killer. Western security officials linked the two to a Telegram channel — Kolosovsky under the pseudonym LexTER — that was used as a platform to extort ransom payments from people whose vehicles had been stolen. Oleynik was arrested in Italy and extradited to Ukraine in August 2024 on car theft charges.

It is unclear whether Kolosovsky was also a car thief. But researchers and security authorities linked their phone numbers to a network of channels and groups on Telegram involved in smuggling and “doxxing”, as well as the sale of fake identities and equipment used to steal cars. His number was often saved on people’s cell phones as “Aleksei” plus the name of a car brand, such as Lexus, Ford or Toyota.

Kolosovsky is also a sophisticated cyber operator. He was associated with a hacker collective called KillNet, according to security officials in a European country. Since the hack, KillNet has focused on attacking the websites of Ukrainian and European companies. In 2024, the group claimed to have invaded a French asset management company.

In 2021, Kolosovsky was briefly detained by Russian authorities, although the reason is unknown. It was then, security officials said, that he was likely recruited by the intelligence services, which routinely scour prisons for potentially useful inmates willing to work for them in exchange for freedom.

After Kolosovsky was detained, his associate Oleynik begged followers to delete their communications because authorities had confiscated Kolosovsky’s electronic devices, according to security officials. Telegram channels possibly linked to Kolosovsky also disappeared, they said.

His mother, who often posts family photos on social media, has not posted any images of Kolosovsky since at least 2021. When asked about his whereabouts in a comment on a Russian social media site in July 2022, she responded that he was on a business trip.

A growing reaction

In the early morning of July 20, 2024, a container being loaded onto a DHL cargo plane in Leipzig, Germany caught fire. Less than 24 hours later, a package on a cargo truck crossing Poland caught fire. A day later, in Birmingham, England, the same thing happened to a forklift at a DHL shipping facility, which was transporting a pallet of packages.

The coordinated attacks alarmed Western governments more than previous sabotage attempts because they had the potential to shoot down cargo planes in flight and cause many deaths. An investigation involving nine countries later concluded that the GRU was behind the plans and that a vast network of operatives in Europe carried them out, “following a very rigorous conspiracy,” according to prosecutors in Lithuania, where the parcel bombs originated.

At the center of these attacks, security officials in two European countries say, was Kolosovsky.

He coordinated the recruitment of the network that helped oversee the transportation and distribution of materials used to make the incendiary devices, according to European authorities and court documents. The network, these documents say, used a military-grade incendiary material called thermite to make the devices, which were hidden inside massage cushions equipped with electronic timers.

(The had previously revealed Kolosovsky’s possible involvement with the GRU and his connection to the plan to place incendiary devices on cargo planes.)

The attacks marked a drastic escalation of the war in Russia’s shadow, indicating a greater willingness to resort to violence to achieve its national security goals, security officials from the five European countries said. If the DHL cargo plane in Leipzig had not been delayed, they said, the device would likely have exploded in mid-air. The episode so alarmed the White House that President Joe Biden’s national security adviser and the head of the CIA contacted their Russian counterparts with a message to immediately stop such actions.

“The Russians have taken state-sponsored murder and sabotage to a new level,” Wiswesser said. “They are using it to achieve strategic objectives.”