On a frosty November morning last year, a broad-shouldered man with short grey hair staggered, exhausted, into a small guesthouse on the outskirts of Bosanska Krupa – a quaint Bosnian border town where ancient stone bridges span the emerald-green waters of the Una River.
Alexander Bezrukavyi had been on the run for more than three months, pursued by European security services who accused him of working for Russia’s military intelligence agency, the GRU.
Bezrukavyi, 44, had set out from Croatia on foot two days earlier, navigating dense Balkan forests and rugged hills to cross into Bosnia illicitly.
As evening arrived, Bezrukavyi messaged his wife, promising her that they would soon be reunited in Russia, and contacted his friend to finalise his plans for getting back home, using new forged papers and a flight from neighbouring Serbia.
But a few hours later, at about 2am, a group of Bosnian intelligence officers and police burst into his room.
Bezrukavyi’s arrest was part of a Polish-led operation targeting a suspected Russian-backed criminal network. The cell is accused of sending parcels containing camouflaged explosives on cargo planes across Europe, triggering fires at three locations.
Polish prosecutors believe Bezrukavyi was part of a plot to send shipments with explosives to the US and Canada, a brazen plan that would have marked a major escalation of a sabotage campaign that western security officials believeMoscow has unleashed over the past three years across Europe.
Western security officials believe the exploding parcels could have led to a plane crash and mass casualties.
When intelligence about the alleged plot reached Washington, it caused so much alarm that top officials in Joe Biden’s administration had called their Russian counterparts to demand that Vladimir Putin call it off.
On 13 February, three months after his arrest in Bosnia, Bezrukavyi was extradited to Poland amid much fanfare. An image published in Polish media showed a man in handcuffs, chained at the ankles, being escorted off a plane by two masked law enforcement officers.
“A Russian hiding in Bosnia-Herzegovina, suspected of coordinating acts of sabotage against Poland, the US, and other allies, was extradited to Poland and arrested by court order,” the Polish prime minister, Donald Tusk, wrote on X.
The country’s interior minister described his extradition as “a serious blow to the Russian sabotage network in Europe”.
This exclusive account – based on the first known interviews with two direct participants in the parcel operations, as well as others close to Bezrukavyi’s group and current and former western intelligence sources – reveals previously unreported details into how the Russian sabotage campaign played out, and the multinational effort to track down the wider network behind it.
It also raises questions about the chain of command in today’s Russian intelligence operations, in which staff officers tend to remain in Moscow, leaving the dirty work on the ground to proxies and recruits.
The Polish prosecutor, in a statement, said Bezrukavyi would be charged “with coordinating acts of sabotage in Poland and other countries, consisting of setting fire to buildings and sending courier packages with incendiary materials”.
In communications with those close to him, Bezrukavyi has claimed he was duped – unknowingly used to deliver packages coordinated via the Telegram messaging app, without understanding their true purpose. Others in the group claimed the same.
“We were being used like blind mules,” one of them told the Guardian. “We were set up.”
Bezrukavyi grew up in Rostov-on-Don, a Russian city near the Ukrainian border, where court records suggest he has a long history of violent offences. Over the years, he faced multiple criminal charges, including illegal possession of weapons, burglary, robbery and drug-related crimes.
According to those who know him from his time in Russia, he made much of his money in various smuggling schemes in Ukraine’s Donetsk region, including moving cigarettes across the separatist-controlled border into Russia.
In 2019, Russian court documents show he was briefly detained and later charged with participation in an organised criminal ring.
Before he could be re-arrested, he fled to Ukraine and settled in Kharkiv – a city nearly captured by Russian forces in the early days of the invasion. As the war raged, Bezrukavyi supposedly lay low in Ukraine, eventually managing to leave for Moldova on 17 February 2024, according to leaked border data.
By May, he had entered the Schengen zone via Croatia, and later obtained Spanish residency through a fictitious marriage to a Ukrainian woman.
“He couldn’t return to Russia because he was still wanted there, so he stayed in Europe waiting for Moscow to drop the charges,” claimed his real wife, Natalia, in a phone interview. The Guardian has a photograph of Bezrukavyi’s Spanish residency permit.
From Spain, Bezrukavyi moved to Warsaw, where he hung out with a group of Ukrainian friends and acquaintances. He shared a flat on the city’s outskirts with Vyacheslav Chabanenko, a clean-shaven Ukrainian, nicknamed “Ponchik” or “Doughnut” for his stocky physique, whom Bezrukavyi had met back in Kharkiv.
Chabanenko also had a criminal past, allegedly spending five years in a Russian jail for beating his wife and mother-in-law. He also became friends with Serhiy Yevseyev from the Ukrainian city of Lutsk, who was later detained and is believed to have aided the operation.
In the summer of 2024, the group reportedly began searching for jobs among Russian-language Telegram channels commonly used by Ukrainian refugees. Amid the legitimate job listings and housing tips, they apparently came across an anonymous account that went by the name VWarrior, which Polish authorities believe was operated by a GRU handler.
The account began offering courier jobs paying hundreds of dollars per assignment.
A close associate of Bezrukavyi who supplied cars for the operation disclosed new details of the parcel shipments to the Guardian.
“The packages looked very random – sex toys from China, vibrators, lubricants, cosmetics … we thought it was pretty worthless shit,” said Kirill, whose name has been changed to allow him to speak freely, and who is hiding from law enforcement in a third country, outside Europe and Russia.
Kirill said an account they knew only as VWarrior would send the group lists of items to buy via Telegram, which they would then collect and pack into boxes. Kirill said the account would post from several different accounts, all with names that included the word “warrior”.
VWarrior usually tasked the group with delivering the boxes from one location to another across Poland and Lithuania, though on at least two occasions, he instructed them to send them via DHL, according to Kirill. All payments to the couriers were done in cryptocurrency.
“It could be true that the purpose of the parcels was sinister,” Kirill admitted. “We just wanted easy money, work that wouldn’t involve drugs or weapons … but it turned out to be some packages to test some fucked up shit,” he said.
Polish officials would later discover that at least one of the parcels sent by Bezrukavyi’s group concealed a homemade incendiary device, hidden among the sex toys and reportedly crafted from a cocktail of chemicals, including highly reactive magnesium.
Over the course of three days in July, European security agencies were shaken by three separate package explosions – each sent from Lithuania – that detonated in Birmingham, UK; Leipzig, Germany; and near Warsaw, Poland.
Western security agencies were quick to suspect Russian intelligence was behind the incidents, which came amid a series of other hostile acts – including arson, cyber-attacks, data theft and the targeting of undersea cables.
It was a fourth package – sent by another member of Bezrukavyi’s network – that helped Polish authorities piece together what was happening. Dispatched from Vilnius on 18 July, the parcel was prepared by a Ukrainian national, Vladyslav Derkavets, and disguised as a shipment of cosmetics and sex toys.
Unlike the others, the package failed to detonate at a depot in Warsaw, allowing investigators to recover it intact and analyse its contents.
Reuters earlier reported that the devices were rigged to ignite using pre-set timers repurposed from inexpensive Chinese electronics typically used for tracking lost items. Their impact was intensified by tubes disguised as cosmetics, which were actually filled with a flammable gel containing compounds such as nitromethane.
The Guardian obtained what a second source involved in the scheme described as a photograph of the alleged order before it was dispatched. The image – the first of its kind to be published – shows four massage pillows, along with several cosmetic tubes and sex toys, laid on a mattress.
The source said the shipment was coordinated by the VWarrior account who paid for it via cryptocurrency, specifically the Tether crypto token, through a middleman.
According to information seen by the Guardian, a cryptocurrency wallet said by a source to be linked to VWarrior transferred the equivalent of $960 (£720) to another wallet in July as payment for the delivery.
A screenshot of the VWarrior telegram account, no longer active, shows a person in tactical gear and helmet, face hidden. The Guardian was unable to reach VWarrior for comment.
It remains unclear what role exactly Bezrukavyi and his associates played in the three parcel deliveries that caught fire. However, all the couriers appear to have operated within the same network and transported similar content of sex toys and massage pillow devices.
As European officials set off on a multinational race to find the culprits behind the mysterious fires, Bezrukavyi’s group continued their courier work, apparently under the instructions of VWarrior.
On 1 August, Bezrukavyi, together with Chabanenko, strolled through a market on the outskirts of Warsaw. They picked out two pairs of Nike sneakers and six sets of sportswear, stuffing them into a plastic bag. VWarrior then instructed them to ship the goods to fictitious addresses in Washington and Ottawa via DHL.
These shipments appear to have raised suspicion among Polish security services, who had already been on high alert after the string of explosions. Sending American-branded clothes back to North America – at steep transatlantic shipping costs – made little sense.
Polish investigators soon concluded the packages with clothes did not contain explosives in contrast to the other shipments. Instead, the shipments, they believed, were a test – a dry run to probe international delivery routes and timing for future Russian operations to target North American-bound cargo.
After receiving intelligence about the alleged plot, top officials in the Biden administration were shocked, and wondered whether the Kremlin was aware of the possible implications.
“It’s unclear whether the Russian services were aware of the fact that a fairly large number of cargo traffic goes on passenger planes,” said a former US security official, pointing out that the consequences of a mid-flight explosion could be catastrophic.
Several top officials called their Russian counterparts and asked them to tell Putin to put a stop to the operation. “I think the calls were successful,” the former security official added.
Four days after the trip to the Warsaw market, Polish police forces arrived at the flat shared by Bezrukavyi and Chabanenko in Warsaw, arresting the latter.
“From that moment on, they started picking up our friends one by one,” said Kirill.
Yevseyev, who together with Kirill had provided the car, fled to Spain where he was later apprehended and was handed over to Polish authorities. Derkavets, the Ukrainian who had sent the package that did not catch fire, was arrested in Poland.
Kirill spoke to the Guardian from a third country, where he is hiding. A law enforcement source confirmed there was an Interpol red notice issued by Poland for Kirill for “sabotage and espionage of a terrorism nature”.
Bezrukavyi was out grocery shopping when the police came for him. His friends warned him about the raid, according to his wife, Natalia, and instead of returning home, he went on the run.
He fled to Slovakia, where he spent the next few weeks hiding out in small villages. He decided to attempt to return to Russia, telling Natalia he would rather risk arrest at home than keep hiding in Europe. But on the way, while in Bosnia, Polish authorities caught his scent.
Natalia painted the whole case as a huge misunderstanding. “He is completely innocent. This is all a very bad dream,” she said.
Warsaw, however, considered Bezrukavyi important enough for the head of its domestic intelligence services to fly to Bosnia to discuss his extradition with his counterpart in the Balkan nation, according to a source with direct knowledge of the meeting.
There are also indications that Russia valued Bezrukavyi. Shortly after his arrest in Bosnia, Russian officials initiated a parallel extradition request – citing a 2019 criminal case as the basis.
Moscow frequently relies on old charges – or launches new ones – against its own citizens, including intelligence operatives and Kremlin-linked businessmen, to establish legal grounds for demanding them back.
Bezrukavyi’s background, in the criminal circles of Rostov region, does not contain any of the red flags previously present in staff GRU officers who travelled to direct operations in Europe. Western intelligence officials say that, hit by travel bans and western sanctions, Moscow now prefers to use freelancers on the ground.
“What we see recently is that staff officers of the Russian intelligence services rarely leave Russian territory, instead recruiting agents to do the work remotely, often via Telegram,” said one European security official.
These freelancers might know nothing about what they are doing, or they might be trusted coordinators, taking orders from contacts in the security services and recruiting others to run operations.
Another western security official, who was briefed on the case, said they believed Bezrukavyi was knowingly working for the GRU, who directed the operation to send the clothing parcels.
He recruited friends – many of them financially struggling and with criminal records – who may not have fully understood the true purpose behind the tasks they were given.
Kirill told the Guardian he had never suspected the parcels could be linked to intelligence work. He admitted he could not be fully certain that his old friend Bezrukavyi was also in the dark about the true purpose of the packages.
Perhaps he knew more than he let on. But even then, he said, he did not think his friend would have been acting from any sense of higher calling.
“I’m sure he didn’t do it ‘for the Motherland’ – he just wanted easy money. He’s been a criminal his whole life,” said Kirill.
One thing is certain, he added. If the Russian services continue their sabotage offensive, there are sure to be more arrests: “There will be others who’ll want to make some money, and someone will be there to take advantage of that.”
Russia’s spies: Uncovering Russia’s secret espionage programmes. On 22 May, join Shaun Walker, Christo Grozev and Daniela Richterova as they discuss how Russia is using deep undercover agents known as “illegals” to infiltrate the west, live in central London and livestreamed globally.Book tickets hereor atGuardian Live