Lithuanian prosecutors and the Criminal Police Bureau have uncovered a group that organized and planned to carry out four terrorist attacks across European countries, with explosives hidden in massage pillows and delivered through DHL and DPD shipping services.
The investigation revealed that on 19 July 2024, Lithuanian citizen AS (born 1973), working with accomplices, used international delivery services to send homemade incendiary explosive devices. Two packages were addressed to the United Kingdom and sent on DHL cargo planes, while two others were sent to Poland via DPD cargo trucks.
The attacks unfolded over three days in July 2024. The first package exploded and ignited at Leipzig Airport in Germany at 05:45 on 20 July, just before loading onto a DHL cargo plane flying the Vilnius-Leipzig-United Kingdom route. A second package detonated at 02:15 on 21 July in a DPD truck traveling through Poland. The third exploded at 03:36 on 22 July at a DHL warehouse in Birmingham, United Kingdom. The fourth package, transported by DPD ground transport through Poland, failed to detonate due to a malfunction in the detonation mechanism.
Investigators determined that the devices were controlled by electronic timers hidden inside massage pillows. Additional flammable mixtures were concealed in hygiene and cosmetic tubes to enhance the incendiary effect. The devices used thermite, an industrial and military substance with extremely high combustion temperatures.
Given the case's significance and the goal of committing terrorist attacks across multiple countries, Eurojust established a joint investigation team. Law enforcement and intelligence agencies from Lithuania, Poland, the United Kingdom, Germany, the Netherlands, Latvia, Estonia, the United States, and Canada are cooperating closely in the investigation.
The investigation established that Russian Federation citizens organized and coordinated these crimes, with connections to Russian military intelligence. Several coordinators were directly linked to an attempted terrorist attack on 9 May 2024, in Vilnius, when the IKEA shopping center was set on fire.
Two key suspects were identified: Ukrainian citizen Danylo Hromov (born 1988), who also uses personal data of Russian citizen Yaroslav Mikhailov (born 1988), and Tomas Dovgan Stabachinskas (born 1971), who holds both Lithuanian and Russian citizenships.
The investigation revealed that other citizens of Lithuania, Russia, Latvia, Estonia, and Ukraine were recruited for specific tasks during the attack preparation. They were found through acquaintances, recruited and maintained contact through the Telegram app, with payment offered in cryptocurrency.
The group operated with strict conspiracy protocols, fragmenting tasks among different executors who were typically unconnected to each other. Tasks included transporting packages and flammable substances, transferring them to other participants, hiding them in caches, and activating devices.
More than 30 searches were conducted in Lithuania, Poland, Latvia, and Estonia. During the comprehensive investigative actions, authorities seized explosive substances hidden in tin cans and detonators from illegal circulation. Some devices were manufactured to produce a directed explosion effect using RDX explosive. The total power of the seized devices exceeded 6 kilograms in TNT equivalent. According to the data, these devices could have been intended for other terrorist attacks.
At this stage of the pre-trial investigation, suspicions for organizing and preparing the specified crimes have been presented to a total of 15 suspects - citizens of the Russian Federation, Lithuania, Latvia, Estonia, and Ukraine.
