Lithuanian intelligence has uncovered a Belarusian operation designed to make Vilnius appear responsible for the ongoing balloon attacks on its own territory, the State Security Department (VSD) announced on 10 December.
The scheme works like this: individuals posing as VSD officials on Telegram offer Lithuanian citizens money to travel to Belarus and launch smuggled balloons from Belarusian territory back into Lithuania. If successful, Minsk could then claim that Lithuanian intelligence itself is organizing the very hybrid attacks that have paralyzed Vilnius Airport and triggered a national emergency — attacks that Lithuania and the EU blame squarely on Belarus.
"Such actions are a gross provocation against our state," the VSD stated. "With such initiatives, the Belarusian regime seeks to create the appearance that Lithuanian intelligence itself is organizing and initiating a hybrid attack against Lithuania that has been going on for more than a month."
Key details from Lithuania's VSD statement:
- Fake VSD agents on Telegram offer money to Lithuanian citizens
- Targets are asked to travel to Belarus and launch balloons back into Lithuania
- Goal: create false evidence that Lithuania is attacking itself
- Lithuanian intelligence attributes the operation to Belarusian security services
- Anyone who travels to Belarus risks detention and prosecution by the Belarusian KGB
The trap behind the offer
The VSD warned that anyone tempted by these offers risks becoming a propaganda tool for the Lukashenka regime. The danger extends beyond reputational damage.
"If they decide to leave for Belarus, they risk their health and freedom — they may be detained and tried there by the Belarusian KGB," the agency cautioned.
Lithuanian intelligence assessed that Belarusian security services are the authors and executors of the operation. The agency urged citizens not to get involved in "the malicious actions of a foreign state, which carries strict criminal liability."
Part of a broader hybrid warfare campaign
The false flag attempt adds a new layer to the hybrid warfare campaign that has forced Lithuania to repeatedly shut down its main airport, stranding thousands of people, according to NPR. On 9 December, Lithuania's government declared a national emergency over the security risks posed by the balloons, the Associated Press reported.
EU Commission President Ursula von der Leyen called the balloon incursions a "hybrid attack" by the Lukashenka regime, and the EU's diplomatic service summoned the Belarusian Chargé d'Affaires in Brussels to deliver a formal demarche on "hybrid actions emanating from the Belarusian territory," CNN reported.
According to AP, Vilnius international airport has been closed for more than 60 hours since October due to the balloon threat, affecting more than 350 flights and approximately 51,000 passengers.
"Belarus is signalling to Lithuania that it can raise the price at any moment," Linas Kojala, head of the Geopolitics and Security Studies Center in Vilnius, told AP. "Yesterday with weaponized migration, today with balloons that are hardly separable from regime control."
Telegram as spy recruitment tool
The VSD reminded citizens that Russian and Belarusian intelligence services actively use Telegram to search for potential agents, recruit them, and maintain contact with them.
Lithuanian intelligence urged anyone who suspects they've encountered recruitment attempts to report them. The VSD is offering amnesty under Lithuanian law to anyone already involved in Russian or Belarusian intelligence activities who comes forward voluntarily.
