Ex-Taxi Driver at the Heart of Russia’s Sabotage Campaign

Who: Aleksei Vladimirovich Kolosovsky, a 42-year-old former taxi driver from rural Russia. When and where: incidents in 2024–2026 across Poland, Lithuania, Britain and Germany. What happened: European officials link a criminal network he led to arson attacks, an IKEA fire and plots to place incendiary devices on cargo planes. Result: Western security services say his network, reportedly aided by officers from Russia’s G.R.U., has become a recurring tool in a broader Kremlin sabotage campaign aimed at undermining allied unity.

Key Takeaways

• European officials and court filings identify Aleksei Kolosovsky, 42, as a central coordinator in several sabotage plots tied to Russian intelligence services.
• An arson attack outside Warsaw in 2024 destroyed more than 1,000 businesses, according to investigators cited by European authorities.
• Security services attribute a separate blaze that consumed an IKEA in Lithuania to the same criminal network linked to Kolosovsky.
• Plans to fit incendiary devices to cargo planes were reportedly targeted at flights in Britain, Germany and Poland, prompting cross-border aviation alerts.
• Western officials describe Kolosovsky not as a trained intelligence officer but as a service provider who sources criminals, false documents and logistics for sabotage operations.
• The G.R.U., Russia’s military intelligence agency, is repeatedly named by officials as the primary intelligence service overseeing sabotage activity in Europe.
• Investigative reporting by The New York Times, which involved travel to eight European countries, provided much of the public detail on these plots on Feb. 22, 2026.

Background

Since Russia’s full-scale invasion of Ukraine in 2022, Western intelligence agencies have documented a rise in covert operations on allied territory that fall short of open military engagement. Those operations range from disinformation and vandalism to attacks on infrastructure and businesses. European security services say the pattern has hardened into more violent acts—arson, bombings and, in some instances, targeted killings—designed to sow discord among Ukraine’s supporters.

Security officials describe a shift in tradecraft: rather than relying solely on embedded agents or diplomatic covers, Russian services increasingly contract out tasks to criminal networks and freelancers who can operate with deniability. That hybrid model blends cybercrime, document fraud, vehicle theft and logistics to produce scalable sabotage capabilities. The model reduces direct footprints for intelligence services while exploiting preexisting criminal ecosystems across the continent.

Main Event

Investigators say Kolosovsky emerged as a facilitator who marshals people and resources for operations across Europe. He reportedly leverages contacts tied to hacking rings, fake identity markets and auto-theft groups to source equipment, transport and operatives. Western security officers interviewed for this report say intelligence officers—principally from the G.R.U.—then coordinate targets and provide operational direction.

The most destructive incident attributed to the network was a 2024 arson that devastated a commercial zone outside Warsaw, destroying more than 1,000 small businesses and causing extensive economic fallout in the region. Separately, an IKEA in Lithuania was set ablaze in a case officials now link to the same group. These attacks have been followed by uncovered plots to place incendiary devices on cargo aircraft servicing Britain, Germany and Poland, which prompted aviation and law enforcement countermeasures.

European courts and security agencies have produced arrest warrants and indictments naming individuals tied to the network; some proceedings reference coordination with Russian intelligence officers. Western officials emphasize that many of the operatives directly involved are criminals motivated by payment and opportunity rather than ideological alignment, making the network adaptable and difficult to trace back to state actors.

Analysis & Implications

The use of criminal intermediaries like Kolosovsky represents an operational evolution for Russia’s sabotage efforts. By outsourcing dirty work to people embedded in transnational criminal markets, intelligence services gain plausible deniability while preserving the option to influence planning and target selection. For Europe, this means a harder-to-detect threat that blends conventional law enforcement cases with national-security concerns.

Economically, attacks that destroy commercial infrastructure can ripple through local supply chains, insurance markets and investor confidence. The 2024 arson outside Warsaw, which destroyed over 1,000 businesses, is an example: rebuilding costs, lost livelihoods and disrupted commerce add cumulative pressure on affected communities and national economies. Politically, such incidents strain coalition politics by increasing public calls for stronger border and document controls, which can slow cooperative actions.

Operationally, aviation-linked plots raise particular alarm because of their potential for catastrophic casualty events and for amplifying fear across borders. Even failed or disrupted plots demand costly countermeasures—heightened cargo screening, additional inspections and interagency coordination—which can degrade routine commerce and introduce delays in critical supply lines.

Comparison & Data

The table summarizes the principal events linked by investigators to the network associated with Kolosovsky. While the precise casualty totals and full economic losses remain subject to ongoing probes, officials treat the incidents as part of a cohesive pattern of increasing severity in sabotage activity.

Reactions & Quotes

“He functions as a service provider to the intelligence services, not as a traditional operative embedded in a foreign agency,” a Western security official said, describing Kolosovsky’s role.

Western security official (anonymous)

“We are seeing a dangerous melding of criminal enterprise and state-directed sabotage that complicates standard law enforcement responses,” commented a European security analyst who reviewed court documents for this investigation.

European security analyst

“Disrupting these networks requires synchronized cross-border policing and intelligence exchange at a scale we have not routinely sustained in peacetime,” a senior counterterrorism official told reporters.

Senior counterterrorism official

Unconfirmed

• Exact operational directives from specific G.R.U. officers in each plot remain classified and have not been publicly disclosed.
• Some reports suggest Kolosovsky’s network operated in additional European countries beyond those cited; those ties are still under investigation.
• Alleged financial trails directly linking Russian state budgets to the criminal payments have not been independently verified in public court records.

Bottom Line

European officials and court filings paint a picture of a pragmatic, outsourced sabotage model in which criminal intermediaries play a central role. Figures like Aleksei Kolosovsky, a 42-year-old former taxi driver, have become nodes that connect illicit markets to state objectives, complicating both intelligence attribution and law enforcement response.

For policymakers, the immediate priorities are improving cross-border evidence-sharing, hardening vulnerable commercial and aviation infrastructure, and disrupting the criminal markets that provide tools and personnel. Over the longer term, allies will need legal and operational frameworks that treat such hybrid acts as national-security threats rather than pure criminality to achieve timely, coordinated responses.

Sources

• The New York Times — investigative news report (journalism; reporters traveled to eight European countries; Feb. 22, 2026).