Fake cosmetics, massage pillows and sex toys. Crude homemade explosives. A Russian known as Warrior. A code word: Mary.

These are among the key elements of a suspected Russian-run sabotage plot that led to three parcels being detonated at courier depots in Britain, Germany and Poland last summer, a person with knowledge of the Polish investigation told Reuters.

The pillows, packed into the parcels with the cosmetics and sex toys, contained hidden homemade incendiary devices made of a cocktail of chemicals including highly reactive magnesium, according to the person familiar with the case who provided the most granular account yet of the alleged plot.

The chemicals were ignited by pre-timed detonators adapted from cheap Chinese electronic gadgets used to track items like lost keys, with the effect enhanced by the tubes of what looked like cosmetics but in fact contained a gel made of flammable compounds including nitromethane, according to the source.

"The proceedings in this case concern criminal activities inspired by Russia's GRU," this person said, referring to Moscow's foreign military intelligence agency.

Reuters is reporting the details of the investigation for the first time, drawing on the account provided by the source close to the Polish case as well as interviews with more than a dozen European security officials. The findings provide a rare insight into how sabotage campaigns play out on the ground.

European security chiefs made the parcel fires public in October, describing them as part of a "hybrid war" being waged by Russia to destabilize the functioning of countries that support Ukraine, involving tactics like arson and cyberattacks.

They said the parcels - which caught alight in warehouses, causing fires but not hurting anyone - were a dry run for a future Russian plot to detonate similar packages in midair on cargo flights to the United States and Canada.

"With the war in Ukraine, these attacks have intensified, they became more frequent, more assertive," said Nicu Popescu, Moldova's deputy prime minister and foreign secretary until early last year and now distinguished policy fellow at the European Council on Foreign Relations think-tank.

"Of course, this poses a risk to people, to citizens across the European Union."

The Kremlin rejected the accusation of Russia having a hand in the fires. "We know nothing about it," spokesman Dmitry Peskov told Reuters. "We do not rule out that this is just more fake news or a manifestation of blind Russophobia."

The Kremlin said European allegations of a Russian sabotage or hybrid campaign were wholly unsubstantiated.

The GRU didn't respond to a request for comment.

The package detonations took place on July 19, 20 and 21 in the British city Birmingham, Leipzig in Germany and near the Polish capital Warsaw.

Two EU security officials with knowledge of alleged attacks, who requested anonymity to discuss sensitive information, said the Polish cell was typical of Russian intelligence's methods. Russian handlers often recruit local criminals to carry out their plans, the officials added, giving them basic instructions via Telegram and paying each operative up to a few thousand euros per job.

The ingredients and igniters detailed in the case are widely available in stores selling products like fertiliser inputs and pyrotechnics, said Jaroslaw Stelmach, a former bomb-disposal specialist who runs the Safety Project, a consultancy that advises on the security of public buildings among other things.

While the small, crude devices might only be able to cause a small fire, they could be difficult to detect, he told Reuters. "This is an extremely cheap, very effective, highly anonymous method of producing explosive devices," he added.

WARRIOR, MARY AND A FOURTH PARCEL

The Polish prosecution case is based on testimony from at least five suspected members of the alleged sabotage cell as well as the classified findings of security services, according to the person with knowledge of the investigation.

The national prosecutor's office told Reuters that investigators had also seized a fourth parcel that failed to explode at a Warsaw depot, allowing them to examine the contents intact.

Polish investigators allege a Ukrainian named Vladyslav D who lived in southern Poland played a key role in the European dry run, acting on instructions he received on Telegram from a GRU handler whom he knew only as "Warrior", the source said.

Polish law doesn't allow the public disclosure of the surnames of people facing criminal charges. However, the suspect's full name - Vladyslav Derkavets - was publicly disclosed in a related court case in Bosnia, where there are no identification restrictions, in which another suspected member of the alleged parcels plot faced extradition to Poland.

On July 18, Vladyslav drove an Opel Astra from his home in Katowice across the border to the Lithuanian city of Kaunas where he collected more than a dozen items from the trunk of a parked car, according to the person close to the Polish prosecution case.

The 27-year-old drove on to Lithuania's capital Vilnius where he boxed up four packages, each with a pillow plus a few of the cosmetics tubes and sex toys. Before sealing them, he pressed two buttons to activate pre-timed detonation mechanisms, according to the source who said the gadgets were of a type that allowed users to set trigger times from a few seconds to months ahead.

On July 19, he handed the parcels over to a man in a park in Vilnius who used the code word "Mary", the person said. The packages were posted on the same day from the city, they added.

Vladyslav was arrested in Poland in early August and charged with performing terrorist acts on behalf of Russian intelligence. In January, a Warsaw court extended his detention near the capital until May while the investigation continues.

Reuters was unable to contact Vladyslav in detention and his court-appointed lawyer said he couldn't comment given his lack of knowledge of the details of the investigation, which is at a pre-trial stage.

The national prosecutor's office told Reuters that the suspect denied both the charges levelled at him including working for a foreign intelligence agency, and provided "extensive explanations" for his actions which the office said it was unable to disclose because of investigation confidentiality.

When questioned after his arrest, Vladyslav told investigators he had been introduced to Warrior by a friend and that they only communicated over Telegram, the source familiar with the investigation said.

Polish prosecutors accuse another man, 44-year-old Alexander B, of being part of the same Polish cell as Vladyslav. His task, they say, involved preparing the way for targeting the North American-bound cargo planes by organising for packages of sneakers and clothes to be sent from Warsaw to Washington and Ottawa to gather information about parcel-processing methods and timing.

Alexander was the suspect Polish authorities sought to extradite from Bosnia, where he was publicly named in full as Alexander Bezrukavyi, a Russian national from Rostov-on-Don. He told a hearing in Bosnian capital Sarajevo in January that he had no part or knowledge of any plot to target depots or cargo planes.

Bezrukavyi lost his extradition battle and was extradited to Poland in February. Reuters was unable to contact him in detention or reach a lawyer acting for him. He has denied the charges levelled against him including working for a foreign intelligence agency, according to the person familiar with the Polish investigation.

Reuters

Silhouettes of people walking are seen in front of the communist-era Palace of Culture and Science in the centre in Warsaw, April 2, 2025. REUTERS/Kacper Pempel

Sex toys and exploding cosmetics: anatomy of a 'hybrid war' on the West