The summer of 2024 turned out to be “eventful.” A series of fires and explosions in parcels at DHL and DPD freight hubs in Europe—the UK, Germany, and Poland—led to large-scale counterterrorism investigations and raised the question in the West of whether this was part of an organized campaign controlled by Russian special services. In 2025, the traces of this story took shape in the form of specific charges, arrests, and public investigations, which suggest that these were not random incidents, but a targeted operation exploiting the vulnerability of international postal logistics.
The mechanism of the attacks turned out to be surprisingly simple and cynical. Homemade incendiary and detonating devices were disguised as household goods and sent in international parcels via standard air transport routes. In several cases, the parcels caught fire inside sorting centers or cargo compartments, causing fires that led to serious consequences. Experts and journalistic investigations point to the use of flammable magnesium-based substances and suggest that the shipments may have been a test to refine the method of delivering devices on transatlantic flights.
The key conclusion reached by European investigative authorities in 2025 was that the operations were not organized by individuals acting alone, but by people involved in Russian military intelligence or other security agencies. In the fall of 2025, the Lithuanian prosecutor’s office and police directly announced the exposure of a network “linked to Russian military intelligence” that was planning a series of terrorist attacks using courier services to deliver devices. These statements are supported by evidence of coordination of actions through encrypted channels, routing through third countries, and the use of “hired” couriers to send parcels.
Why postal and courier networks in particular? The answer lies in a combination of three factors: the global reach and accessibility of international logistics; the high level of trust in well-known carriers and the lack of checks on small parcels within freight chains; and the ability to “separate” the perpetrators from the curators through chains of intermediaries. Analysts call this a classic “hybrid” tactic, as these are limited but demonstrative acts of sabotage that sow panic, undermine trust in infrastructure, and require the diversion of resources to strengthen controls.
Specific examples from 2024-2025 illustrate this logic. On July 22, 2024, a fire broke out at the DHL sorting center in Minworth (UK) after a parcel caught fire. The event was quickly linked to similar incidents in Leipzig (Germany) and at a DPD facility in Poland. Investigations revealed patterns consisting of similar device concealment schemes and traces of shipments from the same geographical nodes (including Lithuania). Western services regarded this as a “rehearsal” for a larger-scale attack.
In the fall of 2025, the issue of “mail bombs” became the subject of criminal cases and extradition proceedings. According to the Lithuanian prosecutor’s office, the crimes were organized and coordinated by Russian citizens linked to Russian military intelligence. During the investigation, more than 30 searches were conducted in Lithuania, Poland, Latvia, and Estonia. The police seized explosives hidden in tin cans, as well as detonators. Journalistic investigations revealed the names and routes of the key organizers.
One such case attracted the attention of the international press. A figure named Yaroslav found himself at the center of a diplomatic “dispute” between European investigative authorities and Russian agencies, which, according to reports, were trying to get their agent back. This testifies to the high value of such “operatives” for Moscow and the scale of its involvement.
At the end of November this year, the Lithuanian Prosecutor General announced that sixteen people had been named as suspects in an investigation into a series of attempted terrorist attacks using incendiary devices delivered via DHL and DPD courier services. One suspect was arrested in Estonia, and Lithuania is awaiting his extradition.
What is Moscow’s goal? According to experts and investigators, several objectives are being pursued simultaneously: demonstrating the capabilities of a covert attack on European infrastructure; testing logistical gaps and the response of security services; creating an atmosphere of anxiety and distrust regarding the transportability of goods; and, in the long term, undermining the West’s economic ties.
What does this mean for security and politics? First, states and logistics operators will have to review their standards for controlling small shipments and increase the transparency of supply chains. Second, legal processes: indictments, arrests, and extraditions will become a new battleground between national justice systems and foreign policy interests.
The case involving explosive devices sent by parcel post does not appear to be a typical terrorist threat for Europe today. The results of official investigations and journalistic inquiries in 2025 indicate that Russia has employed a new political tactic, utilizing terrorism in logistics services to test the possibilities of sabotage and undermining trust, as “small” parcels risk having major political consequences.