German federal prosecutors have revealed the arrest of three Ukrainian nationals accused of orchestrating a sabotage operation on behalf of Russian state actors. On Wednesday, authorities in Cologne and Bern announced that the men sent two unassuming parcels in late March containing covert GPS trackers. Prosecutors allege this represented a “test run” designed to map out potential routes for future shipments of explosive devices to targets in Ukraine.
The investigation began when German security services intercepted the first parcel at a sorting facility in western Germany. Upon inspection, officers discovered the concealed tracking units, prompting a nationwide manhunt. Over the past weekend, two suspects—identified only as Vladyslav T and Daniil B in accordance with German privacy laws—were apprehended in Germany. On Tuesday, Swiss police detained the third man, Yevhen B, after receiving an extradition request from Berlin.
Authorities stress that at this stage no actual explosives were found in the parcels; instead, the focus was on reconnaissance. “The test packets were intended to ascertain viable routes for sending out arson or explosive packages in a coordinated campaign,” the federal prosecutor’s office said in a statement. Had the plan proceeded, parcels would have been loaded onto air or land transport bound for Ukrainian addresses, potentially endangering civilian lives.
Suspects’ Alleged Ties to Russian State Actors
German prosecutors allege the three men communicated directly with individuals linked to Kremlin institutions. While the precise chain of command remains under investigation, officials say encrypted messages indicate the suspects were in regular contact with handlers in Moscow. “We know that Russia is trying to destabilise Western democracies by all means—including targeted sabotage and perfidious intelligence methods,” said German Justice Minister Stefanie Hubig.
READ MORE: American-Israeli Hostage Edan Alexander Freed by Hamas After 580 Days
The accused reportedly offered their services to Russian operatives, volunteering to carry out “special tasks” behind the lines. Prosecutors have charged them with attempting to plan acts of terror and endangering public safety. If convicted, the men could face sentences of up to 10 years imprisonment under Germany’s terrorism statutes.
Pattern of Hybrid Attacks Escalates Across Europe
This alleged plot follows a string of high-profile sabotage attempts traced to Russian covert operations since Russia’s full-scale invasion of Ukraine in February 2022. Last summer, explosive parcels detonated in cargo depots across the United Kingdom, Germany and Poland—incidents later described by European security agencies as test runs for in-flight bombs intended for the United States. Russia has consistently denied responsibility, but Western intelligence officials have pointed to similarities in packaging, shipping routes and communication methods.
Beyond parcel bombs, European capitals have faced a surge in suspected hybrid warfare tactics. In Poland, investigators implicated Russian government entities in a major fire at a Warsaw shopping centre in May 2024. Meanwhile, Lithuanian authorities continue to probe a suspicious blaze at an IKEA complex last year. Undersea infrastructure has also been targeted: in late 2022, explosions tore through Nord Stream pipelines in the Baltic Sea, triggering widespread environmental and security alarms.
Security experts warn that such acts of sabotage are calculated to sow distrust in public institutions, divert law-enforcement resources, and undermine Europe’s unity in supporting Ukraine. “These aren’t isolated incidents—they form part of a coordinated campaign to erode confidence in Western democracies,” says Dr Anna Müller, a Berlin-based expert on Russian hybrid warfare.
Legal Proceedings and Extradition Requests
Following the arrests, the Swiss Justice Ministry confirmed that Germany has formally requested Yevhen B’s extradition on charges of attempted terrorism. Under Swiss procedural rules, authorities have 40 days to grant or deny the request, barring exceptional circumstances. Should the man be surrendered to German custody, he will join his two co-accused in a Cologne detention facility awaiting trial.
Berlin prosecutors have yet to set a date for the suspects’ first hearing. The defense teams are expected to challenge the admissibility of evidence gathered from the test parcels, arguing that the GPS devices alone do not constitute a criminal offence under German law. However, counter-terrorism specialists note that even reconnaissance for attack planning can be prosecuted as an attempted act of terror.
Broader Context: Hybrid Warfare and European Security
The unfolding case underscores a broader shift in Russia’s tactics, moving beyond conventional military aggression to embrace asymmetric, deniable methods. Parcel bombs—relatively low-cost, low-risk for handlers—can bypass heavy security screening at airports and freight depots. Similarly, sabotage of civilian infrastructure has outsized symbolic impact, attracting intense media coverage and fomenting public alarm.
European governments have responded by bolstering counterintelligence cooperation and tightening postal and cargo screening protocols. The European Union’s new Critical Entities Resilience Directive, set to take effect later this year, mandates member states to harden key infrastructure against sabotage, including transport hubs and communication networks. NATO has also issued guidance to member militaries on defending against hybrid threats.
In Germany, the Federal Office for the Protection of the Constitution (BfV) has elevated the parcel-bomb threat to its highest alarm level. In recent weeks, postal workers and courier companies have received briefings on how to spot suspicious shipments; additional X-ray scanners have been deployed at major sorting centres.
Implications for Ukraine and Beyond
For Ukraine, the arrests offer a mixed message. On one hand, they demonstrate the vigilance and collaborative success of European security services in intercepting Russian-backed plots. On the other, they confirm that Kyiv remains a target far beyond the conventional battlefield. Ukrainian government officials have welcomed the German and Swiss actions as evidence of solidarity against Russian aggression.
“Every disrupted sabotage operation is a victory for European unity and peace,” said Ukraine’s Ambassador to Germany, Andriy Melnyk. “But it also reminds us that the war continues in the shadows, and we must remain vigilant.”
Western intelligence agencies now warn that Russia may escalate such hybrid operations further, targeting political processes, energy grids and digital infrastructure. Experts advise private-sector partners—from logistics firms to manufacturing plants—to review their security protocols and report any anomalies in freight movements or communications.
Conclusion: Vigilance in the Age of Hybrid Threats
The arrests of Vladyslav T, Daniil B and Yevhen B underscore Europe’s evolving security landscape, where open warfare is complemented by clandestine sabotage. While the unfolding legal case in Germany and Switzerland will test prosecutors’ ability to convert thwarted plans into convictions, it also reinforces the necessity of international collaboration against state-sponsored hybrid threats.
As European nations navigate this complex terrain, from enhanced cargo screening to legislative overhauls, the message is clear: defending democracy today means securing not only borders and airspace but also every parcel on the conveyor belt.
