Destroyed monuments and cemeteries, vandalised cars, arson attacks, and assassination attempts. A network of Russian saboteurs operates throughout Central Europe and the Baltic States.
This network is becoming increasingly active. The agents recruited through Telegram are trying to spread in different countries. Unexpectedly, there are a lot of Ukrainians among them.
This investigation was the result of NGL.media’s cooperation with journalists from RE:Baltica (Latvia), FRONTSTORY.PL (Poland) and Delfi.ee (Estonia).
Maksym Leha, 22, only recently moved from Poltava to Warsaw. Everyone around him was talking about the war, but there were still a couple of weeks left before the Russians invaded Ukraine on a full scale. It was February 2022, Maksym was earning on the side as a rental agent and looking for another job. By chance, he saw an ad on Telegram: “Draw hashtags and earn money”. He clicks on it.
Maksym Leha (photo 2019)
A year later, his girlfriend would testify to the Polish prosecutor’s office that her fiancé often brought home cameras and SIM cards (she was sure they were for sale). From time to time, he also travelled outside Warsaw, allegedly for volunteer work.
In fact, Maksym Leha, together with 13 other Ukrainians, two Belarusians and a Russian, created a sabotage organisation that planned to blow up a railway line used to transport military equipment from Europe to Ukraine. The group consisted mainly of young men. None of them had any previous conflicts with the law. None of them had anti-Ukrainian views.
He has always been against Russia.
Soon, Maksym Leha becomes one of the most important members of the group. After responding to an ad on Telegram, he meets a man who introduced himself as Andrii.
“Andrii” the members of the sabotage group did not know the real name and surname of the group’s handler, and he has not yet been identified has the highest status: he assigns tasks, introduces network members to each other, and pays them. He is considered the commander and the main recruiter. At some point, he introduced Maksym to Artem Averba, 19. Since then, they have been inseparable, doing tasks together and recruiting other people, usually their friends or acquaintances. Sometimes they themselves were looking for new saboteurs in Telegram groups with job ads. They offered quick big money.
One of those who fell into their trap was Yaroslav Boguslavets, 44, from Dolyna town in Ivano-Frankivsk region. His family and friends still do not believe it. “How can he be a spy? He served in the ATO for a year and a half! – says Sofia, 83, the man’s mother. “He has always been against Russia. He was constantly fighting with my brother, who is a Putin supporter.”
Yaroslav Bohuslavets from Dolyna fought in the ATO for a year and a half, and now he is wanted in Poland for spying for Russia (photo by NGL.media, from Sofia Bohuslavets’ home photo archive)
Sofia Bohuslavets has not had any contact with her son for two years. In April 2022, she reported his disappearance to the police, although the Ukrainian police do not search for missing persons abroad.
Yaroslav, who, according to his mother, has always been anti-Russian, is put in touch with a Russian recruiter by Roman Zabolotnyi, a friend of his from Ukraine. Bohuslavets, who works for a magazine in Krakow, writes directly to “Andrii” on Telegram, saying that he would not mind earning some money. Soon he receives his first assignment. He has to paint seven anti-war graffiti. His reward is $50 each. “Andrii” pays in bitcoins and transfers the money through Maksym Lega.
Yaroslav will be detained along with everyone else, but he didn’t go to prison. In the winter of 2024, similar to two other saboteurs Ukrainian Artur Melnyk and Belarusian Maria Medvedeva , who had committed to attending court hearings not to be arrested, he disappeared from the Polish justice system. The wanted notice has not yet yielded any results – it is as if Yaroslav has dissapeared into thin air.
“Barbados” offers graffiti
Another saboteur who has so far escaped punishment, is Artur Melnyk, a teenager from Chernihiv. In February 2022, shortly before the outbreak of a full-scale war in Ukraine, his parents reported their son missing. Later, Artur turns up in Poland, goes to school in the town of Przedbórze in the Lodz Voivodeship, but the town is too small for him, and he wants to move to Lodz.
He is not interested in studying; he is looking for a job. He is trying to make money as an online designer. In a Telegram dating chat, he meets another Ukrainian teenager, Rostyslav Koniuchenko,16. Rostyslav, who goes by the nickname Barbados, offers him a job painting graffiti and handing out leaflets, and later a job as a courier.
Later, they became friends. From the testimony of Artur Melnyk: “We met, rode scooters and ate in the city. He paid for everything. It was obvious that he had money. He lived in a modern high-rise building and rented the apartment through a rental service. When the landlord realised that he was under 18, Rostyslav moved into a refugee home.”
In June 2022, the Polish police took Rostyslav Koniuchenko to a juvenile detention centre. An employee of the centre recalls: “He was in a sports club late at night, and the police brought him to us. He said he was dealing in cryptocurrencies and that he was receiving money from Ukraine. He showed us cash. He was rude, impudent and vulgar”. At the time, the centre staff were surprised that the teenager was using three different phones.
From Arthur’s testimony: “He said that he earns money by acting as an intermediary in finding young people to perform certain tasks. He said that I could make money from this too, and that I would get $20 for each person who contacted him […] I didn’t know what tasks he was talking about.”
As a result, Artur brought Rostyslav some fifty candidates. According to our estimates, this subversive group alone completed at least 500 ‘tasks’.
Rostyslav Koniuchenko himself receives assignments directly from ‘Andrii’, and later offers Artur a special task for USD 200 – to buy video cameras and bring them to Warsaw.
Arthur does a good job with this task and Rostyslav asks him to buy cameras again. What will they be used for? Andrii reassures him: to enhance the security of a new store in Warsaw.
Arthur hands the cameras to a stranger in a black hoodie – it’s Maksym Leha. Soon they went together to Rzeszow. There they installed one of the cameras near the local airport, which at that time had become a transport hub for Western military aid to Ukraine.
After a while, the police find the camera and the case becomes publicised in the media.
In March 2023, Rostyslav calls Artur and asks him to immediately delete all his Telegram messages. Artur managed to do so, but that evening, employees of ABW the Polish Internal Security Agency came to his apartment. The security services arrest all 16 members of the group, one by one.
December 2023. A court in Lublin issues sentences against 14 of the 16 defendants. Maksym Leha and Artem Averba received the largest sentences – 6 years each. According to Polish intelligence services, the network could have included more than ten other people who were not identified.
On January 9, 2024 ABW reported the detention of Belarusian citizen Daria Astapenko, who allegedly worked for KGB. Evidence of cooperation with Belarusian services since 2017 was found on her phone.
Another saboteur was arrested by the end of the same month. He is suspected of organising arson attacks on a paint and varnish factory in Wroclaw. In May 2024, two more Belarusian citizens and a Pole were detained, suspected of preparing arson attacks in Warsaw, Pruszków and Pomerania.
Were they all recruited via Telegram and were they part of Russian agents? ABW is still establishing this.
A spy loses a note
In May 2022, a landlady from the small Latvian village of Rembate, an hour’s drive from Riga, is working in her garden. She sees a black car making a U-turn on the driveway. A young man gets out of it for a moment. He doesn’t notice that he’s dropped something, and the car drives off. A rolled piece of paper is lying where it stopped. The landlady picks it up and forgets about it, preoccupied with her own business.
She reads the note only the next day and immediately passes it on to her son-in-law, the military. The note will send the Military Intelligence and Security Service into a frenzy and Militārās izlūkošanas un drošības dienest – the counter-intelligence of the Latvian Ministry of Defence and Armed Forces : the next day, investigators from this Latvian special service were already working in the village.
The lost note that appears in the investigation of the Latvian Military Intelligence and Security Service (photo by RE:Baltica)
Why this reaction? Perhaps because of the note’s title: “Mission, Lielvarde military airfield”. The sheet contains precise instructions on what to photograph at the airfield and how to react in case of compromise. On the back of the note you can see a drawing of an aeroplane made by a child’s hand.
The village of Rembate is located just a few kilometres from the Lielvarde base, where military aircraft, including American Black Hawk helicopters, are stationed to monitor the airspace over the Baltic Sea.
The lost note led Latvians to a network of saboteurs organised by Russian services, which, among other things, set fire to a building in Kyiv a month before Russia attacked Ukraine.
Normunds Mežviets, the head of the State Security Service of Latvia, believes that the aim of this action was to sow fear and uncertainty among Ukrainians: “Exactly what Russia is now trying to do in Europe using acts of sabotage.”
Information gathered by our Latvian partners at RE:Baltica shows that Russian operations have intensified in recent years. At least eight serious incidents have been recorded in the Baltic States and Poland alone.
This year, the Estonian security service KAPO detained 13 people for desecrating several national memorials and vandalising the cars of the interior minister and a journalist. In Latvia, two men tried to set fire to the Museum of Occupation in February Last year in Poland, a group of saboteurs were convicted of spying for Russia and planning to blow up a railway line carrying aid to Ukraine.
Sergejs is looking for soldiers
The note that the landlady found in Rembate was very useful to the Latvian authorities. It contained both detailed instructions and exhaustive lists of expenses. It included notes on the cost of two nights’ accommodation in a guesthouse near the airfield and a rental receipt for a Canon camera.
The investigators visited the guesthouse near the airfield. The owners remembered a young, tall man named Sergejs. He was wearing a T-shirt and torn jeans, his hair was tied in a ponytail, and he paid cash. He asked where the soldiers from the airfield went to have fun. The owner recommended the Kante cafe.
Black Hawk helicopters at Lielvārde airbase (photo courtesy of the Latvian Ministry of Defence)
However, the note mentioned a Canon camera rental company. It turned out that the rental company had a copy of the young man’s ID. He’s Sergejs Hodonovičs, 21. In his apartment, investigators found a phone with photos of an abandoned bunker and the soldiers’ cafe Kante’.
Hodonovičs was detained and a case of espionage for Russia was opened. According to the prosecutor’s office, “it can be concluded that his activities are part of the tasks set by the GRU of the General Staff of the Russian Armed Forces”.
Doing operation with Maliuk
In the interrogation video, Sergejs Hodonovičs sits with his shoulders hunched. Wearing a denim jacket, with shoulder-length hair and a three-day-old stubble, he tells how he was looking for marijuana in Telegram chats, how he came across a man called “Green”, who asked him to travel from Latvia to Estonia for money and paint something on the wall with spray paint. Sergejs agreed.
In April 2022, two months after Russia’s invasion of Ukraine, Sergejs leaves work early and takes a bus to Tallinn. On the way, he receives instructions and information on Telegram: It turns out that his partner in the operation is travelling on the same bus. He is carrying paint cans. Sergejs looks around and sees a short teenager, whom he calls “Maliuk”. “He was speaking Russian. His phone had the location tracking feature on,” Hodonovičs recalls.
After getting off the bus, they walked for an hour until they approached a concrete wall. This is where their graffiti is to appear, and “Maliuk” has already received its content via Telegram. They draw without diving too much into the meaning of the inscription. When the orange and red letters are ready, they take a photo and send it to “Green”. They return to Latvia by bus carrying 400 euros.
Killnet hacked you
The next morning, Estonian police receive information that the walls of the complex housing the NATO Cyber Defence Centre have been spray-painted. The words “Killnet hacked you” are repeated like a mantra on the 190-metre-long wall. Killnet is the name of a Russian-speaking hacker group.
On the same morning, several Estonian government-owned online services and websites, including the Cyber Defence Centre, fell victim to DDoS attacks. Russian cyberattacks are a daily reality in Estonia, but this is the first time such an attack went with such a message.
Police are investigating into who created the graffiti. The city’s CCTV footage shows that a taxi picked up two young men at the gate of the Cyber Defence Centre the night before. It took them several hours to complete the drawings, and they finished them only in the morning.
Russian agents paint graffiti on the fence of the NATO Cyber Defence Centre in Tallinn (screenshot from CCTV)
Another task from Green: to take pictures of the military airfield in Lielvarde. Telegram automatically deletes messages, so Hodonovičs wrote down the instructions on a piece of paper. Following them, he bought two memory cards. He downloaded random photos to one of these for disguise, and to the other, he downloaded military installations in four locations. He sent the photos from his phone. His reward: 400 euros again.
Today, we know that Sergejs Hodonovičs received assignments from several people, and “Green” was only one of them. We know that his real name is Gleb. Until recently, he laundered money by recruiting so-called “mules” – people who withdraw cash from ATMs or allow their personal data to be used to open accounts on Revolut.
However, Gleb was not the head of the network. He received tasks (from graffiti to arson) from someone higher up. He earned only 100 euros for involving Hodonovičs in a trip to Tallinn.
Gleb did not know the customer personally, and he often changed his phone numbers and nicknames (a separate criminal case has been opened against him, the investigation is ongoing). Both Gleb and Hodonovičs were just a link in a longer chain of the network. Another intermediary known as MOT was more important. He was the one who received the tasks from the client, whose name in the network was “Alexander”.
“Maliuk” prepares a Molotov cocktail
How did the investigators identify MOT? By analysing the chain of payments to Hodonovičs for photographing the airfield.
Several times Hodonovičs was transferred several hundred euros from a man named Timur, but he was not MOT. He was not a member of the group either; he just lent his Revolut card to a fellow student at the naval school. Other classmates did the same. MOT used their accounts to convert the cryptocurrency he received from Alexander. He then paid the money to the agents.
MOT was arrested in Riga. Today we know that he is Martins Griķis, 20.
In the video of the interrogation, Grikis answers in a matter-of-fact, emotionless manner, as if discussing ordinary office work. Before he started to cooperate, he sent Oleksandr a copy of his passport. He communicated with his boss via Telegram. Alexander asked him for a favour: to deposit cryptocurrency into his Revolut account, convert it into euros, and send Alexander the money.
In two years, Grikis earned about 10,000 euros in this way.
He also searched for people to perform tasks assigned by Alexander and checked their reliability. For each such “task”, Grikis received between 500 and 2,000 euros in cryptocurrency. He converted the bitcoins, paid the workers and kept a commission. He was making good money.
Hodonovičs was not the only one recruited by Grikis. “Maliuk” who painted graffiti in Tallinn allegedly travelled to Kyiv a month before Russia’s invasion to throw a Molotov cocktail into the ventilation shaft of a military building.
The Latvian authorities identified “Maliuk” as Ivans Tarabanovs. Today, we know that his superiors sent him a PDF file with instructions on making a Molotov cocktail and a plane ticket to Kyiv via Telegram. He chickened out at the last moment, and only set fire to the outside wall of the building. Then he fled by bus to Poland.
We know that Grikis (or Alexander) was looking for people to set fires in villa neighbourhoods in France, even before the arson attacks in Ukraine. He was also looking for people to work in Russian drug labs.
Who is Alexander?
Grikis testified that he had never met Aleksander, but that they had spoken on the phone. His boss was often drunk. Once he confessed that his real name was Vadym and he was from Dnipro in Ukraine. That he was 25 and a cook by profession.
There is no evidence in the Latvian investigation materials that would confirm Alexander’s links to the Russian GRU. However, according to the Latvian secret service, such a connection exists. Griķis and Hodonovičs have confessed to spying for the Russian secret services. This means that they both knew who they were working for.
A Latvian court sentenced Griķis to three years in prison and Hodonovičs to two years and eight months. Ivans Tarabanovs, the “Maliuk” who set fire to the building in Kyiv, testified that he did not know about Alexander’s ties to Russian special services. The verdict in his case will be delivered in autumn.
The head of the Latvian State Security Service believes that the creation of chains of intermediaries is a strategy to make finding the real customer more difficult. Alexander himself may not be a GRU officer. There’s a possibility he could have been recruited to find intermediaries in other countries.
The detentions in Poland and Latvia did not stop the saboteurs. In January this year, a man with dual citizenship of Estonia and Russia was caught on the Latvian-Belarusian border throwing paint on national memorials in Latvia and Lithuania. Meanwhile, arsonists who attacked a Lithuanian IKEA were arrested in Poland. In May, nine Russian spies involved in sabotage plans for Baltic countries and possibly Sweden were arrested in Poland.