Almost every day brings news of hybrid attacks in Europe. Russia, in particular, is constantly testing how far it can go before its actions can be classified as a direct military attack. One increasingly common form of such attacks is arson, as illustrated by the fire at Milrem Robotics' factory in Lasnamäe. Rather than trained James Bond-style operatives, the perpetrators are often local petty criminals.

"I got home with my friends at around 11 p.m. We had dinner, chatted and went to bed. I hadn't even fallen asleep when I heard some unusual noise outside. I looked out the window and saw that the car parked next to my house was already on fire," recalled Ruslan, a victim of a series of arson attacks.

The 50-year-old small-business owner from Harju County has been the target of a criminal campaign and his life and property may still be at risk. Over the past three years, at least four passenger cars he used have caught fire, along with a vacation cabin, while a building he owned that operated as a tourist center burned to the ground.

"Absolutely every time, without exception, there were people either in adjacent rooms or in the immediate vicinity. The greatest distance between the fire and the people was 10 meters," Ruslan added.

The repeated fires involving his property are remarkable in themselves, but it has since emerged that Ruslan's attackers were also carrying out an assignment for Russian military intelligence during the same period. Russia has been organizing similar acts of vandalism and arson across Europe at an accelerating pace, with the aim, according to experts, of sowing confusion and testing how far it can go before its actions are considered overt aggression.

"Looking at the potentially bloody operations they have undertaken in the past, you could say they have calculated that there could be a major explosion and they still wouldn't face a serious response," security expert Meelis Oidsalu explained.

"These attacks have become increasingly dangerous: Explosives are being used and buildings are being set on fire. We also know of cases in Europe where individuals have been targeted. These are all quite serious activities and I would say that the more desperate Russia becomes in its war in Ukraine, the more intense these attacks could become," said Marta Tuul, bureau chief of the Estonian Internal Security Service (ISS/KAPO).

To be clear, Ruslan is not a GRU target. The motive behind the attacks against him is personal and the investigation into who is seeking revenge against him is still ongoing. Nevertheless, Ruslan's case provides a vivid illustration of how a series of arson attacks is carried out.

"Because things kept happening to me systematically that were difficult to anticipate and that I couldn't understand, I was forced to install cameras. I installed video surveillance everywhere, incidentally, on the police's recommendation," Ruslan said.

On October 31 last year, a few minutes after midnight, two hooded men approached the gate of Ruslan's home just outside Tallinn. Both had their faces covered and one was carrying a canister. The men approached the car Ruslan used for work, doused it with gasoline and, moments later, flames erupted.

Surprisingly, the arsonists did not stop there. Just an hour and a half later, at around 1:30 a.m., two apparently similar hooded figures arrived at Ruslan's summer property and attempted to set fire to a cabin there. However, either a mistake by the attackers or the damp weather prevented a larger fire.

To Ruslan's surprise, the investigation was handed over to the ISS, with prosecutor Gardi Anderson, who has handled several other hybrid attack cases, taking charge of the proceedings.

"At first, I was surprised, but later everything fell into place. The suspects are not only suspected of committing a crime against me, but also of offenses against public order and the state," Ruslan said.

A few weeks after the latest arson attack, three young men from Maardu were detained: Martin Jaagumets, then 23, Aleksandr Grebeljuk, 22, and a 14-year-old boy whom we will identify only by the initial D because he is a minor.

"In this particular case, we are dealing with three young men who are friends, come from the same place and share common interests," Anderson explained. "The young men were members of the same Telegram group where a job was posted calling for four arson attacks. Anyone in the group could have picked it up. This time, these young men decided to accept the assignment and announced that they would carry it out."

A group called "МАШИНА," or "CAR," exists on the Telegram messaging app where, astonishingly, an advertisement was posted seeking people willing to carry out arson attacks. The three young men in our story took up the offer.

The clients, using the aliases "Hardu" and "Said," provided a list of addresses and instructions to find a vehicle, buy lighter fluid, carry out the arson attacks, film the execution of the assignments and send video evidence. They were promised €1,000 for each job. Counterintelligence agencies in several countries confirm that trained agents are not used to carry out such acts. Instead, petty criminals and fools are recruited through social media.

"Often, there are several links in this chain. Someone in the group notices a job offer and passes it on. In recent cases, we can say that the people accepting these offers are individuals who have had trouble in life. [...] When an offer is posted in a Telegram group, someone picks it up and passes it along. The vandals who are offered the jobs are often drug addicts, petty thieves or fraudsters. Sometimes the perpetrators know who they are working for and sometimes they don't," Tuul explained.

The trio's campaign of destruction took place in late October last year. First, on the night of October 29–30, they set fire to a Mercedes-Benz parked in the courtyard of an apartment building in Lasnamäe while its owner was asleep at home. On the night of October 30–31, they set fire to Ruslan's car and vacation property. Then, on the night of October 31–November 1, they vandalized memorials to soldiers killed in the Battles of the Blue Hills in the village of Vaivara, Ida-Viru County. Investigators also obtained videos the young men had recorded and sent to their clients.

"They were probably surprised at how quickly they were caught, which is why they hadn't deleted the videos," Anderson said.

While the first incidents have no known connection to geopolitics or intelligence operations, the final assignment was ordered by Russia's military intelligence agency, the GRU. Had the young men not been caught, they would likely have been used again.

"They often start with simpler jobs. Once those have been completed and evidence has been submitted, increasingly serious assignments are gradually offered. What begins as an offer to paint over or damage a memorial can, after a few trial assignments, very quickly escalate to arson or an attempt on someone's life," Tuul added.

"Fortunately for us, these saboteurs aren't particularly skilled. They are recruited more or less at random. Just as you can hire a plumber through the hange.ee website, you can post odd jobs on Telegram, advertise the payment and see who turns up. Most of those who take these jobs are men in their 30s who have had trouble with the law and are financially vulnerable," Oidsalu said.

Estonia was among the first countries to encounter such hybrid attacks and adopted a policy from the outset of identifying the perpetrators and bringing them to justice. For example, the chain of intermediaries involved in the December 2023 vandalism of vehicles belonging to then-Interior Minister Lauri Läänemets and the editor-in-chief of Russian-language Delfi was longer, but the GRU was identified as the ultimate client.

"The mastermind behind the operation was Allan Hantsom, who recruited a series of other people, who in turn recruited more people, in the hope that they could intimidate Estonian society and create a sense of dissatisfaction with the government's work," Tuul said.

Similarly, the ISS believes the GRU was behind the January 2025 arson attacks on a grocery store in the village of Osula, Võru County and, a few days later, a Ukrainian restaurant in Tallinn's Telliskivi area. The criminals smashed a window at the restaurant and threw a Molotov cocktail inside, but security camera footage shows that one of the arsonists also caught fire during the attack.

"The arson attack on the Coop store in Võru County was a trial run before the assignment involving the Slava Ukraina restaurant. Two Moldovan citizens were given the task to see whether they could carry it out. Once they succeeded, they were given a more serious assignment, which was to set fire to the restaurant near Balti Jaam," Tuul said.

"When the interior minister's car window is smashed, the target audience is politicians. When someone sets fire to a Ukrainian restaurant near Balti Jaam, the aim is to make the Kalamaja community wonder whether Estonia's chosen security policy is too dangerous and whether the state can protect them. These small, seemingly sporadic acts are used precisely to amplify such messages," Oidsalu explained.

While such attacks were initially observed primarily in countries neighboring Russia, they have now spread more widely and the methods have become more reckless. Examples include the GRU's attempt in the summer of 2024 to place parcel bombs on cargo aircraft, the August 15 arson attack on Milrem Robotics' factory in Tallinn this year and the burning of Starlink satellite communications antennas near Vilnius two weeks ago. Given the growing frequency and brazenness of these attacks, experts say it is only a matter of time before one causes mass casualties.

"We have been fortunate in cases such as the railway bombing in Poland where the potential damage could have been enormous. The same applies to the 2024 incendiary parcel operation, in which two passenger planes could have exploded in midair," Oidsalu said.

"These are all quite serious activities and I would say that the more desperate Russia becomes in its war in Ukraine, the more intense the attacks could become," Tuul reiterated.

"The Russians' current methods are already dangerous enough. So far, we've been relatively lucky that there hasn't been a major explosion. I'm waiting for that moment with some apprehension because we don't yet know whether Europe and NATO have an effective response if major damage occurs. And I'm not just talking about financial damage, as in the cases of Balticconnector and the undersea cables. This is the next major decision we need to prepare for today so that we can find an effective response. The Russians are now looking for a major, visible and bloody impact and we must be prepared for it," Oidsalu warned.

Ultimately, the ISS established that the arson attacks involving Ruslan had not been ordered by Russian intelligence services, but the attack on the Blue Hills memorial had. The young men who set fire to Ruslan's car and cabin were prosecuted and convicted. Because they managed to demonstrate that they were unaware a hostile state was pulling the strings behind the Blue Hills memorial attack, they were convicted only of damaging another person's property and desecrating the memory of the dead, and received partially suspended sentences. The Police and Border Guard Board (PPA) is continuing to investigate who ordered the arson attacks against Ruslan.

"Only fools aren't afraid. Of course I'm afraid. Especially since I've found myself, through no choice of my own, caught up in these repeated incidents. Yes, of course I'm afraid. I'll say it again: My daughter has developed health problems because of the psychological stress. I have children and property. Of course I'm afraid," Ruslan said.

So, once again, going along with foolish proposals found online ends badly and if you see anything suspicious, you should report it to the appropriate authorities.

--

Follow ERR News on Facebook and X and never miss an update!