Russia-linked spy ring exposed in Lithuania over plot to attack Ukraine aid
Photo: Lithuania uncovers large-scale Russian network (facebook.com Lietuvos.policija)
Lithuanian intelligence services have uncovered a network of agents linked to Russia’s GRU who were plotting assassinations, gathering intelligence on military infrastructure, and preparing arson attacks on equipment destined for Ukraine, according to Lithuania’s Criminal Police Bureau and the Office of the Prosecutor General of Ukraine.
Plot to burn equipment for Ukraine
Investigators found that the suspects were acting with terrorist intent. In addition to planning killings, they collected data on military infrastructure and prepared to set fire to military equipment that was to be sent to Ukraine.
The actions were planned and coordinated as part of a broader subversive activity in the interests of the GRU, Russia’s Main Intelligence Directorate.
How it started
In early 2025, a Russian citizen living in Lithuania discovered a tracking device in his car.
He reported it to the police, triggering a large-scale investigation. Investigators determined that he had been a real target for assassination. Another man, a Lithuanian citizen, was also targeted, likely because of their political views.
Who was involved
Since the summer of 2024, agents had been gathering intelligence on the targets, including through technical surveillance devices. Those involved included citizens of Russia, Belarus, Ukraine, Georgia, Latvia, Moldova, and Greece who either lived in Lithuania or traveled there with a specific purpose.
Photo: Arrest of the suspected perpetrators (lkpb.policija.lrv)
The operation was to be carried out by two Greek nationals, one of whom also held Russian citizenship. Both are linked to organized crime.
In Lithuania, they consulted with local criminal groups about the victims’ whereabouts, escape routes after the crime, how to obtain weapons, and how to dispose of them.
On March 12, 2025, the main suspects were detained in Vilnius. Investigators later identified those who organized and financed the crimes.
In early 2026, a joint international operation led to searches and arrests in Poland, Ukraine, and Greece.
Out of 13 suspects, nine are in custody, while four are subject to European arrest warrants. Three have already been extradited to Lithuania, and the transfer of two more is being decided.
Prosecutor’s office confirms participation in the operation
"The preparation of serious crimes in EU countries has been stopped. The perpetrators, intermediaries, and coordinators who organized and financed the activity have been identified," the statement said.
The statement also noted that acts of sabotage were documented at a military enterprise.
Investigators further established that members of the group were planning violent actions against military personnel and civilians in Ukraine.
Meanwhile, RBC-Ukraine reported that Ukraine’s Security Service, together with the FBI, Polish counterintelligence, and EU law enforcement agencies, carried out an international cyber operation against the GRU.
Russian operatives hacked home and office Wi-Fi routers belonging to Ukrainians, Europeans, and Americans to intercept passwords, correspondence, and data belonging to military personnel and government officials.
RBC-Ukraine also reported that Ukraine’s Security Service detained an FSB agent near Kyiv who had been recruited via Telegram. He conducted reconnaissance around Kyiv’s power plants and identified locations of Ukraine’s Defense Forces.
