Western security services say they have disrupted a sprawling Russian sabotage campaign that aimed to cause mass casualties on flights bound for the United States, a scale of aviation threat not seen since the attacks of September 11. Investigators describe a network of at least 20 Russian agents and proxies who allegedly tried to turn routine cargo shipments and gig-economy jobs into tools of state-directed terror. The emerging picture is of a covert war that has quietly moved into the air corridors linking Europe and North America, with passenger jets and cargo planes treated as legitimate targets.
What has been uncovered is not a single plot but a layered effort that stretches from parcel hubs in Europe to runways in the United Sta, and from low-paid “gig workers” to seasoned Russian operatives. As I piece together the reporting, the throughline is stark: Moscow’s intelligence services appear willing to gamble with catastrophic loss of life to pressure Western governments, even as they misjudge how close they are coming to a disaster that would transform the conflict with the West.
The 20 agents and the gig‑worker front
Western officials say the most alarming discovery is a cluster of at least 20 Russian operatives who allegedly worked through cut‑outs and casual labor platforms rather than traditional spy tradecraft. Instead of deep-cover illegals, investigators describe “Fake Russian” gig workers hired for mundane tasks like moving parcels or servicing warehouses, then steered toward jobs that placed them close to US‑bound cargo. According to one account, the network’s exposure followed a pattern of unexplained fires and suspicious packages that pointed back to a coordinated effort to test how incendiary or explosive devices might behave inside aviation supply chains, a pattern that culminated in the arrest of 20 Russian agents accused of planning mass casualties on flights in a scale unseen since September 11, as detailed in a Russian focused report.
Investigators say the same ecosystem of casual labor that delivers groceries and assembles furniture was quietly repurposed as a deniable logistics arm for sabotage. A separate account of “Fake Russian” gig‑worker saboteurs describes how, On July, a contractor was allegedly tasked with handling a parcel that later drew scrutiny from counterintelligence services, raising questions about how many similar jobs had already slipped through unnoticed. That narrative of covert operatives hiding in plain sight, using ordinary apps and short‑term contracts, is captured in detail in an analysis of Fake Russian saboteurs.
How the parcel‑bomb scheme was meant to work
European intelligence services say they eventually traced the aviation threat back to a parcel‑based scheme that was chilling in its simplicity. According to their assessment, European agencies concluded that a Russian sabotage network was preparing to place explosive devices on planes flying from Europe to the United Sta, using the dense web of transatlantic cargo routes as cover. The plan, as described by these services, involved routing dangerous parcels through multiple hubs so that by the time they were loaded onto US‑bound aircraft, the origin and handlers would be obscured, a method outlined in detail by European intelligence reporting.
At the heart of the operation, investigators say, were DHL logistics centers in Poland, Germany, and the United Kingdom, which handle huge volumes of parcels that eventually end up on passenger and cargo flights across the Atlantic. The key element of the scheme was to hide explosives inside seemingly ordinary shipments moving through these DHL hubs, exploiting the fact that cargo from Poland, Germany, and the United Kingdom is routinely consolidated and forwarded to North America. Officials describe a network that blended professional operatives with local helpers, some of whom were allegedly recruited or coerced, a structure that emerges clearly in accounts of how DHL hubs were turned into potential staging grounds.
From unexplained fires to arrests in Poland and the UK
The first visible signs of the plot were not mid‑air incidents but fires on the ground. Earlier in the campaign, three unexplained blazes broke out at cargo facilities that handled US‑bound shipments, incidents that initially looked like industrial accidents. Only later did investigators connect those fires to a broader pattern of sabotage testing, which they now link to the same network of 20 Russian agents accused of preparing mass‑casualty attacks on transatlantic flights, a connection drawn in a Story by Elle de Bru.
Law enforcement pressure intensified once national prosecutors began to see the fires and suspicious parcels as part of a single campaign. Poland’s National Prosecutor’s Office announced that four suspects had been detained in connection with fires at DHL hubs, describing them as part of a broader Russian operation targeting Western aviation and infrastructure. Officials in Poland framed the arrests as a direct response to a hostile intelligence service, with the National Prosecutor and the Office stressing that the suspects were tied to a sabotage campaign against Western powers, a characterization laid out in detail in a report citing Poland and its National Prosecutor’s Office.
In the United Kingdom, counter‑terrorism police opened their own inquiry after an incident at a commercial premises in Manchester raised concerns about incendiary devices linked to aviation cargo. A UK counter‑terrorism spokesperson confirmed that officers were investigating the site and its possible connection to a wider European pattern, underscoring that the case was being treated as part of a live threat to air transport. That British investigation, which sits alongside the Polish arrests and other European probes, is described in coverage of how CNN documented the Manchester incident.
Western intelligence warnings and the 05.11 inflection point
By the time the parcel‑bomb scheme came into focus, Western intelligence services had already begun warning that Russia of was experimenting with ways to ignite fires on flights to the United States and Canada. Analysts pointed to a pattern of test shipments and small‑scale incidents that looked designed to probe airline safety systems and emergency responses, rather than to bring down an aircraft outright. One internal assessment, dated 05.11, captured the growing alarm inside Western services that Russian operatives were trying to trigger in‑flight fires on routes to the US and Canada, a concern laid out in a detailed account of how Western agencies tracked the threat.
European officials later told their American counterparts that they believed the Russians were trying to ship incendiary devices that would ignite in flight, potentially forcing emergency landings or worse. Those briefings, which described a deliberate effort to compromise the safety and security of air cargo, helped spur joint investigations and new screening measures on both sides of the Atlantic. The warnings from European and American officials about Russians using cargo routes to move incendiary devices are summarized in a report that quotes how European and American services described the threat.
A broader covert war and the risk of escalation
For Western governments, the aviation plot is only one front in what they now describe as a wider Russian campaign of sabotage against Europe and North America. Intelligence assessments say that by the end of 2024, three underwater fiber‑optic cables linking Sweden to Lithuania, Finland to Germany, and Finland to Estonia had been damaged in incidents that officials suspect were part of the same covert strategy. These attacks, which also include alleged plans to poison water supplies and disrupt critical infrastructure, are portrayed as an unprecedented act of sabotage in one account that traces how, By the close of that year, Russia had expanded its operations from land and sea to the air, a pattern detailed in reporting on how By the end of 2024 the sabotage had spread from Sweden and Lithuania to Finland and Germany.
Inside Washington, the response has reportedly included direct warnings to Moscow. Advisors to Biden have privately threatened Putin with an escalation of the shadow war if Russian sabotage against the US and Europe continues, signaling that aviation plots and infrastructure attacks are crossing red lines. Those advisors argue that if Russia persists in using more effective and covert devices, Western services will have to respond in kind, a stance described in detail in accounts of how Biden aides have confronted Putin over sabotage in Europe.
More from Morning Overview