On Wednesday morning, the Harju District Court considered whether to extradite to Lithuania Eldar Salmanov, an Ida-Viru businessman with a Russian passport, and his Estonian partner, Gelena Gusseva. The Lithuanian Prosecutor's Office suspects the couple of aiding terrorism.

According to reports, the middle-aged pair were allegedly part of a Russian military intelligence (GRU) operation in which explosives were planted aboard cargo planes.

Last month, a cross-border investigation by journalists from the Baltics, Poland and the U.S. reported that it was only by chance that a major catastrophe in a European metropolis was avoided. ETV's investigative show "Pealtnägija" spoke with some of those involved.

In the early morning of July 20 last year, at 5:45 a.m., a container caught fire in a DHL warehouse at Leipzig Airport. The shipment had just passed a security check, but because the flight was delayed, the packages had not yet been loaded onto the aircraft.

A day later, a package caught fire in a DPD courier company warehouse near Warsaw. It took 20 firefighters two hours to extinguish the blaze and nothing was left of the truck.

On July 22, a package burst into flames on a euro pallet in a DHL warehouse in a Birmingham suburb — right as a forklift operator was moving it. Around the same time, Poland's security service discovered an explosive device in a similar shipment at a local transport company's warehouse. The device had failed to detonate due to an assembly error.

Initially, none of these incidents were made public, nor did investigators immediately see a connection between them. In hindsight, however, security experts in several countries — led by the Lithuanian Prosecutor's Office — say these were coordinated acts of Russian military intelligence (the GRU), an operation that stands out as remarkably brazen even by recent hybrid warfare standards.

"The original plan was probably for these packages to explode on transatlantic flights, but instead they went off in Birmingham, Leipzig and Warsaw," said Indre Makaraitytė, head of the investigative unit at Lithuanian National Broadcaster LRT.

Holger Roonemaa, head of the investigative team at Delfi Meedia in Estonia, said there were claims the packages were meant to detonate midair. "And if they had exploded on board, it would have caused an extensive catastrophe," he said.

"I think the fact that we're discussing this in this way shows that the GRU is already getting inside our heads," commented Edward Lucas, a senior fellow at the Center for European Policy Analysis and a columnist. "We're wondering are they so cruel and so careless that they would bring down an airliner, killing all the people on board and possibly causing destruction on the ground — or was this just an attempt to intimidate us with fires going off on the ground."

The entire story could be straight out of a Cold War spy thriller — full of intrigue and unanswered questions. For instance, it's still unclear whether the bombs failed to detonate on planes purely by chance or whether the bomb makers deliberately intended only to sow confusion. What is certain is that a potential air disaster was narrowly avoided.

Both official investigators and journalists tracing the trail of the bomb packages eventually found their way to Estonia. According to available information, the first person in the European Union to initiate the chain of shipments was a Narva businessman named Eldar Salmanov.

Roonemaa said Salmanov is relatively well-known in Narva and Narva-Jõesuu. "He's been a fairly successful logistics businessman. His company acted as a representative for a Russian state-owned enterprise in Estonia and developed a system for pre-filling customs declarations to facilitate border crossings for freight trucks. It made him quite a bit of money," the journalist explained.

A Russian citizen who has lived his entire adult life in Ida-Viru County, Salmanov has occasionally appeared in the news over the years for his role in the transit business. Some of his partners in various companies were well-known members of the Center Party— former Narva Mayor Vladimir Mižui and former Riigikogu member Jüri Šehovtsov. After Russia launched its full-scale invasion of Ukraine, the logistics business dried up, but Salmanov had already amassed significant capital.

Through his company, Salmanov owns several properties in both Narva and Narva-Jõesuu.

The 67-year-old, now in custody, declined to provide detailed comments to "Pealtnägija" through his lawyer, but previously admitted that in early summer last year, a contact in Russia had asked him to mail a package from Estonia.

According to Roonemaa, Salmanov told Delfi's investigative team only that "a former business partner, also working in logistics, had asked him to send a package onward." He refused to name the person, explain how he received the package or say what it contained. "He paints a picture of himself as a well-meaning helper," Roonemaa said.

Salmanov himself, along with other evidence, confirms that he asked his partner to send the package. The parcel, which weighed a few kilograms, was mailed by his 54-year-old Gelena Gusseva, who works as a customer service representative at the Transport Administration. On June 24 last year, Gusseva dropped the package into a parcel locker in Narva-Jõesuu, located near the library and youth center. That was the beginning of the package's journey, which first took it to Riga and ultimately led to explosions in DHL warehouses.

It has since been established that the package contained electric massage cushions. However, whether the explosive materials and components were added in Estonia or later remains an open question.

The package was first carried by Omniva to Riga, then handled as hand luggage. In Riga, it was retrieved from a locker by 62-year-old Vassili Kovacs, who drove it to Lithuania's capital, Vilnius. According to his lawyer, the parcel contained ordinary items and his client had no idea it might include a bomb.

Makaraitytė explained: "The modus operandi of Russian intelligence operations is to recruit people who usually don't know one another. They don't see the full scope of the operation and sometimes don't even realize they're part of one. A task might simply be to activate a device or deliver a package. They might not even know what's inside — it's just a delivery to them."

Roonemaa and Makaraitytė, who investigated the case in Estonia and Lithuania respectively, found that most of the men caught up in the chain shared either service in the Soviet Navy or work-related ties with those who had. They do not claim that everyone knew what the package contained — but none of them were entirely innocent either. In Kovacs's case, a later search uncovered an unregistered firearm and a device capable of jamming mobile signals. He had also driven the package between Riga and Vilnius twice, as his first attempt to hand it off had failed.

A leaked photo later appeared showing what seemed to be several sex toys, lubricant tubes and four massage cushions. The tubes reportedly contained nitromethane, a highly flammable liquid, and the cushions hid electronic timers.

Aviation incident investigator Karl-Eerik Unt explained that nitromethane is a commonly available fuel used, for example, in model aviation.

According to Makaraitytė, the devices were fully activated in Lithuania in mid-July and divided into four separate parcels, which were then sent out via international courier companies. What followed were the fires in Leipzig, Warsaw and Birmingham.

Roonemaa noted that at first, these incidents were not linked to Russian sabotage or the GRU. "The possible Russian intelligence connection only surfaced several months later, when, as far as I recall, The Wall Street Journal was the first to report that the fires might be tied to a GRU sabotage operation in Europe."

On September 17, at the same time as a series of joint investigative articles were published across multiple countries, the Lithuanian Prosecutor's Office officially announced that the operation had been carried out by Russia's GRU, specifically a special-operations subunit established in 2023. The unit was reportedly created from former senior Soviet submarine officers to conduct sabotage acts in Western countries supporting Ukraine.

The Lithuanian Prosecutor's Office also confirmed that the first link in the bomb parcel chain within the European Union was in Estonia. According to media reports, 15 people across various countries have now been charged and at least one organizer has been declared wanted.

Veteran journalist Edward Lucas, who specializes in intelligence and security issues, said the case ranks among the boldest and most dangerous in recent memory.

"[Flight] MH17 was a pretty spectacular catastrophe — the Russians shooting down a completely innocent civilian passenger airliner on its way to Malaysia, with lots of Dutch people on board. We already knew from the nerve agent attack in Salisbury in 2018, when they used a vast amount of the very dangerous nerve agent Novichok to try and kill one former GRU official who was working for the British. We already know that they basically don't care about human life. To this day, people in villages around Salisbury look nervously when mowing the grass by the side of the road in case they find a bottle of nerve agent that could kill countless people," Lucas said.

Even if the packages' explosive power was limited, Unt confirmed that even a small fire aboard an aircraft can have deadly consequences. For example, in May 2016, a single spark from an e-cigarette, combined with an oxygen leak in the cockpit, caused a fire that destroyed an Egyptian passenger plane completely, he said.

"They're really attacks on our decision-making," Lucas concluded. "They're there to make out decision-makers distracted and confused and they're there to make the members of the public think: do the people who run my country really have a grip on this. So, although the damage from this attack was actually quite light, the effect was really substantial," Edward Lucas said.

--

You can read the investigations in English on Vsquare, LRT and Re:baltica, and in Estonian on Delfi's website.

--

Follow ERR News on Facebook and X and never miss an update!