How a Ukrainian Teen Became a Suspected Foot Soldier for Russia

The job offer, pitched to appeal to a 17-year-old Ukrainian refugee without work, promised a BMW car and about $11,000 in cash.

Daniil Bardadim, a teenager on the run from war in Ukraine, received the offer early last year after making his way to Warsaw in neighboring Poland, according to investigators.

He accepted and was given a BMW, albeit an old one, but not the cash. And what probably once seemed an attractive proposition soured even more badly. It landed him in jail in Lithuania on a raft of terrorism charges, accused of setting fire to an IKEA store.

The job, offered through a shadowy group, turned Mr. Bardadim into an unwitting foot soldier for Russia as part of a multipronged campaign of sabotage attacks on targets across Europe, Lithuanian investigators say.

Shopping malls, warehouses, undersea cables and railways in Europe have all been hit over the past two years in what the Center for Strategic and International Studies describes as a drive to sow havoc led by Russia’s military intelligence service, the GRU.

The number of covert Russian attacks nearly tripled between 2023 and 2024. That has worried European governments who fear that the invasion of Ukraine by President Vladimir V. Putin is part of a broader offensive that is underway elsewhere in the shadows and could easily escalate into additional overt aggression.

“We have already entered a war zone in Europe,” said Darius Jauniskis, the outgoing director of Lithuania’s State Security Department. “Their goal,” he said, “is to create havoc, to create mistrust and panic” and undermine public support for helping Ukraine. “Welcome to World War III,” he added.

Steve Witkoff, President Trump’s envoy to the Middle East and Russia, dismissed as “preposterous” the notion that the “Russians are going to march across Europe” in a recent interview. “I don’t regard Putin as a bad guy,” he said.

That view has left many in Europe aghast, particularly in countries near Russia, like Poland and the Baltic States.

“The shadow war in Lithuania and other countries shows that Putin is ready and able to act beyond his country’s borders,” said Gabrielius Landsbergis, Lithuania’s former foreign minister. The belief that Russia’s aggressive intent does not extend beyond Ukraine, he added, is “just wishful thinking.”

The attack Mr. Bardadim is accused of carrying out took place last May, when an incendiary device planted at an IKEA store in the Lithuanian capital, Vilnius, burst into flames in the middle of the night. Police officers later stopped a bus he was traveling on from Lithuania to neighboring Latvia and arrested him.

Among his possessions on the bus were incendiary devices that investigators believe were to be used in another arson attack in the Latvian capital, Riga.

Mr. Bardadim’s court-appointed lawyer, Renata Janusyte, declined to comment on the record about her client’s actions or motives.

Lithuania’s investigation into Mr. Bardadim has revealed striking and often bizarre details of how sabotage operations are prepared and carried out. That includes the use of a Vilnius railway station locker to stash a bag containing explosives, six mobile phones, four detonators and two vibrators, whose intended use is unclear.

Why Ukrainians would get involved in a sabotage campaign on behalf of their country’s archenemy has raised troubling questions for Lithuania, Latvia and Poland. Those countries welcomed tens of thousands of refugees from Ukraine and lobbied strongly for stepped-up Western military aid to help Kyiv resist Russia.

Mr. Bardadim grew up in Kherson, a mainly Russian-speaking city in southern Ukraine near the Black Sea that, before the war started, was home to many residents who looked favorably on Russia. Mr. Bardadim’s mother still lives there. Contacted by telephone in Kherson, she declined to comment.

Lithuanian investigators believe Mr. Bardadim and others involved in the IKEA attack were mainly motivated by money. Last month, Arturas Urbelis, the lead prosecutor, described them as “young individuals who clearly lack life experience” and who, because of the war in Ukraine, “have found themselves in a difficult material position.”

He added that they perhaps “did not comprehend the ultimate objective” of those who, hidden behind aliases on social media, commissioned and guided their work.

People being recruited by GRU “are obviously not professionals,” since they are easily getting caught, and are often in difficult financial straits and attracted by “offers of quick and easy money,” said Mr. Jauniskis, the State Security Department director.

Pitching for recruits on social media, Russia’s intelligence agencies “just throw out a fishing net to see who will bite,” he added.

Asked whether it had found any evidence that Mr. Bardadim signed up as a saboteur out of loyalty to Russia, the office of Lithuania’s prosecutor general said “there is no information indicating that the defendant holds pro-Russian views.”

Many of the instructions sent to Mr. Bardadim and other recruits were transmitted via Telegram by a user who went by the name Warrior2Alpha, according to Lithuanian investigators. Another channel of communication was Zengi, a Chinese messaging app.

The Ukrainian teenager was recruited by what investigators describe as a subterranean Russian network directed by the GRU and other Russian agencies to spread mayhem. He communicated, according to Lithuanian prosecutors, on Zengi with an unidentified handler using the alias “Q,” apparently referring to the character in the James Bond movies.

The most potentially dangerous sabotage operations have involved incendiary devices disguised as innocent packages. A parcel flown from Vilnius to Germany by DHL burst into flames last July at a handling center in Leipzig. Another package from Vilnius exploded in Birmingham, England, and a third burst into flames at a Polish courier firm.

Western intelligence officials have blamed each episode on Russia. And the IKEA fire has also been clearly linked to Russian sabotage, Mr. Jauniskis said.

Mr. Bardadim, prosecutors say, crossed Poland’s northern border with Lithuania last April. He scouted possible targets, visiting an IKEA store in Siauliai, an eastern city, and a second, bigger IKEA store in Vilnius.

Siauliai, home to a NATO air base, has long been a focus for Russian intelligence services. Last year, the Lithuanian police arrested an 82-year-old retiree there on espionage charges after finding spy gear at his home. Mr. Jauniskis said the man was working for the GRU.

“For Russia, age, gender and ideology don’t matter,” Marius Cesnulevicius, the national security adviser to Lithuania’s president, said in an interview. Beyond the nuisance value of such operations, he said, “their goal is to coerce and deter us from supporting Ukraine.”

After his scouting trip to Siauliai and Vilnius last April, Mr. Bardadim went back to Warsaw. He then returned to Vilnius and, prosecutors say, on May 8 planted an incendiary device in the bedding section of the IKEA store. On a timer, it exploded early on May 9, which Russia celebrates as “Victory Day” marking the Soviet victory over Nazi Germany in 1945.

The timing was deliberate, said Mr. Cesnulevicius, the national security adviser.

“We are supporting Ukraine, and, in the Kremlin’s logic, this means we are supporting Nazis,” he said.

The incendiary device that prosecutors say Mr. Bardadim planted set off an inferno but failed to burn down the building, as had apparently been the plan.

Three days later in Warsaw, a mysterious blaze that Polish investigators now believe was caused by Russia-recruited saboteurs destroyed the city’s largest shopping center. Poland believes that Mr. Bardadim, who left Vilnius for Warsaw on the night of the IKEA operation, may have been involved.

Mr. Bardadim, according to prosecutors, had accomplices in Lithuania, including a fellow Ukrainian, who helped in the IKEA attack and has since been arrested in Poland.

Polish prosecutors recently said they had also filed terrorism charges against a Belarusian citizen who has been accused of setting fire to a large hardware store in Warsaw last April.

In February, Bosnia extradited to Poland a Russian man, Aleksandr Bezrukavyi, who was accused of belonging to a cell of Moscow operatives that coordinated sabotage operations against Polish, Baltic and other NATO-member targets.

Prime Minister Donald Tusk of Poland said last month that Lithuania’s wide-ranging investigation into the IKEA attack had “confirmed our suspicions that those responsible for setting fires to shopping centers in Vilnius and Warsaw are Russia’s secret services.”

Mr. Jauniskis, the director of Lithuania’s State Security Department, said the IKEA attack “was not just about burning mattresses” but part of a wider campaign to “create panic.”

He added: “We talk about sabotage, but in reality this is state-supported terrorism.”