During the Cold War there was at least some level of accountability and professionalism,” said Sean Wiswesser, a former C.I.A. officer who has written a book about Russia’s spy services, which he spent decades working against. “But now everything seems to be in the realm of possibility. We’ve never seen this level of recklessness.”

A Spy Network

Nothing about Mr. Kolosovsky’s public profile suggests a life of secret intrigue.

He appears to live modestly and is often in debt, according to security officials from one European country. His social media accounts feature a lot of cars, though not flashy ones. His last post on one account was on Dec. 15, 2020, his birthday. It featured a photograph with his mother.

Western security officials and researchers who have dug into his background found evidence of another life, hidden from view.

Mr. Kolosovsky seems to have been associated with a professional car thief named Daniil Oleynik, who used the online moniker Wasp Killer. Western security officials have linked both men to a channel on Telegram — Mr. Kolosovsky under the alias LexTER — that was a platform for extracting ransom payments from people whose vehicles had been stolen. Mr. Oleynik was arrested in Italy and extradited to Ukraine in August 2024 on car theft charges.

It is unclear whether Mr. Kolosovsky was also a car thief. But researchers and security officials have connected his phone numbers to a network of channels and groups on Telegram involved in smuggling and doxxing, as well as selling fake IDs and equipment used to steal cars. His number was often saved in people’s phones as “Aleksei” plus the name of a car brand, like Lexus, Ford or Toyota.

Mr. Kolosovsky is also a sophisticated cyberoperator. He was associated with a hacker collective called KillNet, according to security officials in one European country. Since the invasion, KillNet has focused on attacking the websites of Ukrainian and European companies. In 2024, the group claimed to have hacked a French asset management company.

“Nothing personal, we’re just against the support of Nazis,” KillNet posted on social media, using a favored Kremlin slur for the Ukrainian government.

Often, the group ended its communications with: “Our enemies fall at our feet. Long Live Russia.”

A leak by a rival hacker group in 2024 linked Mr. Kolosovsky to the online handle @warriorkillnet.

In 2021, Mr. Kolosovsky was briefly detained by the Russian authorities, though it is not clear why. It was then, the security officials said, that he was likely recruited by the intelligence services, which often troll prisons looking for potentially useful inmates willing to work for them in exchange for freedom.

After Mr. Kolosovsky was detained, his associate, Mr. Oleynik, implored followers to delete their communications because the authorities had confiscated Mr. Kolosovsky’s electronic devices, according to the security officials. Telegram channels, possibly linked to Mr. Kolosovsky, also disappeared, the officials said.

His mother, who often posts photographs of her family on social media, has posted none of Mr. Kolosovsky since at least 2021. When asked about his whereabouts in a comment on a Russian social media post in July 2022, she responded that he was on a business trip.

A Growing Backlash

Early in the morning of July 20, 2024, a shipping container being loaded onto a DHL cargo plane in Leipzig, Germany, burst into flames. Less than 24 hours later, a package on a freight truck driving through Poland ignited. A day after that, in Birmingham, England, the same thing happened on a forklift at a DHL shipping facility, which was carrying a pallet of packages.

The coordinated attacks rattled Western governments more than the previous sabotage efforts, since they had the potential to blow cargo planes out of the sky and cause mass casualties. An enormous investigation involving nine countries later determined that the G.R.U. was behind the plots and that a vast network of operatives in Europe had carried them out, “adhering to a very strict conspiracy,” according to prosecutors in Lithuania, where the parcel bombs originated.

At the center of the attacks, say security officials in two European countries, was Mr. Kolosovsky.

He coordinated the recruitment of the network that helped oversee the transport and distribution of materials used to make the incendiary devices, according to the European security officials and court documents. The network, the documents said, used a military-grade incendiary material called thermite to make the devices, which were hidden inside massage pads fitted with electronic timers.

(The Washington Post previously disclosed Mr. Kolosovsky’s possible involvement with the G.R.U. and his connection to the plot to place incendiary devices on cargo planes.)

The attacks marked a drastic escalation of Russia’s shadow war, indicating a greater willingness to use violence to achieve its national security objectives, security officials from the five European countries said. Had the DHL cargo plane in Leipzig not been delayed, the officials said, the device likely would have gone off in midair. So alarmed was the White House that President Joseph R. Biden Jr.’s national security adviser and the head of the C.I.A. contacted their Russian counterparts with a message to halt such actions immediately.

“The Russians have taken state-sponsored murder and sabotage to a new level,” Mr. Wiswesser said. “They’re using it to accomplish strategic aims.”

While the attacks sent an ominous message, the blowback for Russia has been intense.

Lithuanian prosecutors moved aggressively to deconstruct the plot and charged more than a dozen people, several of whom were also implicated in the attack on the IKEA store. Among them was a Russian citizen named Yaroslav Mikhailov.