Authorities from the Czech Republic, Lithuania, Poland and Romania found links between attempted and actual arson attacks in their respective countries. In Romania, a suspect was arrested in July 2024 after he was caught taking photos of possible locations to set on fire. In the Czech Republic, investigations revealed that a suspect had set fire to buses in Prague by spraying oil and pouring petrol over them before setting fire to the substances. He also scouted other locations for follow-up attacks. In Lithuania, the suspects targeted a factory producing materials for the Armed Forces of Ukraine. Although the suspects had brought all the materials needed to commit the attack, they abandoned their plan when pedestrians passed by. The second attempt was successful, although no damage was caused as insufficient flammable material was used.

The joint investigation team set up at Eurojust revealed that all these acts were carried out by the same terrorist group, which is suspected of having links to a foreign intelligence service. The suspects were all connected to the same organisers, used the same methods and acted with the common objective of intimidating people, fostering fear and distrust, and hindering support for Ukraine in the war.

Coordination through various meetings at Eurojust ensured that the authorities shared valuable information for their investigations and coordinated the prosecution of the suspects to avoid ne bis in idem. Europol provided operational support to the countries involved.

In Romania, an individual was sentenced to six years’ imprisonment for sabotage. In the Czech Republic, an individual was sentenced to eight years’ imprisonment, indefinite expulsion from the country and ordered to pay compensation for the damage caused. In Lithuania, a criminal case against six individuals for participating in an organised terrorist group and attempting to carry out terrorist attacks has been referred to the Šiauliai Regional Court. The trial is expected to start later in the year.

The investigation conducted in Poland revealed subversive activities carried out by a citizen of the Republic of Colombia, responsible for subsequent arson attacks in the Czech Republic. Before travelling to the Czech Republic, the suspect committed two arsons in Poland — targeting construction supply depots in Warsaw and Radom. Recordings of these incidents were later disseminated by Russian‑language online media, falsely presented as acts of sabotage against NATO military infrastructure for disinformation and propaganda purposes. The proceedings concerning the suspect and his principals are ongoing.

The actions were carried out by the following authorities:

• Czechia: High Public Prosecutor´s Office in Prague; National Counter-Terrorism, Extremism and Cybercrime Agency
• Lithuania: Prosecutor General’s Office; Criminal Police Bureau
• Poland: Lublin Branch of the Department for Organised Crime and Corruption in Lublin, Internal Security Agency
• Romania: Directorate for Investigating Organized Crime and Terrorism – Central Structure