An Estonian court found that Russia’s military intelligence agency, the GRU, ordered arson attacks in Estonia, including the firebombing of a Ukrainian-themed restaurant in Tallinn. The attacks were part of a wider Russian sabotage campaign aimed at destabilizing Western nations and undermining their support for Ukraine.

GRU ordered firebombing operations via Moldovan nationals

On 2 July, the Harju County Court in Estonia sentenced two Moldovan nationals, both named Ivan Chihaial, in connection to arson attacks carried out in January 2024, Euronews and ERR reported. One was convicted of directly executing the operations and received six and a half years in prison. The other, his cousin, was sentenced to two and a half years as an accomplice.

The court stated that the primary perpetrator was working on behalf of Russia’s military intelligence agency, the GRU. His first mission, according to the court, was a 2024 trial operation involving the arson of a co-op supermarket in Osula, a village in southeastern Estonia. The next day, GRU operatives instructed him to target the Slava Ukraini (“Glory to Ukraine”) restaurant in Tallinn.

Attack on Slava Ukraini restaurant executed overnight on 31 January

Court documents revealed that on the night of 31 January, the main suspect and his cousin traveled to Tallinn and set fire to the Slava Ukraini restaurant. The cousin was reportedly unaware of the GRU connection.

According to the court ruling, at 4:30 a.m. on 31 January, the older Chihaial smashed a window of the Slava Ukraini restaurant, threw in a can of gasoline, and set the building on fire. Meanwhile, the younger Chihaial filmed the arson from across the street; the footage was later uploaded to YouTube by the GRU. After the attack, both suspects left Estonia.

Estonia’s State Prosecutor Triinu Olev-Aas stated that cooperation among Latvian, Lithuanian, and Polish authorities was instrumental in tracking and arresting the men in Italy. They were extradited back to Estonia to face charges.

GRU’s use of foreign nationals signals recruitment challenges

The Estonian Internal Security Service noted that the GRU’s use of Moldovans instead of Russian citizens indicates growing difficulty in recruiting operatives from within Russia. Estonia has previously faced Russian cyberattacks and vandalism targeting vehicles of outspoken anti-Kremlin figures.