WASHINGTON — American and European officials believe that Russian military intelligence officers directed associates of a white supremacist militant group based in Russia to carry out a recent letter bomb campaign in Spain whose most prominent targets were the prime minister, the defense minister and foreign diplomats, according to U.S. officials.
Spanish and foreign investigators have been looking into who sent six letter bombs in late November and early December to sites mostly in Madrid, including the official residence of Prime Minister Pedro Sánchez, which also serves as his office; the American and Ukrainian Embassies; and the Defense Ministry. No one was killed in the attacks, which U.S. officials consider terrorism. An employee of the Ukrainian Embassy was injured when one of the packages exploded.
Investigators in recent weeks have focused on the Russian Imperial Movement, a radical group that has members and associates across Europe and military-style training centers in St. Petersburg, the officials said. They added that the group, which has been designated a global terrorist organization by the U.S. State Department, is believed to have ties to Russian intelligence agencies. Important members of the group have been in Spain, and the police there have tracked its ties with far-right Spanish organizations.
U.S. officials say the Russian officers who directed the campaign appeared intent on keeping European governments off guard and may be testing out proxy groups in the event Moscow decides to escalate a conflict.
The apparent aim of the action was to signal that Russia and its proxies could carry out terrorist strikes across Europe, including in the capitals of member states of the North Atlantic Treaty Organization, which is helping defend Ukraine against Russia’s invasion, said the U.S. officials, who spoke on the condition of anonymity because of the sensitivities around the investigation. Spain is a member of the alliance and has given military and humanitarian aid to Ukraine, as well as diplomatic support.
One of the letter bombs was sent to Instalaza, a weapons maker in Zaragoza that manufactures grenade launchers that Spain is giving to Ukraine, and another went to the Torrejón de Ardoz Air Base outside Madrid.
There are no signs that Moscow is ready to engage in widespread covert attacks or sabotage in Europe, which Russian officials believe could provoke a response from NATO and, potentially, a costly wider conflict, according to U.S. and allied officials. For that same reason, President Vladimir V. Putin of Russia and his generals have not ordered a conventional attack on a NATO country.
Mr. Putin’s calculus on terrorist attacks could change if Russia continues to suffer major setbacks in Ukraine, U.S. officials say. Mr. Putin has given his military intelligence agency wide latitude to develop and conduct covert operations in Europe, but the degree to which the Kremlin was involved in the letter bomb operation is unclear, they say.
“This seems like a warning shot,” said Nathan Sales, the State Department’s counterterrorism coordinator in the Trump administration, when the Russian Imperial Movement was designated a terrorist organization. “It’s Russia sending a signal that it’s prepared to use terrorist proxies to attack in the West’s rear areas.”
The Russian officers behind the bombing campaign work for the Main Directorate, commonly referred to as the G.R.U., one of Moscow’s more aggressive intelligence shops, U.S. officials say. In recent years, the group has carried out bold and lethal covert actions with impunity.
Members of the agency have been involved in a range of shadowy activities, from interfering in the 2016 U.S. presidential election to shooting down a Malaysian civilian airliner over Ukraine in 2014, according to U.S. officials.
One specific part of the agency, Unit 29155, has tried to destabilize Europe through attempted coups and assassinations, according to U.S. and European security officials. Its agents include Russian war veterans, and it was so secretive that most G.R.U. operatives probably did not know it existed. American and allied officials learned about the unit only in recent years.
U.S. officials suspect that the Russian officers involved in the Spain action are part of the 161st Special Purpose Specialist Training Center, whose headquarters in eastern Moscow house Unit 29155, among other groups, U.S. officials say.
Spanish investigators have identified “persons of interest” they believe were involved in the attacks, one senior U.S. official said.
What we consider before using anonymous sources. Do the sources know the information? What’s their motivation for telling us? Have they proved reliable in the past? Can we corroborate the information? Even with these questions satisfied, The Times uses anonymous sources as a last resort. The reporter and at least one editor know the identity of the source.
A spokeswoman for the Spanish Embassy in Washington declined to comment, citing the continuing inquiry.
Fiona Hill, a senior director for Europe and Russia on the White House National Security Council in the Trump administration, said it would not be surprising if the G.R.U. had directed the Russian Imperial Movement to carry out the attacks.
“Most of these kinds of organizations are of course linked to Russian intelligence, either the G.R.U. or the F.S.B.,” she said, referring also to the Federal Security Service, Russia’s domestic intelligence agency. “Oftentimes they’re just front groups for the intelligence activities.”
Intelligence agents use the groups to sow confusion and create “implausible deniability,” she added.
American and British intelligence officials have been working with the Spanish national police and counterintelligence officials on the investigation. Their suspicions about the Russian Imperial Movement and the G.R.U. coalesced late last year, soon after the bombs were discovered, U.S. officials say.
The radical group is only partially aligned with the Russian government. The movement’s leadership has criticized the incompetence of Russian leadership in the Ukraine war and accused Mr. Putin of corruption. Yet because the group shares Moscow’s aims of undermining Western governments and sowing chaos in Europe, Russian intelligence has been able to influence its operations, according to American officials.
The ability to use the Russian Imperial Movement as a sometime proxy force is useful to Russian intelligence, particularly because that makes it more difficult for rival countries to attribute actions to the Russian government.
The State Department designated the group and its leadership global terrorists in April 2020, the first time such a label had been applied to a white supremacist group.
“R.I.M. has provided paramilitary-style training to white supremacists and neo-Nazis in Europe and actively works to rally these types of groups into a common front against their perceived enemies,” the department said in the announcement of the designation.
The department said the group had two training centers in St. Petersburg that “are likely being used for woodland and urban assault, tactical weapons and hand-to-hand combat training.”
The leaders designated by the State Department were Stanislav Anatolyevich Vorobyev, who founded the group in St. Petersburg in 2002; Denis Valiullovich Gariyev, the leader of its paramilitary arm, the Russian Imperial Legion; and Nikolay Nikolayevich Trushchalov, an organizer of the group’s activities abroad.
The department said that two Swedes who committed a series of bombings in Gothenburg, Sweden, in 2016 had attended a training course run by the Russian group. The perpetrators, who were convicted in court, had targeted a refugee shelter, a shelter for asylum seekers and a cafe.
The Center for International Security and Cooperation at Stanford University describes the Russian Imperial Movement as “white supremacist, monarchist, ultranationalist, pro-Russian Orthodox and antisemitic.” The group advocates the restoration of czarist rule to Russia, it said, and nurtures ties with neo-Nazi and white supremacist groups in the United States and Europe.
American and European security officials have had growing concerns about white supremacist groups with transnational links for most of the last decade. In 2019, for example, an Australian man who killed 51 people at two mosques in Christchurch, New Zealand, published a manifesto online before the massacre saying he had drawn inspiration from white extremist terrorism attacks in Europe and the United States.
As a result of the recent letter bombs, U.S. intelligence and counterterrorism officials have increased their scrutiny of the Russian Imperial Movement, including updating terrorist watchlists to flag suspected leaders of the group or its members, U.S. officials said.
Russian intelligence agents have attracted more attention from counterintelligence officials and police departments in recent years as they have carried out increasingly bold operations, particularly in Europe.
In 2018, they tried to kill Sergei V. Skripal, a former G.R.U. officer recruited by Britain as a spy, by poisoning him and his daughter at their residence in England; those two barely survived, but a British woman died. Russian agents have also carried out bombings and assassination attempts in the Czech Republic and Bulgaria, and tried to pull off a coup in Montenegro, according to European intelligence officials.
The same elite group active in Europe, Unit 29155, has operated in Afghanistan and offered bounties to reward Taliban-linked militants for killing American and coalition troops, according to a U.S. intelligence assessment first reported by The New York Times. American officials said in 2021 that they had no evidence showing the Kremlin had ordered the covert action.
Charlie Savage contributed reporting from Washington, and José Bautista from Madrid.
