Cargo packages waiting for North American flights ignited. Officials blame Russia.

Western security officials suspect Russian intelligence was behind a plot to put incendiary devices in packages on cargo planes headed to North America, including one that caught fire at a courier hub in Germany and another that ignited in a warehouse in England.

Poland said last month that it has arrested four people suspected to be linked to a foreign intelligence operation that carried out sabotage and is searching for two others. Lithuania’s prosecutor general Nida Grunskiene said Nov. 4 there were an unspecified number of people detained in several countries, offering no elaboration.

The events come as Western officials say they are seeing an intensification of a hybrid war of sabotage by Russia targeting Ukraine’s allies, including election disinformation and arson attacks in Europe this year. Several officials said they believe the attacks were the work of Russian military intelligence, the GRU, although Moscow denied involvement.

The FBI said hoax bomb threats at polling locations across several states on United States Election Day appeared to originate from Russian email domains, though federal cybersecurity officials cautioned that the culprits were not necessarily Russian.

Poland’s Internal Security Agency, or ABW, says that incidents in Poland, as well as other EU and NATO members, had intensified this year. ABW believes they are initiated and coordinated by the Russian special services. So far, 20 people have been charged in investigations led by the prosecutor’s office, the ABW, and police.

Polish Prosecutor Katarzyna Calów-Jaszewska said the investigation focuses on foreign agents conducting acts of sabotage, including damaging industrial facilities or critical infrastructure such as airports, airplanes, and other vehicles, as well as arson using self-combustible parcels sent to EU countries and the U.K. that would ignite during road or air transport.

She added that the group tested a channel for sending such parcels to the United States and Canada.

The Wall Street Journal first reported the details of the cargo plane incidents.

The U.S. Transportation Security Administration said it has put extra security measures in place in recent months for certain cargo shipments heading to the U.S.

“We continually adjust our security posture as appropriate and promptly share any and all relevant information with our industry partners, to include requirements and recommendations that help them reduce risk,” the TSA said.

There was no active threat targeting flights heading to the United States, according to a U.S. official, who was not authorized to comment publicly.

Dirk Heinrichs, a spokesperson for DHL in Germany, said in an emailed statement to The Associated Press that the company could not provide details about the matter but was “fully cooperating with the relevant authorities to protect our people, our network and our customers’ shipments.”

The head of Britain’s domestic intelligence agency, MI5, said last month the U.K. is facing a “staggering rise” in attempts at assassination, sabotage, and other crimes on its soil by Russia as well as Iran.

Ms. Calów-Jaszewska said Oct. 25 that parcels with camouflaged explosives were sent via cargo companies to EU countries and Britain to “test the transfer channel for such parcels” that were ultimately destined for the U.S. and Canada.

The incendiary devices in Germany and the U.K. both ignited in July.

One was at a stopover at a DHL logistics center at an airport in the city of Leipzig, according to Thomas Haldenwang, head of the German intelligence service. The German news agency dpa reported that the connecting flight containing the package, which came from one of the Baltic nations, was delayed in Leipzig and was on the ground when it ignited and set fire to a freight container.

British counterterrorism police are investigating whether Russian agents were behind an incendiary device in a parcel that caught fire in a DHL warehouse in Minworth, near Birmingham, in central England on July 22. The incident, first reported by the Guardian newspaper and German broadcasters, was similar to the one in Germany.

The Polish newspaper Gazeta Wyborcza also reported that a fire was reported in a courier truck near Warsaw.

“We are observing aggressive action by the Russian intelligence services. In particular Russian espionage and sabotage in Germany are on the rise, both quantitatively and qualitatively,” Haldenwang told the German Budestag, or parliament, last month while discussing the Leipzig incident.

“The activities of Russian intelligence services in the real world as well as in cyberspace show that Germany is the focus of Russia’s hybrid war against Western democracies,” he added. “Russia is using its entire toolbox: from influencing political discussions within Germany to cyber attacks against critical infrastructure and sabotage. Russia’s willingness to use force proves that it is also willing to put human lives at risk.”

In a rare public speech setting out the major threats to the U.K., MI5 Director General Ken McCallum said “the GRU in particular is on a sustained mission to generate mayhem on British and European streets: We’ve seen arson, sabotage, and more. Dangerous actions conducted with increasing recklessness.”

Kremlin spokesman Dmitry Peskov on Nov. 4 called media reports about the alleged sabotage plot an example of a “vague fabrication.”

This story was reported by The Associated Press. AP writers Jill Lawless, Danica Kirka, Dasha Litvinova, Kirsten Grieshaber, Aamer Madhani, and Liudas Dapkus contributed.