In 2022, a Latvian housewife living in a small village near Lielvārde military airfield, about an hour's drive south-east of Riga, was tending her garden when she noticed a black car pull into her driveway. A young man got out, but by the time she reached the gate, the car was gone. Left behind was a folded piece of paper. After reading the note, she immediately handed it to her son-in-law who works in the army. He in turn passed it on to his superiors, who then informed the Latvian Military Intelligence and Security Service.

Why such a reaction to a seemingly ordinary piece of paper? The note read ”Mission, Lielvārde Military Airfield” and contained instructions on what to photograph at the airfield, how to respond if questioned, and a child-like drawing of an aeroplane. It also included the cost of two nights in a guesthouse nearby, and the rental of a Canon camera.

The lead, accidentally found on the ground by the housewife, was just the tip of the iceberg. Now, two years later, an investigation led by Latvian authorities has ended in the arrests of the mysterious man in the driveway and his associates, breaking up a network of saboteurs recruited by Russia.

First, the investigators discovered that on the night in question, the guesthouse mentioned in the note had only one guest, leading to a man named Sergejs Hodonovičs. In his apartment in Riga, the investigators found photos of a military bunker and cafe near the airfield, which was enough for them to assert that Hodonovičs' activities are connected to the Main Directorate of the General Staff of the Armed Forces of the Russian Federation, commonly known as GRU.

Upon interrogation, Hodonovičs explained how he connected with a man nicknamed Green - Gļeb by his real name - while trying to get marijuana via the Telegram app. On his part, Green was looking for someone to travel to Estonia and spray-paint ”Killnet hacked you” on the NATO Cooperative Cyber Defence Center of Excellence in Tallinn. Hodonovičs agreed to travel to Tallinn, meet The Kid, Green's associate, and take care of the job. Around the time they were at it, several Estonian online state services and websites, including the Cyber Defence Center, did face cyberattacks, causing some to go temporarily offline.

For the next task, they shifted from messages on Telegram to hand-written notes - such as the one found by the housewife. The interrogation made it clear that Hodonovič received orders from a network of people. Some of them have already been identified by the Latvian State Security Service (VDD), while the identity of the ”main man”, referred to as Alexander, is still unknown.