Bomb hoaxes disrupt flights across Europe as Russian group 'Male State' denies links

Threats hit airports and media offices

Bomb threats disrupted air traffic and media offices in several European countries on Thursday, 5 November, and again on Friday, 6 November. At least 21 flights were affected on Thursday, and nearly every threat, with the exception of London Heathrow, was treated seriously enough to trigger emergency measures. Some aircraft were forced to change course and land at other airports, while in Italy fighter jets took off to escort civilian planes. According to the ANSA news agency, a Wizz Air flight from Prague to Rome was diverted to Venice. Danish police said they were investigating threats against air traffic at Copenhagen Airport and that, so far, passengers did not appear to be at risk.

Czech police reported further bomb threats against aircraft departing from and landing at Prague Airport, adding that security measures had only a minimal effect on operations. A Ryanair flight from Rome to Lisbon was also among the new threats recorded on Friday.

A group that denies any link

The threat messages to Birmingham, Rome and Sofia airports were signed by people claiming to be fighters of the 'Male State', a Russian group that has also been renamed 'Male Legion' in some cases. Its founder, Vladislav Pozdniakov, told reporters via Telegram that the organisation simply has not existed since 2021, the year Russian authorities banned it as extremist. He said that those staging provocations in EU countries under the group's name were doing so for personal gain, using a name that did not belong to them. Pozdniakov is believed to be living abroad, and a Telegram account linked to the group mocked the idea that it had sent the emails.

The group was founded in 2016 by Pozdniakov, a blogger and coach, first as a community on the Russian social network VK. Over time it took on a partly political character, promoting an ideology that combined misogyny and nationalism, but it never won wide support and became known mainly for online harassment campaigns. Media reports say its online activity continued after the 2021 ban and that it turned into a community supporting Russia's invasion of Ukraine, which began in 2022.

The first email to Rome

The first misleading email, which came into the BBC's possession, was sent on Thursday at 07:21 under the subject line 'Threat warning'. It went to several offices and staff members of Aeroporti di Roma, the company that runs Rome's airports, as well as accounts at Fiumicino airport. The sending address appears to be linked to state health services in Bogota, Colombia. The message was written in flawless Italian and claimed that Male State fighters had planted explosives on two incoming flights. It is unclear whether airports or airlines in other countries received the same or similar messages, and at least one of Friday's warnings appears to have come by phone rather than email.

Suspicion turns toward Russia

Some have turned their suspicion toward Russia, because the incidents happened almost simultaneously and show signs of coordination. They also follow a series of cyberattacks and unexplained drone sightings near sensitive sites in previous months. In recent days, remote interference was reported with freezers in supermarkets and at a blood bank. A suspicious incident was recorded on the Poland-Russia border, and in August a drone attack hit Leipzig-Halle airport in Germany, which the German interior minister publicly blamed on Moscow. Authorities and investigators in some cases link hybrid attacks in Europe to Russia and, occasionally, to Iran. Despite the absence of direct evidence, the incidents may fit a wider grey-zone campaign that aims to cause damage and unease without claiming responsibility, and such operations typically do not trigger Article 5 of the NATO treaty.

Evacuations in Ireland and Lisbon

On Friday, 6 November, the threats reached Ireland, where the offices of RTE, Newstalk and The Irish Independent group in Dublin were evacuated. Newstalk's presenter Claire Byrne told listeners on air that the threat was a prank and that staff could return to the building in central Dublin. The Irish government spoke of signs of a coordinated destabilisation campaign. Similar investigations were also triggered in Lisbon. Threats checked so far have proved to be hoaxes, but that does not guarantee that a later threat will not prove real. No check has so far found an actual explosive device.