Russian extremist group denies sending hoax bomb threats

The hoax warnings caused real disruption even though no explosives were found. Flights were delayed, diverted, or escorted, while airport staff and Irish media organisations faced evacuations. The incident mattered because a false message still forced authorities to treat the danger as genuine.

A flight from Rome to Lisbon and a Wizz Air flight from Prague to Rome were among those affected. The Wizz Air flight diverted to Venice. In the initial Rome incident, one plane was ordered to land in France, while another was escorted into Rome by Italian air force jets. Bomb threats also reached several prominent Irish media organisations on Friday.

The warnings continued to appear across Europe, and investigators had not established whether they came from one campaign or copycats. Italy’s defence minister described the events as part of a possible strategy to increase chaos. The episode showed how a short, credible-looking message can consume security resources and disrupt public travel.

The Male State was a Russian extremist group known for misogynistic views. Russia banned it in 2021, and its founder, Vladislav Pozdnyakov, is thought to live abroad. In some places, the group has renamed itself “Male Legion.”

The link came from the wording of the first threat sent to Rome. Written in fluent Italian, it claimed that “fighters” of the Male State had planted explosives on two incoming flights. It described the alleged attack as revenge against Italy’s “feminist regime.” Telegram accounts linked to Pozdnyakov then rejected the connection and mocked the BBC’s questions.

The denial did not settle the issue. Italy’s La Stampa newspaper believed the group was behind the threats, while Bellingcat had previously described it as an extremist far-right supporter of Russia’s invasion of Ukraine. The article says investigators were still examining whether the threats were coordinated, copied, or falsely attributed.

The precise scale remained unclear. The article identifies several affected flights and organisations but does not give a complete count. It reports threats involving a Ryanair flight from Rome to Lisbon and a Wizz Air flight from Prague to Rome. The latter was diverted to Venice.

The original Rome warning was sent to several Aeroporti di Roma offices and individuals, as well as accounts at Fiumicino airport. It referred to two incoming flights. One was diverted to France, and another was escorted into Rome by Italian air force jets. No explosives were found on either plane or any other aircraft reporting threats.

The disruption also moved beyond airports. Threats reached a number of high-profile Irish media organisations, causing evacuations. Further bomb scares appeared at airlines on Friday, and at least one warning came by phone rather than email. The Europe-wide investigation was still testing whether these incidents formed one campaign or reflected copycats.

A credible bomb threat creates immediate safety and operational consequences. Passengers may face diversions, delays, evacuations, or uncertainty. Airlines must alter routes and schedules, while airports must coordinate emergency responses and protect staff and travellers. Even an empty threat can therefore produce serious disruption.

The article gives concrete examples. One flight was ordered to land in France, another was escorted into Rome by Italian air force jets, and a Wizz Air flight diverted to Venice. Several Irish media organisations evacuated after receiving threats. No explosives were found, but the warnings were treated seriously because airport staff said such messages were extremely unusual.

National security agencies must also determine whether the threats are isolated hoaxes or part of a wider campaign. Italy’s defence minister warned of a “strategy to increase chaos,” alongside other reported cyberattacks. The response can consume military, police, airport, and intelligence resources while amplifying public anxiety across borders.

Groups may deny responsibility to avoid consequences, protect supporters, or make attribution harder. A denial can also create confusion about whether a threat reflects genuine capability, an imitator, or an attempt to frame the group. The article presents the denial as part of an unresolved attribution dispute.

A Telegram account linked to the Male State and Pozdnyakov mocked the suggestion that the group had emailed the threats. It said the Male State had not existed for years. Yet the Rome message explicitly claimed to come from the group and invoked its supposed “fighters.” La Stampa still argued that the group appeared responsible.

The conflicting signals matter because attribution affects the response. If investigators identify the true sender, they can assess intent, links, and future risk more accurately. The article says the Europe-wide hunt was continuing, with officials considering a coordinated campaign or copycats. It does not establish that the Male State sent the warnings.

A hybrid threat uses several methods together rather than relying on one conventional attack. False bomb warnings can disrupt transport and public institutions. Cyberattacks can damage services or supplies. Information campaigns can highlight social tensions and spread fear. Together, these actions may strain trust and government capacity without a single large physical attack.

The article connects the idea to several incidents. Bomb warnings disrupted flights and prompted evacuations at Irish media organisations. Crosetto also referred to cyberattacks that raised supermarket refrigerator temperatures and destroyed large amounts of produce. A Telegram channel linked to Pozdnyakov shared pro-Russian material about Ukraine and posts highlighting European problems and protests.

Italy’s defence minister called the situation a “hybrid threat” and warned of a “strategy to increase chaos.” The article does not prove that all incidents had one organiser. It shows why officials examine them together: repeated alarms, service disruptions, and inflammatory messaging can fuel tension even when individual threats are false.

To distinguish coordination from copycats, investigators compare the threats closely. They can examine wording, language quality, timing, target selection, delivery method, and technical information in emails or calls. Shared patterns may suggest one campaign. Major differences may point to separate actors or imitators.

The article provides several clues to compare. The first Rome warning arrived by email at 07:21 and appeared to originate from Colombia’s state health services. At least one later warning came by phone. The Rome message was written in “word perfect Italian,” while other threats may have used different routes or wording. These details can help test connections, but they do not prove them.

Investigators must also assess spoofing and attribution. A sender address can be made to appear connected to another organisation, so its apparent origin needs verification. They can compare records, account links, and the timing of public reports. The article says the investigation was still determining whether the incidents were coordinated or copycats.