Russia is recruiting civilians to commit arson, sabotage, and terrorist acts across Ukraine and Europe—and in Ukraine, its operatives have refined the playbook: they now forge official Security Service of Ukraine (SBU) summonses, complete with the signatures of senior SBU officials, to coerce targets who believe they are complying with their own government. The SBU and National Police warned on 3 July that dozens of such attempts have been uncovered in 2026 alone.
This isn't a new tactic—similar cases have been documented over the past few years. The warning arrives as Russia's civilian-recruitment campaign has spread across NATO territory on an industrial scale.
The Center for Strategic and International Studies counted 34 sabotage attacks in Europe in 2024, nearly triple the 2023 figure. A senior NATO official has described "a steady and growing pattern of hybrid attacks" against member states.
The targets are ordinary people—financially vulnerable, legally exposed, or simply contactable through commercial data obtained from online shops—manipulated into carrying out operations whose Russian origin they may never discover. Poland's Internal Security Agency (ABW) has described Russia as deploying "low-cost agents"—individuals recruited online quickly and cheaply, some unaware they are acting in Russia's interests.
Ukraine's SBU is now documenting a distinct variant of that model—one that manufactures state authority rather than merely offering money.
How the scheme works
Russian operatives contact targets by phone or messaging app, presenting themselves as SBU investigators, National Police officers, or other law enforcement. The entry point is a fake official summons sent by messenger—printed with forged signatures of senior SBU officials, directing the target to appear over a fabricated criminal case. A common invented charge: alleged purchase of pharmaceutical products on Russian websites.
Handlers then offer to close the invented proceedings in exchange for tasks. The escalation is structured:
- surveillance of a named individual;
- carrying packages between addresses or purchasing chemical components;
- building an improvised explosive device;
- burning a Defense Forces vehicle or administrative building;
- preparing a terrorist act or sabotage of critical infrastructure.
Russian handlers sometimes also demand payment—transfers to Russian-controlled accounts or cash handed to a courier under the guise of "authenticity verification"—as an alternative to, or alongside, task assignments.
To find targets, Russian services use customer databases from online shops—turning leaked commercial data into a recruitment pipeline, the SBU notes.
What Ukraine's cases document
Elsewhere in Europe, the campaign usually runs on money and leverage—recruitment through Telegram, or pressure on people already compromised. In several Baltic cases, Estonian smugglers were blackmailed into spying after being caught at the border.
What Ukraine's cases document is a different lever: the forged summons manufactures state authority itself. The targets do not believe they are being recruited by Russia. They believe they are being contacted by their own government.
The SBU stated that it operates exclusively under Ukrainian law, does not issue tasks of the kind described, and does not send official documents via messaging applications. Citizens who receive suspicious contacts can report them via the SBU chatbot at t.me/spaly_fsb_bot or by calling the hotline at 1516.
