Amid terrorist attacks targeting military recruitment offices, public debate continues in Ukraine over whether the perpetrators are marginalized individuals resentful of the government, ideological supporters of the “Russian world,” or opportunists lured by money from Russian special services.
Texty.org.ua journalists have uncovered how Russian intelligence agencies recruit Ukrainians to carry out attacks against recruitment centers and service members, offering payments up to $5,000 primarily to young people for terrorist activities.
- Amid the ongoing Russo-Ukrainian war, Russia’s espionage and sabotage activities are on the rise in Ukraine, with the SBU security service regularly reporting arrests of suspected spies and saboteurs. These are mostly Ukrainian nationals hired for promises to be paid for their actions.
- Last year, most Russian sabotage activities included nighttime arson attacks on Ukrainian military SUVs parked in cities. Additionally, fewer reports emerged on the detention of agents involved in railway sabotage and passing coordinates of Ukrainian military facilities to Russian handlers.
- Starting this month, Russian sabotage efforts in Ukraine have abruptly shifted to terror attacks on recruitment offices (TTsK), involving a series of remotely detonated explosions inside multiple facilities. These blasts killed the agents who delivered them and injured others. Additionally, there have been cases of assassination attempts on the military.
During their investigation, Texty reporters posed as potential recruits to infiltrate FSB recruitment networks operating through Telegram channels. The journalists say the investigation began after discovering suspicious graffiti in a dimly lit underground passage in Kyiv, displaying an unknown Telegram channel URL.
The channel initially appeared to be standard Russian propaganda about Ukraine’s military recruitment offices, featuring videos of mobilization efforts and emotional family reactions. However, it soon revealed its true purpose – recruiting individuals for violent actions against Ukrainian military infrastructure.
Starting 1 February, the following reports on terror attacks emerged:
- On 1 February, an unemployed Zhytomyr man brought an improvised explosive device into a recruitment center in Rivne. His Russian handlers, tracking his movement via his phone camera, detonated the bomb remotely, killing him and injuring eight Ukrainian servicemen.
- On the same day, a masked assailant fatally shot a military serviceman escorting newly mobilized recruits in Poltava Oblast.
- On 2 February, an explosion near a recruitment facility in Pavlohrad, Dnipropetrovsk Oblast, left one person with minor injuries. The SBU detained three men, aged 21 and 22, who were allegedly recruited by the Russians via Telegram to earn “easy” money.
- On 5 February, an explosion near the Kamianets-Podilskyi recruitment office injured two medical workers, a passerby, and a serviceman, and killed one person.
FSB’s online HR
FSB handlers employed a systematic recruitment approach, Texty reports. Potential recruits first complete a questionnaire, followed by online interviews where handlers assess skills and capabilities. Russian operators showed particular interest in drone-related expertise, though their specific intentions remained unclear.
“Sensing our interest, they suggested starting with simpler ‘projects’ before moving to something more serious,” Texty journalists report.
These initial tasks involved creating and placing propaganda materials, including stenciled advertisements for their Telegram channels.
“We were gradually, but very insistently, led to the need for real violence against representatives of the Recruiting office and the Ukrainian authorities in general,” Texty wrote.
Promised payments
Texty noted that the schemes for recruiting saboteurs were not unlike standard MLM practices. Recruits started with simple tasks, such as distributing propaganda leaflets or painting graffiti for $70–$110, before progressing to more lucrative assignments.
Sometime later, a Telegram post emerged on the channel showing a price list for higher-level sabotage and even assassination.
The investigation revealed a sophisticated network structure, comprising one main Telegram channel with approximately 5,000 members and multiple regional channels for each oblast center, each having several hundred to nearly thousand participants.
The FSB handlers promised:
- Up to $5,000 for attacks on recruitment center buildings
- Up to $3,000 offered for setting military vehicles on fire
- “Negotiable price” for assassination of the military
“Interestingly, law enforcement efforts to track down those setting vehicles on fire have apparently yielded results. As a result, Russian handlers now advise slashing tires or immediately moving on to assassination attempts,” Texty noted.
Ukraine detains more than 450 in Russian-orchestrated arson network
The SBU reported on multiple occasions that handlers often promise large sums of money but do not actually pay when a gullible wannabe agent commits an actual crime.
Posing as Ukrainians, specific focus on minors
Notably, the FSB handlers deliberately avoided any mention of “Russian world” ideology, despite their posts being in Russian. Instead, Texty reports, the administrator claimed to be Ukrainian, insisting Russians allegedly had no connection to the operation.
“I’m doing this for my children so they can live in a normal country,” the handler wrote, while avoiding questions about funding sources.
The investigation revealed a specific focus on young people, including teenagers. One announcement specifically targeted 15- to 17-year-olds. Those under 18, as minors, would receive a reduced sentence if convicted.
Telegram
Texty stressed that “it has always been the case, and it will continue to be the case” that Russia uses the Telegram messenger to recruit new agents.
Similarly, the SBU reports having screenshots of agents correspondents with their Russian handlers feature the screenshots from Telegram.
Telegram Messenger, headquartered in Dubai, was founded in 2013 by two Russians, Nikolai and Pavel Durov, who previously created VK, Russia’s clone of early Facebook. Initially, the messenger gained popularity among Russians.
In Ukraine, Telegram saw a surge in use during Zelenskyy’s 2019 presidential campaign, as his team actively utilized it. Its importance grew further in 2022 during the initial phase of Russia’s full-scale invasion, when Ukrainian government websites were hit by DDoS attacks, prompting official institutions to launch Telegram channels for real-time updates.
US lawyer helped connect FSB operatives with Zelenskyy campaign in 2019, The Times says
In 2024, Kyrylo Budanov, chief of Ukraine’s HUR defense intelligence agency, stated that Telegram posed a national security threat. Oleksandr Melnychenko, a representative of the SBU’s Department for Counterintelligence Protection of State Interests in the Information Security Sphere, claimed that Telegram cooperates with Russia’s FSB and Roskomnadzor, including complying with Russian requests to block certain channels.
In September 2024, Ukrainian officials and military personnel were banned from using Telegram on work devices. The National Cybersecurity Coordination Center issued the decision on 19 September, with approval from the National Security and Defense Council. Telegram use was also restricted on critical infrastructure sites due to national security concerns.
However, Telegram was not banned entirely in Ukraine, unlike most Russian propaganda platforms, including Kremlin-funded news agencies and Russian social networks.
“The authorities have done nothing to block [Telegram] in Ukraine, although it is technically possible. So there is only one thing we can be sure of: even if we manage to block a single channel, a network of new ones will appear in its place tomorrow,” Texty wrote, noting that all investigation findings were to be passed to law enforcement agencies.
Related:
- The cost of “easy money”: Russian services eliminate their own sabotage recruits in recent attacks on Ukraine’s military recruitment centers
- YLE: Multiple drone sightings reported near Finnish gunpowder factory
- Armed assailant kills military recruitment officer, while deadly explosion rocks recruitment center in Ukraine
- “Disposable agent”: Russia kills own recruit in Ukraine military center bombing plot, SBU says
- US lawyer helped connect FSB operatives with Zelenskyy campaign in 2019, The Times says
- Ukraine detains more than 450 in Russian-orchestrated arson network
- Russian spy ring busted in Poland – RMF24 (2023)
