By Viktor Yahun
As of September 15, 2026, it is no longer possible to speak of isolated cases. This has become a systematic method used by the Russian security services. Its purpose is to identify large numbers of people in Ukraine who can be remotely used to gather intelligence, help direct strikes, carry out arson and sabotage, and even commit murder.
This differs significantly from traditional intelligence recruitment. Today, the FSB and GRU often do not need a trained agent who has been studied, recruited and prepared over a long period. They need someone cheap, controllable and, preferably, disposable. To them, the person carrying out the task is simply expendable.
The internet remains the main environment for finding such people. According to Ukraine’s National Police, 82% of terrorist attacks uncovered in Ukraine were coordinated through Telegram. But the problem is not limited to one particular messenger. Social networks, dating sites, job-search groups and other online platforms are also used.
Recruitment almost never begins with the words “work for Russia”. It starts much more simply: “there’s an easy way to make money”, “we need you to photograph something”, “deliver a package”, or “check an address”. Another approach begins as an ordinary online acquaintance, with the recruiter gradually gaining the person’s trust before making the first request or assigning the first task.
The Security Service of Ukraine (SSU) identifies several of the most common identities assumed by recruiters: an employer, volunteer, law enforcement officer or new acquaintance. Law enforcement agencies have also warned of another dangerous scheme: Russian handlers impersonate SSU officers, police officers or representatives of other Ukrainian law enforcement agencies, frighten people by claiming that they face criminal prosecution and then use this threat to force them to carry out “assignments”.
Young people and minors are a particularly vulnerable group. In June, the SSU said it had identified a Russian GRU officer who recruited children aged between 13 and 18 in Odessa to carry out sabotage and terrorist attacks. In July, a 16-year-old boy was detained in the Vinnytsia region after, according to investigators, agreeing to earn “easy money” by setting fire to a service member’s car.
Another particularly cynical tactic involves relatives of Ukrainian prisoners of war. In late August, the SSU reported an increase in such recruitment attempts. People are contacted by phone or through messaging apps, with recruiters exploiting their fears for relatives in captivity. They demand information about military facilities, military movements or personal data and, in some cases, attempt to persuade people to carry out sabotage, terrorist attacks or contract killings.
The typical scheme is relatively straightforward: identify a vulnerability — money, fear, loneliness, resentment, addiction, a desire for adventure or “easy money”; establish contact; build trust; assign a first task that appears harmless; gradually increase the level of danger; and, once the person has committed the first crime, use it as additional leverage against them.
The line between “just taking a photograph” and actual participation in a Russian operation can be crossed very quickly.
The scale of the problem is already significant. On August 4, the SSU reported that it had recorded more than 300 acts of sabotage and terrorism by Russia in 2026 alone. Of these, 249 crimes had been solved and another 84 prevented.
The consequences for those recruited are very real. In September alone, the SSU reported prison sentences of 10 and 15 years for individuals recruited to conduct espionage, arson and preparations for sabotage. One student convicted of spying on military airfields had also first come to the attention of the FSB while searching for “easy money” on Telegram.
And this is no longer solely a Ukrainian problem. On September 14, a joint investigation by public broadcasters in Germany, Lithuania, Spain and the Czech Republic described a network of so-called “disposable agents” linked to Russian intelligence and acts of sabotage in the Czech Republic, Poland, Romania and Lithuania. The profile is strikingly similar: young or financially vulnerable people recruited through social media and employment platforms, remotely controlled and with minimal direct contact with Russian intelligence services.
The main warning sign of recruitment, therefore, is not the passport, citizenship or accent of the person making contact. What matters is the logic of the interaction itself.
A stranger offers a disproportionately high payment for a simple task. They ask about military personnel, critical infrastructure, movements of military equipment or the aftermath of strikes. They demand secrecy. They ask for photographic or video evidence that the task has been completed. The assignments gradually become more serious. And if the person refuses, the recruiter may resort to threats or blackmail.
Most importantly, people should not try to outsmart such a handler or conduct their own counter-operation. They should preserve the correspondence, contact details, payment information and any other evidence and pass it to the SSU. Reports can be made by calling 1516 or through the SSU’s official “Spaly FSBshnyka” chatbot.
Modern Russian recruitment often begins not with ideology but with a single message: “There’s a job. Quick. Money immediately.”
It can end with a terrorist attack, loss of life and years in prison.
For a Russian intelligence service, a recruited Ukrainian is neither a partner nor an “employee”. They are a disposable tool. The handler will remain hundreds or thousands of kilometres away from the scene of the crime.
The person who carried it out will be the one held accountable under Ukrainian law.
