Just after 2 p.m. on Valentine’s Day this year, a middle-aged woman in a bright red coat walked over to a group of Ukrainian soldiers standing outside a cafe in the city of Mykolaiv. The soldiers, who were just finishing their lunch break, stood in a group, chatting, and clearly didn’t think much of the woman as she placed the bag she was carrying on the ground. Within seconds, the bomb hidden inside the bag was remotely detonated, killing her and three of the Ukrainian soldiers instantly.
As first responders rushed to the scene, a coordinated messaging campaign got underway across Russian media, including the state-controlled Izvestia newspaper. The blast, it was suggested, was the revenge of a distraught mother, driven to murderous insanity by the grief of losing her only son to the war after he was forcibly mobilized by the Ukrainian authorities. The soldiers who were killed, the messaging campaign added, were military recruiters.
As is the case with most Russian influence operations, nothing stated was true. The killed soldiers didn’t work for any recruitment office; they were all members of Ukraine’s demining corps. The bomber, a 42-year-old mother from the city of Horishni Plavni in Poltava oblast, had left her very-much-alive infant child in a nearby hostel when she left on what became a “suicide bombing” mission. Recruited on the social media platform Telegram, which, despite its Russian ownership, is still ubiquitous in Ukraine, she was not aware of her lethal cargo. Her Russian intelligence contact told her merely that she was to deliver a large amount of money to a certain location. The bomb had been prepared by a group of teenagers, aged between 14 and 17, also from Poltava oblast. They’d built the device under instruction from their Russian handlers and handed it off to its unwitting transporter. Russian intelligence tracked the woman’s arrival at the target site and detonated the package remotely. (The Ukrainian government has not released the names of any of the bombers or victims mentioned in this article.)
Nearly a month later, one early evening in March, two teenagers, one 15 and the other 17, were walking near the railway station in the city of Ivano-Frankivsk, in a part of western Ukraine largely spared from the daily carnage of war, when the improvised explosives they were carrying detonated. The older of the two was killed instantly; his younger friend was hospitalized with severe injuries. The device they had been carrying, which they’d assembled under the supervision of their Russian handlers, had been constructed with GPS tracking and remote detonation, as was the case with the bomb in Mykolaiv. As the two teenagers walked close to their target, their Russian handlers, who had initially recruited the pair with the prospect of earning “easy money” for simply making and planting the bomb, according to the Ukrainian security services, called in the detonation. The teenagers hadn’t realized they were going to be part of the butcher’s bill.
These attacks were just the latest examples of a tactic increasingly used by Russian intelligence in Ukraine, which is reminiscent of the more grisly actions of militant groups: turning gullible or desperate civilians into human weapons. “It’s al Qaeda and ISIS-level tactics,” said Ed Bogan, a former CIA officer with extensive experience dealing with both Russia and international Islamist groups. “There are no limits to what the Russians will do now.”
“The Russian intelligence services consider such people ‘one-time’ assets and have never been worried about them,” one Ukrainian intelligence officer told New Lines. “Teenagers and young people are easier to recruit for such actions, when you characterize what they’re being asked to do as some sort of game.”
So pervasive is this gruesome tactic that the SBU, Ukraine’s domestic security service, and National Police have taken to visiting schools and lecturing Ukrainian students on the dangers of foreign recruitment under the rubric, “Burn the FSB Officer,” referring to Russia’s domestic security service.
“How do you know that they are trying to use you?” National Police spokesperson Yulia Girdvilis asked a classroom in Kyiv recently. “For example, a stranger writes to you on social media and offers ‘easy money’ for completing a simple task. They hint to you that ‘it’s not scary, nothing bad will happen.’ Russian agents can also resort to intimidation or blackmail. And the tasks can be arson, mining, taking photos of objects, transmitting information or even terrorist attacks.”
These attacks have occurred all over Ukraine.
On Feb. 1, a 21-year-old unemployed man from Zhytomyr took an explosive device into a military enlistment office in the western Ukrainian city of Rivne. His Russian handlers monitored him via a livestream from his mobile phone, then detonated his payload, killing him instantly. Four days later, on Feb. 5, a man brought a package into a recruitment center in Kamianets-Podilskyi. As soon as he handed it over to Ukrainian soldiers at the security checkpoint outside, it exploded, killing him and injuring four others. In a particularly horrific incident, a 14-year-old schoolgirl in Ternopil was approached on Telegram by Russian recruiters offering her money. After initial contact was established, and the schoolgirl refused to go along with the plan, Russian agents hacked her phone to force her cooperation, threatening to release intimate photographs of her onto the internet. She complied, assembled an improvised explosive device as instructed and attempted to leave it near a local police station, but was detained by Ukrainian security services.
“It’s an incredibly sinister and insidious tactic but, unfortunately, very effective,” Liubov Tsybulska, a Ukrainian expert in Russian hybrid warfare told New Lines, comparing the methods to those used by violent Islamist groups targeting the West. “It’s similar to tactics used by al Qaeda or Islamic State, except the people Russia recruits don’t know they’re going to blow themselves up. And they are happy to use the most vulnerable people — women or children — in such attacks. They really don’t care.”
Ukrainian authorities believe the choice of targets — military facilities and recruitment centers — is partly designed to exploit existing tensions in wartime Ukraine, where military recruiters often come under enormous criticism, even from patriotic Ukrainians, for their heavy-handed approaches to ensuring military-aged men are enlisting. Under martial law, Ukrainian men aged 18 to 60 are considered eligible for military service and are banned from leaving the country while men between 25 and 60 are actively subject to mobilization.
After the blast in Kamianets-Podilskyi, Ivan Vyhivskyi, the the head of the Ukrainian National Police, said, “We, together with the [Security Service of Ukraine], clearly understand that this is a specific attack by the Russian special services with the aim of creating a false opinion in society, destabilizing the situation and creating a negative attitude towards the Security and Defense Forces.”
Russian attempts to exacerbate preexisting tensions in society via Telegram-incited active measures are not limited to Ukraine.
In the United Kingdom, Russian-linked Telegram channels attempted to incite arson attacks on mosques and the spraying of racist graffiti. Such attacks would be rewarded with cryptocurrency. The British government is taking such threats seriously, with the head of MI5, Ken McCallum, warning in October 2024 that Russia’s military intelligence agency, the GRU, was on a mission to cause “sustained mayhem on British and European streets.”
Since Russia’s full-scale invasion of Ukraine in February 2022, Moscow’s intelligence services and its various proxies have been responsible for at least 59 incidents, including assassination attempts, cyberattacks, arson and acts of vandalism, particularly on sites where materiel destined for Ukraine is manufactured or stockpiled. (Czech officials have publicly put the number of attacks in Europe higher: 100 attributed to Russia in 2024, another 500 suspected.)
These incidents have occurred all across Europe, according to a recent investigation by the Associated Press. The GRU was also behind an ambitious plot to place incendiary devices aboard several cargo planes en route to North America, one of which blew up on the tarmac at a DHL logistics hub in Leipzig, Germany, according to Western intelligence officials.
Behind much of the carnage are veterans of GRU Unit 29155, an elite black ops group responsible for poisoning Sergei and Yulia Skripal in Salisbury in 2018 as well as a host of bombings on Bulgarian and Czech weapons and ammunition depots dating back over a decade. Unit 29155 has also been implicated in recruiting Afghans to pay Taliban fighters to target U.S. and coalition forces in Afghanistan prior to the 2022 American withdrawal from the country.
Since 2023, Unit 29155 has been working under a new parent organization within the GRU known as the Department of Special Tasks — a name reminiscent of a Cold War-era KGB department responsible for assassinating Ukrainian nationalists and, most notoriously, exiled Russian revolutionary Leon Trotsky in Mexico.
According to Alex Finley, a former CIA officer who has written extensively about Russian active measures, “These attacks are designed to be deniable and below the threshold of what we generally consider an act of war. But to Russia, these attacks are very much part of their war plans. Hybrid attacks that combine kinetic actions with information operations are weapons Russia is using against us. They do it to destabilize the Western alliance from the inside, in order to lower Western resolve to support Ukraine.”
In Ukraine, the GRU is believed to collaborate with other Russian intelligence agencies. Russian psychological operations are conducted by different teams, including the FSB and information units embedded with the Russian infantry and private military companies.
“What we see in the news is just the tip of the iceberg,” Tsybulska told New Lines, explaining that there have been hundreds of such incidents, with nearly a fifth involving children. As well as bombings, in some cases teenagers are being paid small amounts of money to carry out less significant acts of sabotage, such as setting military vehicles on fire. And the pool of potential recruits is huge. “Almost all children in Ukraine use Telegram,” she said.
Such attempts often target those on the fringes of Ukrainian society who are more easily manipulated by the prospect of fast money: the poor, the unemployed, those with substance abuse problems.
A nationwide campaign has now been launched by the Security Service of Ukraine in schools, warning children of the danger of such Russian active measures and imploring them to report any such approaches to Ukrainian authorities.
Sign up to our mailing list to receive our stories in your inbox.