It is an ordinary evening in a Ukrainian city. A soldier on rotation matches with a woman on a dating app. She is warm, attentive, quick to reply. Over several days, trust builds. She suggests a place to meet. What the soldier cannot know is that the profile is run by a Russian intelligence handler, the photographs are stolen, and the meeting point was chosen before the first message was ever sent, because the explosives are already there. The date is a trap.
This is not a scenario. It is a documented Russian tactic used inside Ukraine. Such traps are part of a Russian digital campaign that runs through messaging apps, job boards, online marketplaces, social networks, and increasingly through children.
The war in Ukraine is usually told in the traditional language of military combat with an emphasis on missiles, drones, artillery, and the line of contact. But since spring 2024, Russia has been waging a second campaign far behind the front lines. Its weapons are arson, sabotage, and terrorist attacks. Russia’s instruments are Ukrainians themselves, who are recruited online, deceived, and discarded. The objective is to spread fear, manufacture chaos, and destabilize the state from within.
The task of countering this campaign has fallen largely to the National Police of Ukraine. Their record speaks for itself: In 2025, every second attack Russian special services planned was stopped before it could be carried out. How that happened is a story American policymakers and police chiefs should study closely.
Russian intelligence services recruit through the platforms ordinary people use every day: Messaging apps, job search sites, online marketplaces, dating services, and social networks. Russian operatives often create anonymous accounts disguised as patriotic movements, anti-war initiatives, or Ukrainian opposition projects. Behind the façade sits Russian intelligence. They typically target people in difficult life circumstances or those searching for easy money.
Recruits are regarded as expendable. To avoid paying their operatives, Russian services routinely turn them into unwitting suicide bombers. When a recruit carrying explosives reaches the assigned location, the device is detonated remotely, without warning and with no chance of survival. It is crucial to inform the public about this, because the scheme depends on lack of awareness.
The scale of Russia’s campaign is well documented. During 2024, 558 arson attacks were committed across Ukraine. Police detained 288 people (211 men, 12 women, and 65 minors). Nearly all had been recruited online with promises of quick money. This is not vandalism or youthful misjudgment. It is a weapon of war, engineered by an enemy state.
Stay updated
As the world watches the Russian invasion of Ukraine unfold, UkraineAlert delivers the best Atlantic Council expert insight and analysis on Ukraine twice a week directly to your inbox.
The Ukrainian police have taken the lead in combating this campaign. Working with the Ukrainian Security Service, the police stopped treating each arson attack as an isolated crime and began dismantling the system that produces them. This meant targeting the recruiters and handlers, along with the logistics networks that move money and devices.
Counter sabotage work focused on the digital environment where recruitment takes place, allowing plots to be identified and neutralized at the planning stage. Meanwhile, an information campaign was launched in the national media and in schools that named the “easy money” offer for what it is: Bait.
The results are measurable. In 2025, police stopped 27 terrorist attacks during the preparation phase, before a single device detonated. A further 52 attacks were foiled in total, representing half of all planned operations. Arson fell from 558 cases in 2024 to 369 in 2025, of which 251 were solved with 243 people detained.
Most telling of all, more than 250 Ukrainian children have come to the police at their own initiative to report recruitment attempts. There has also been a rise in public reports about suspicious objects and people, helping officers to intervene before an attack matures. The population itself has become part of the sensor network.
Russia’s campaign has targeted the police directly, precisely because they stand between the state and those working to break it. In 2025, twelve crimes against police personnel were documented. In the Rivne region, a taxi rigged with explosives was directed at a police station, but the device detonated before the vehicle reached its destination. In the Odesa region, a recruited woman carried a bag containing an improvised explosive device into a police administrative building; the blast injured three officers and killed the woman herself. In another case, officers responding to a report of a body discovered in an abandoned building walked into an ambush but escaped unharmed. A false call is now a potential weapon for the enemy. Every response is planned accordingly.
The most disturbing aspect of Russia’s campaign is the age of recruits, who are as young as thirteen years old. In 2025, police detained 69 minors for sabotage-related activity. Criminal police in the Odesa region uncovered a mother and daughter who had been paid to set fire to critical infrastructure and vehicles belonging to Ukrainian service members. Russian agents had first reached the daughter through Telegram. When her attempt to ignite railway infrastructure failed, she drew her mother into the scheme. Together, they burned a Ukrainian soldier’s vehicle.
Eurasia Center events
For the United States, this is not only a Ukrainian story. The digital infrastructure this campaign runs on is the same infrastructure Americans use every day, while the playbook is deliberate, repeatable, and cheap. A hostile intelligence service does not need to insert an agent across a border when it can recruit one already in place, anonymously, for a few hundred dollars. Ukraine is simply where the model has been run at full scale first.
Five lessons from Ukraine’s experience translate directly. First, prevention must be the organizing principle. Ukraine’s numbers turned when investigators stopped working arson attacks case by case, and began mapping and dismantling the recruitment networks behind them.
Second, the digital environment is the primary crime scene. Recruitment, tasking, and payment all happen online. Capability to monitor this environment is vital as it makes interdiction at the planning stage possible.
Third, public communication is an operational tool, not an afterthought. In Ukraine, naming the scheme publicly in national media and in classrooms collapsed the supply of recruits and brought more than 250 children forward voluntarily. Silence protects the handler.
Fourth, police officers and facilities must be understood as targets. Rigged vehicles, planted devices, romantic lures, and false calls designed as ambushes are all documented tactics. Protective posture, response protocols, and training should reflect this threat.
The fifth factor is trust. The recruitment model preys on isolation, desperation, and grievance. A police department that the wider community, and especially its young people, are ready to approach voluntarily denies a hostile service its raw material. Community policing is usually defended in the language of legitimacy. Ukraine’s experience defends it in the language of counterintelligence.
For Ukraine’s National Police, the mission continues. For American policymakers and police leadership, the requirement is to learn from Ukraine’s experience and act accordingly. This means building threat awareness before the first case appears. Fusion centers and police departments should be briefed on the platform-based recruitment model so the first rigged vehicle or staged call is recognized as part of a campaign and not filed as an anomaly.
It is crucial to adopt a network-first investigative doctrine. Coerced sabotage should be treated as an organized, Russian state-directed crime from the first incident, with the recruiter and the logistics chain as the primary targets of investigation. Training and protocols should account for staged provocations such as ambushes disguised as routine calls, devices delivered by intermediaries, and lures aimed at individual officers and service members.
Schools should be a key part of prevention planning. Age-appropriate education modeled on Ukraine’s experience can turn the most targeted population into the earliest warning system. Community trust should also be viewed as a security asset, measured and resourced accordingly. Voluntary reporting moved Ukraine from reacting to attacks to preventing them.
Russia’s campaign inside Ukraine has failed to achieve its goals. It has not broken public order or turned Ukrainians against their state. in 2025, half of all planned attacks never happened at all, because the police shut it down before it ever hit the streets. But the model survives its failures. It costs Moscow almost nothing to run, improves with each iteration, and can be replicated virtually anywhere.
The United States has been handed the rare advantage of foresight: A fully documented adversary playbook and a fully documented answer to it. Ukraine built its answer under fire. American law enforcement can build its own response in peacetime. The key is to begin before the first taxi is rigged, the first officer is lured, and the first thirteen-year-old is recruited on an app their parents have never heard of. A state whose citizens cannot be turned against one another cannot be broken. That is the lesson from Ukraine’s home front. It is available to anyone willing to learn it.
Andrii Niebytov is Deputy Head of the National Police of Ukraine and Chief of the Criminal Police. He is a member of the International Association of Chiefs of Police. He holds a Doctor of Science of Law degree in Criminal Law and Criminology and Criminal Executive Law and has been awarded the academic rank of Professor in Criminology and Criminal Executive Law.
Clara Kaluderovic is a nonresident fellow at the Atlantic Council’s Eurasia Center, a former Schmidt Fellow at the Special Competitive Studies Project, and a member of the Aspen Strategy Group’s Rising Leaders Class of 2026. She is co-founder and CEO of Mental Health Global, a nonprofit partnered with the Ukrainian Armed Forces to deliver AI-enabled mental health support in conflict zones.
Further reading
The views expressed in UkraineAlert are solely those of the authors and do not necessarily reflect the views of the Atlantic Council, its staff, or its supporters.
The Eurasia Center’s mission is to enhance transatlantic cooperation in promoting stability, democratic values, and prosperity in Eurasia, from Eastern Europe and Turkey in the West to the Caucasus, Russia, and Central Asia in the East.
Follow us on social media
and support our work
Image: Train tracks run through a village in Chernihiv region, Ukraine. November 27, 2025. (REUTERS/Thomas Peter)