7 hours ago
2
Oleh found the job via a Telegram channel offering day work and side gigs. It sounded easy enough: he was to travel from his home in eastern Ukraine to the western city of Rivne, pick up a rucksack containing a paint canister and spray it outside the local police station.
It would require nimble feet to flee the scene without being caught, but the money on offer – $1,000 – was good, fantastic even, for what amounted to a morning’s work for the 19-year-old.
But when, on a snowy morning in early February, he opened the bag outside Rivne’s police station, he recoiled in horror. Instead of a paint canister, he saw something that looked like a homemade bomb, with protruding wires and a mobile phone attached to it, apparently a crude remote detonation mechanism.
The device, if it had detonated, would have made Oleh an unwitting suicide bomber, part of a sinister new trend of attacks inside Ukraine that the country’s SBU security agency says are organised by Russian intelligence officers using local one-time recruits. So far, there have been more than a dozen attacks in which the perpetrator was injured or killed, according to a Ukrainian law enforcement source.
Russia’s sabotage campaign inside Ukraine started last spring, SBU spokesperson Artem Dekhtiarenko told the Guardian. To begin with, it involved arson attacks on military vehicles, conscription offices and post offices. It was primarily aimed at western Ukrainian regions, far from the front.
Ukrainians, often teenagers, were offered money via Telegram to carry out the attacks by “curators” who used a mixture of enticements and blackmail to snare their recruits.
The perpetrators then had to make a video of the fire on their phones, and send the recording as proof the deed had been done. The videos would invariably find their way on to Russia-friendly Telegram channels, as supposed evidence of discontent inside Ukraine, stoking real social tensions over issues such as conscription that have flared during Russia’s war on the country.
These attacks were part of a secret shadow war, raging in parallel with the conflict on the frontlines. Russia is also carrying out arson and sabotage attacks in European countries, according to multiple western intelligence agencies, while Ukrainian services are believed to be behind a number of arson attacks at conscription offices in Russia earlier in the war.
At the end of 2024, Russia apparently decided on a major escalation, moving from simple arson attacks in Ukraine to bombings that are more reminiscent of the tactics of terrorist groups. “They started the mass recruitment of Ukrainians to plant bombs: in cars, near conscription offices, near police departments, and so on,” said Dekhtiarenko.
This account of Russia’s new campaign of bombings in Ukraine is based on prison interviews with perpetrators, who are currently detained and awaiting trial. Their names have been changed. It also draws on access to case materials and interviews with several SBU operatives who have worked on similar cases.
The Russians recruit networks of Ukrainians, the SBU believes, with one person making the bomb and leaving it at an agreed spot. Someone else then collects it, without knowing what it is. The Russian curators can thus set off explosions deep inside Ukraine, without needing to set foot in the country.
The SBU says it has detained more than 700 people since the beginning of 2024 for sabotage, arson or terrorism. Many are unemployed or need money to feed addictions, but about a quarter of them are teenagers, the youngest to date being an 11-year-old girl from Odesa region.
“In some cases, the agents don’t only plant the bomb, but unconsciously perform the role of a suicide bomber. Russians blow up their own agents, this is becoming common practice,” said Dekhtiarenko.
Oleh, 19 and unemployed, was badly in need of cash. “I sat at home and mostly did nothing,” is how he described the last three years, since he left school.
In 2024, he became a father, and he now had a baby to support. So he spent a lot of time on various “work in Ukraine” Telegram channels, looking to make some quick money. On one of them he spotted a post by a man called Anton.
“He said he had easy jobs, payment in dollars. When I contacted him, he told me to take photos of the courthouse, the conscription office, the police station [in my home town]. He paid me $50, to a crypto wallet,” Oleh recalled. The payment was made in USDT, a cryptocurrency stablecoin.
Russian curators usually start off with simple tasks like this, say SBU officers. Taking photographs of sensitive sites is one common request, printing out and hanging a few copies of subversive flyers is another. Then, once the recruit is drawn in, they up the stakes.
“Sometimes they use threats, sometimes they are friendly and encouraging. It depends on who is curating the agent; they use different psychological manipulations on different people,” said Dekhtiarenko.
Often, the curators use youth slang to give the impression the recruit is talking to someone their own age. Sometimes they flirt with the recruits, or offer them moral support about difficult family situations. They will not usually reveal themselves as Russians; they might claim to be Ukrainians who are “tired of war” and want to show there is opposition to it.
If the recruit is proving unwilling, the curator might reveal the Russian connection and use blackmail to push for further action, threatening to send evidence of previous cooperation to the SBU.
“After people perform the first task, they are on the hook,” said Dekhtiarenko. In one case, malware was sent to the mobile phone of a teenage female recruit and the curator threatened to publish intimate photographs and videos hacked from the phone if the girl did not continue to cooperate.
Soon after Oleh had taken the photographs, Anton offered him a new task: to burn down a building in his home town. Oleh didn’t want to do that; he wasn’t a terrorist, he told the man. When Anton insisted, Oleh blocked his account.
But the exchange stuck in Oleh’s mind, because he really needed money. So when another man, who claimed to be called Alexander, got in touch with him on Telegram a few weeks later, and suggested the possibility of earning $1,000 without the need to burn anything, he was sorely tempted.
Oleh was worried about doing the job alone, so he called his old school friend Serhiy and suggested they did the job together. He offered to split the $1,000 down the middle.
“He said: ‘I’ve got some work, wanna come to Rivne?’ I said: ‘What’s the work?’ and he said: ‘I’ll tell you later,’” Serhiy recalled in an interview. Serhiy quickly agreed; he was also unemployed, and had two children. The money would be useful.
Oleh told his girlfriend he was off for a couple of days to make some money for her and their child. Alexander, the Telegram curator, sent him about $200 up front for expenses, again in cryptocurrency, and he bought tickets for a bus from Sumy region to Rivne. The ride took all day; Oleh and Serhiy arrived in Rivne late in the evening. Alexander told Oleh he should find a cheap hotel for the night and await instructions.
The next morning, Alexander sent Oleh a location pin – a garage cooperative on the outskirts of town. “He said all we have to do is pick up a rucksack there with some paint in it,” said Serhiy. The duo set out, a little nervous.
When they got to the location, Oleh called his Telegram contact, who guided him by phone. “He said, ‘Turn right, between garage number 32 and number 33, and you’ll see a tyre,’” Oleh recalled. Stashed inside the tyre, he found a black rucksack and a white plastic bag. He picked up both of them, as instructed.
Alexander told Oleh not to open the bags but to head to the next location he would share via Telegram, which was a pin for the local police station, and then call him. The canister was primed to explode when the bag was opened, Alexander said, spraying the walls of the police station with paint and delivering an anti-establishment message about the futility of war. Oleh called a taxi and the pair headed into town.
Oleh and Serhiy agreed they would split up ahead of reaching the police station; Oleh would be in charge of coordinating with Alexander where he should leave the bag, while Serhiy would keep lookout to check they were not being followed and tell his friend if he spotted anything suspicious.
The Telegram chat between them, seen by the Guardian, shows Serhiy was deeply uneasy. “I’ve seen the same BMW again, and the same woman,” he wrote, suspecting they were being watched. “Let’s hope everything’s going to be OK,” Oleh wrote.
Alexander called Oleh and told him he should open the white plastic bag and take out the box he would find in it. Then he should walk, holding it, towards the entrance of the police station.
Oleh did so, but grew suspicious and opened the box to check the contents. He was startled to see something that looked like very much like a bomb. Panicking, he decided to rush to the nearest police officer, and announced that he feared he was carrying explosives. Just as he did so, SBU operatives pounced on both Oleh and Serhiy, grabbing the packages and forcing the two men on to the ground.
An SBU team had been watching Oleh and Serhiy ever since they picked up the bomb, according to an operative involved in the case. Just three days earlier, Rivne had experienced a very similar attack. An unemployed 21-year-old was recruited on Telegram to pick up a device and take it to one of the city’s military conscription offices. The device exploded, killing the attacker and wounding eight soldiers.
The operative described the scheme in Oleh and Serhiy’s case: the black rucksack contained a homemade explosive device, packed with screws and nails; the smaller bag held a white box containing a less powerful explosive device.
This box had a small hole cut into it, with a cameraphone that transmitted geolocation and images of the surroundings to Alexander, who was also speaking to Oleh on a Telegram call. He could watch video of Oleh’s location in real time and direct him to a suitable spot packed with people. Then, as Oleh waited for the command to remove the supposed paint canister from the bag, the curator would detonate both devices, by calling the phones attached to them.
If this had happened, Oleh would most likely be dead, just like the attacker three days previously. The entrance to the police station was crowded with officers coming and going, and visitors queuing to receive building passes, so many more may have been killed with him.
But the SBU had followed the pair and had special equipment on hand, the operative said, expecting another attack after the previous blast. “We had certain technical means to block the signals to the telephone,” said the source. When Alexander rang the phones strapped to the bombs to detonate them, the calls did not go through.
As for the real identity of Alexander, the SBU is not certain, thought it is confident in the assessment that, one way or another, he represented the Russian services. It is believed that sometimes the curation is done by staff officers of GRU military intelligence or the FSB domestic security service, but both services also recruit go-betweens to make the actual calls.
The SBU has not yet found the person who made the bombs that Oleh and Serhiy picked up, although the assumption is that it was done by another Ukrainian teenager recruited by Alexander. Previously, the SBU in Rivne detained a teenage girl for making similar explosive devices. She had also been recruited on Telegram and was then sent video tutorials on how to make the devices from commonly available products.
To try to counteract the recruitment of teenagers for such tasks, the SBU has launched an awareness programme in Ukrainian schools, to warn children of the dangers of accepting offers to make money from strangers on Telegram.
“The only free cheese is in a mousetrap, as the saying goes,” said one of the officers involved. The agency has also set up a chatbot where young Ukrainians can report any suspicious approaches or Telegram accounts to the authorities.
The big question for European intelligence services, which have been dealing with a wave of Russia-linked arson and sabotage attacks over the past year, is whether Moscow will export its latest tactic in Ukraine to the west. So far, attacks in the west have sought to cause chaos and sometimes material damage, but have not been directly designed to cause bloodshed.
A Ukrainian law enforcement source said that could change: “Ukraine is the testing ground for Russian conventional and hybrid warfare. Look at cyber-attacks, look at arson attacks, look at the sabotage on railways. They test things here, and then they do it in western countries,” said the source.
For Oleh and Serhiy, being caught may have saved their lives, but they are now behind bars, awaiting a trial in which they could be sentenced to up to 12 years of prison time. Oleh said he is not sure yet if he will plead guilty; he insists he did not realise he was working for the Russians, or that his actions could have led to carnage.
In a brief telephone conversation from the prison where he is being held in Rivne, his girlfriend told him to forget about ever speaking to her or their child ever again. He also had a short phone call with his parents, the content of which he summed up glumly and succinctly: “They said I’m an idiot.”
