In the thick of the ongoing conflict, the internal battle for security within Ukraine has been complicated by a persistent and evolving threat: the recruitment of Ukrainian citizens as informants and saboteurs for the Russian Federation. Since the full-scale invasion in February 2022, the Security Service of Ukraine (SBU) has arrested thousands of individuals suspected of treason and collaboration. These activities range from passing coordinates of military targets to conducting physical acts of sabotage, reflecting a multi-layered strategy by Russian intelligence to erode Ukrainian resistance from within.
The motivations behind such collaboration are rarely singular, often involving a complex mix of financial desperation, ideological alignment,
and coercive pressure. For many, the primary driver is economic. In regions devastated by war where jobs have vanished, Russian handlers frequently use social media platforms—most notably Telegram—to offer “easy earnings”. These tasks often begin with seemingly minor assignments, such as photographing local infrastructure or transport routes, for which payment is made in cryptocurrency to avoid detection. However, these “one-time agents” are quickly drawn into more dangerous operations, including tracking the movements of high-ranking officials or providing the precise GPS data required for guided missile strikes.
Ideology and historical ties also play a significant role. In parts of eastern and southern Ukraine, certain individuals retain a pro-Russian sentiment rooted in shared linguistic, cultural, or familial bonds from the Soviet era. These “ideological” spies often believe they are assisting a “liberation” force rather than an invader. In other cases, collaboration is born out of the sheer necessity of survival in occupied territories. Residents may accept Russian passports or provide information to occupying authorities simply to access healthcare, pensions, or food supplies, effectively being coerced into a life of informant work to protect their families.
Russian intelligence agencies, specifically the FSB and the GRU, have also refined their recruitment tactics to target more vulnerable demographics. Recent reports in 2025 and early 2026 have highlighted a disturbing trend: the systematic targeting of Ukrainian teenagers. Lured by the promise of quick cash and often unaware of the severe legal consequences, minors have been caught setting fire to military vehicles or electricity hubs along vital railway lines. Ukrainian counterintelligence officials note that because these individuals are often poorly trained, their activities are frequently detected, but the sheer volume of such recruitment attempts creates a massive “noise” that strains Ukraine’s security resources.
Here are five specific examples:
1. The Kyiv Bank Insider (Arrested February 9, 2026)
In a major breach of financial data security, the SBU detained a 40-year-old employee of a prominent commercial bank in Kyiv. Working within the bank’s information security department, the suspect allegedly used his privileged access to harvest the personal data of active-duty Ukrainian soldiers and military volunteers. Investigators believe this information was being funneled to the FSB to help Russia identify targets for assassinations, blackmail, or recruitment.
2. The Khmelnytskyi “Video Trap” Agent (Arrested February 9, 2026)
A 60-year-old woman in the western city of Khmelnytskyi was caught red-handed while attempting to set up a “video trap” near a military installation. Having been recruited via Telegram with the promise of a new life in Russia, she rented an office on the top floor of a commercial building under the guise of starting a “cosmetic services” business. Instead, she installed high-resolution cameras on the windowsills to provide the FSB with a live remote feed of Ukrainian troop movements and air defence sites.
3. The Sloviansk Railway Saboteur (Arrested February 10, 2026)
A 33-year-old employee of Ukrzaliznytsia (Ukrainian Railways) was apprehended in the frontline town of Sloviansk. According to SBU reports, the suspect utilised his role within the national railway network to track the transport of Western-supplied heavy weaponry and tanks. He allegedly passed the precise coordinates of these logistics hubs to Russian military intelligence to facilitate missile strikes aimed at crippling Ukraine’s supply lines.
4. The Lviv “Oreshnik” Damage Assessors (Arrested January 22, 2026)
In the aftermath of the January 8-9 Oreshnik missile strikes on Lviv, the SBU arrested a pair of agents—a 64-year-old man from Mukachevo and his 22-year-old unemployed neighbour. The younger agent was tasked with visiting the impact sites to photograph the damage and mark GPS coordinates on Google Maps. This “battle damage assessment” was intended to help the Russian GRU refine their targeting for a second wave of strikes on the region’s civilian and military infrastructure.
5. The Rivne “Sleeper” Agent (Arrested February 11, 2026)
A 28-year-old Russian citizen who had been living in the western city of Rivne since 2021 was arrested for spying on Ukraine’s Special Operations Forces (SSO). Posing as an ordinary resident with “Ukrainian roots”, the suspect was revealed to be a former Russian military intelligence officer. He had spent years attempting to infiltrate the social circles of elite soldiers to identify partisan members and clandestine operatives, passing their identities back to the FSB via secure, encrypted channels.
The legal response from Kyiv has been swift and uncompromising. In 2022, the Verkhovna Rada adopted strict anti-collaboration laws, introducing life sentences for high treason committed during martial law. High-profile arrests, such as that of a senior official in the SBU’s anti-terrorist centre in February 2025, serve as a reminder that the reach of Russian influence can extend deep into the state’s own security apparatus. As the war continues into 2026, the “war of the shadows” remains as critical as the frontline, with the SBU continuing to dismantle sleeper cells that Russia maintains as its “eyes and ears” inside Ukrainian territory.
/images/ppid_a911dc6a-image-177106302538573741.webp)
