Adversary Intelligence — 2026-07-05

Russian Intelligence Forges Official SBU Documents to Recruit Ukrainian Civilians as Saboteurs Across Ukraine and Europe

BLUFRussia's state-impersonation recruitment pipeline exploits leaked commercial databases and citizens' deference to authority, giving handlers a scalable sabotage network resistant to single-channel disruption.

The SBU and National Police reported uncovering dozens of recruitment attempts in 2026 in which Russian operatives pose as SBU or police officers 12. The scheme relies on forged summonses bearing fake signatures of senior SBU officials, ordering targets to appear on fabricated charges, often an alleged purchase of pharmaceuticals on Russian websites 13. Handlers then offer to close the invented cases in exchange for tasks escalating from surveillance and courier runs to building improvised explosive devices and arson against Defense Forces vehicles or administrative buildings 123. Targets are identified through leaked online-store customer databases, and some are also pressed to transfer money to Russian-controlled accounts or via courier 12. The SBU said it never issues tasks by messenger and directed citizens to report suspicious contacts through its Telegram chatbot or the 1516 hotline 23.

Analysis
The scheme industrializes sabotage recruitment by exploiting reflexive compliance with state authority rather than relying solely on financial coercion, and leaked commercial databases give handlers a scalable targeting mechanism that survives any single messenger takedown. The escalating tasking ladder, from surveillance to arson to device construction, shows handlers screening for compliance before committing higher-value operations, extending Russia's low-cost-agent model already used against NATO states into a state-impersonation variant. The reporting traces to one primary SBU disclosure, repackaged without independent corroboration by other outlets, which may serve deterrence and counterintelligence messaging as much as factual warning, inflating the "dozens" figure to discourage further recruitment. SBU's standing intake infrastructure will likely surface additional documented cases in the coming weeks. That trend will determine whether Ukrainian security services target the leaked-database pipeline itself or downstream sabotage detection. Confidence is moderate, resting on a single uncorroborated source.

4 sources