At the beginning of 2025, Ukraine faced a new wave of terrorist attacks organized by Russian intelligence services. In just February and March 2025, several attacks were carried out or prevented in Ivano-Frankivsk, Kryvyi Rih, Mykolaiv, and Odesa. In Kryvyi Rih, the Security Service of Ukraine (SBU) detained a 26-year-old man who planned to bomb a Territorial Recruitment and Social Support Center. In Mykolaiv, a 19-year-old woman attempted to plant a bomb near the National Police building. Both were recruited via Telegram and were meant to be eliminated after completing their tasks. In Ivano-Frankivsk, a 17-year-old teenager was killed, and a 15-year-old suffered severe injuries – both were remotely detonated by Russian handlers, used as suicide bombers. Meanwhile, in Odesa, well-known pro-Ukrainian activist Demyan Hanul was assassinated – likely on orders from the FSB, as back in 2024, pro-Russian sources had placed a $10,000 bounty on his head.
A new phase of terror: how enemy intelligence adapts new technologies
These terrorist acts indicate that Russia has entered a new phase of its terror campaign against Ukraine. Russian intelligence services are shifting tactics, focusing on digital recruitment through anonymous channels and using young people and vulnerable social groups as disposable agents, often detonated remotely or abandoned after completing their missions. These attacks target both frontline regions and relatively peaceful western areas, aiming to spread fear, destabilize the rear, and undermine public trust in Ukrainian society.
The terror tactics Russia employs against Ukraine have evolved from traditional sabotage to a complex, digital-oriented hybrid strategy. This approach relies on the digitization of recruitment, the cynical exploitation of perpetrators as “disposable” suicide bombers, and the expansion of the target audience to include the most vulnerable categories of Ukrainians – teenagers, individuals in psychological crises, or those in financial distress.
Previously, Russia relied on trained agents or ideological collaborators among Ukraine’s population for terrorist attacks. Now, it increasingly uses Telegram networks, anonymous chats, and fake job advertisements to remotely orchestrate sabotage operations without direct contact with perpetrators. The Kremlin is adopting some of the most brutal methods used by Islamist terrorist organizations—eliminating its own agents after they complete their missions, leaving them no chance to surrender or survive. This approach removes witnesses and ensures plausible deniability.
This escalation marks a new level of terrorist threat, where the key tools are not physical attacks but information manipulation, psychological programming, and technological anonymity—making Russia’s war against Ukraine even more insidious and dangerous.
Recruitment methods
Russian intelligence services use various channels to recruit perpetrators for their terrorist operations. Given the young age of many individuals involved in these crimes, the following methods stand out:
- Online job ads and Telegram channels promising quick, easy money
Recruitment often begins with anonymous posts in messengers or social networks, particularly Telegram. Russian handlers create fake “job offers” promising easy earnings, sometimes under the guise of assisting the Ukrainian Armed Forces (UAF) or simple courier work. Potential recruits are added to special chats where further contact is established. The lack of control over such chats and their creators remains a pressing issue for Ukrainian cyber forces. - Manipulation, false narratives, and distorted motivation
To lower recruits’ internal resistance, they are deliberately misled—for example, being told they are fighting “corrupt officials”, “saving conscripts from mobilization” or “avenging injustice”. Propaganda Telegram channels portray military recruiters and police officers as enemies of the people, framing terrorism as an “act of civil protest”. - Financial incentives
Money is a simple bait. Recruits are promised rewards ranging from hundreds to thousands of dollars, depending on the risk. However, in reality, many never receive payment—they are often eliminated or left to face justice alone. The FSB typically seeks to leave no traces, so it’s cheaper to dispose of an “agent” than to pay them. - Blackmail and compromising material
One of the most cynical methods is recruitment through intimidation. In a known case, Russian handlers hacked the phone of a 14-year-old girl from Ternopil, obtained her intimate photos, and blackmailed her into agreeing to commit a terrorist act. Such tactics represent gross violations of international law and highlight the total immorality of enemy intelligence services. - Potential use of Artificial Intelligence (AI)
Experts warn that Russian intelligence agencies may already be using AI to mass-process potential recruits. AI-powered chatbots, deepfakes, and fake video or audio messages allegedly from military personnel or government officials can convince individuals of the “authenticity” of their assignments. According to the Ukrainian Crisis Media Center, “In one-third of cases, AI-generated responses were based on fake news sources containing manipulations and outright disinformation.
Who is at risk?
Who are the groups most vulnerable to enemy propaganda?
- Teenagers and young people
They are easily influenced, seek adrenaline or quick money, and often do not fully grasp the consequences of their actions. Cases of recruitment of even 14–15-year-olds via Telegram channels have been documented, with the youngest known recruit being only 12 years old.
“We increasingly see cases where Russian intelligence recruits Ukrainian teenagers online, promising easy money, ‘adult’ tasks, and an ‘important mission’– only to remotely detonate them afterward”, summarize Ukrainian psychologists Olena Lisova and Oleh Mykhailyk. - People in psychological or emotional crises
Those who have experienced personal trauma –divorce, the loss of a loved one, disappointment in themselves, others, or the government – are particularly vulnerable. They may be in an unstable emotional state, making them easier targets for manipulation. - Deserters and former military personnel
Individuals with personal grievances against the military, debts, or a sense of abandonment may be targeted for blackmail or lured with large sums of money for a “one-time job”. - People in financial hardship or job seekers
Those seeking employment, especially high-paying courier work, are at risk. Initially, they may be tasked with simple deliveries – food or documents with decent pay. After several such trips, they may be given a package to deliver to a strategic location, such as a police station – only to be remotely detonated at that moment.
In March 2025, a woman in Bilyayivka, Odesa region, unknowingly carried such a bag to a National Police station and was killed on the spot. - Individuals deceived into thinking they are fighting for justice
Some genuinely believe they are “fighting corruption”, “saving conscripts”, or “avenging injustice”. They are fed distorted information that lowers their moral barriers, ultimately turning them into disposable bombers.
The people at the highest risk are often emotionally vulnerable, lonely, overly trusting, or experiencing personal grievances or disappointments. They may engage in prolonged online conversations seeking support, attention, or understanding. These interactions expose them to manipulative handlers who pose as “friends”, “mentors” or “patriots”. Such individuals may not have malicious intent but, due to naivety, feelings of injustice, or simple belief in “helping the country”, become tools in the hands of enemy intelligence.
Resonant terrorist attacks in Ukraine: rear cities suffer
If you think that only people living near the front line can become victims, that is not the case. In March alone, several terrorist attacks took place in the rear cities of Southern and Western Ukraine.
List of high-profile incidents that occurred in March 2025:
1. Ivano-Frankivsk (March 11, 2025)
Two teenagers – 15 and 17 years old – were recruited via Telegram and made two homemade bombs. Russian handlers remotely detonated one of the devices in the hands of the older boy on his way to the target, killing him. The younger one survived with severe injuries.
2. Mykolaiv (March 7, 2025)
A 19-year-old girl was recruited online and forced to leave an explosive device near the regional police headquarters. The plan was to detonate the bomb with her nearby. She was arrested just minutes before the attack, with all the evidence in her possession.
3. Biliaivka, Odesa region (March 23, 2025)
A woman working as a courier, who had been receiving good payment for deliveries, unknowingly carried a bag with a bomb to the district National Police office. The explosive device was remotely activated – she was killed instantly.
4. Odesa (March 14, 2025)
Pro-Ukrainian activist Demyan Hanul was shot dead by a deserter from the Armed Forces of Ukraine, who was allegedly recruited by Russian intelligence services. It is known that a “bounty” had previously been placed on Hanul in pro-Russian channels, and he had asked the Security Service of Ukraine (SBU) for protection.
Has this happened before? How Russia uses terror as a means of influence
Russia has repeatedly used terrorist methods in the past to achieve its goals. These included residential building bombings or targeted terror. Do you remember the explosions of civilian buildings in Buynaksk, Volgodonsk, and Moscow? That happened when dictator Putin needed to create an enemy image of the Chechens and launch the Second Chechen War.
Personal terror has also been widespread in Russia – just recall the high-profile assassinations of opposition figures Anna Politkovskaya and Boris Nemtsov.
In the 1990s, during the wars in the former Yugoslavia, regional intelligence agencies actively recruited youth for ethnic terrorism and sabotage. The methodology was similar: manipulation, ideological conditioning, and the use of individuals in “proxy wars”. The only difference was the communication channels through which propaganda reached its targets. Today, Russia operates in a similar way, only in digital format and on a larger hybrid warfare scale.
In Syria, terror was direct – through airstrikes and societal destabilization. Russia carried out airstrikes on civilians, hospitals, and schools, under the guise of fighting terrorists. The goal was maximum intimidation, demoralization, and destruction of infrastructure. This experience is now being actively applied in Ukraine.
Another advocate of terror is the terrorist organization ISIS. Islamic fundamentalists used remote recruitment and suicide bombers to inflict significant damage on their enemies. ISIS widely utilized Telegram, fake accounts, and deepfakes to recruit operatives worldwide. Their methods formed the foundation of Russia’s digital terrorist model. However, Russia goes even further by employing these practices on a state level with more resources.
Al-Qaeda imposed its ideology through videos, sermons, and networks of followers, inspiring attacks without direct contact. Similarly, Russia foments hostility toward the state among Ukrainians, using media, Telegram channels, and fake messages. The difference is that Moscow does this not for religious reasons but for political purposes.
Scenarios of Russian terrorism development and state response
If the situation escalates further, terrorist attacks may become even more sophisticated, precise, and technologically advanced. Terrorism can evolve depending on internal and external factors and, with technological advancements such as artificial intelligence, gain new tools of influence. The aggressor may combine physical attacks with information warfare, using psychological pressure, digital manipulation, and societal disorientation through hybrid rear-line operations.
Such actions not only pose a direct threat to citizens’ lives but also overburden law enforcement, forcing them to operate under constant stress. They exert additional pressure on societal morale, fostering anxiety, suspicion, and fatigue. Often, these attacks do not target strategic facilities but rather “undesirable” or inconvenient members of Ukrainian society – volunteers, activists, opinion leaders – those who prevent the aggressor from feeling unchecked in the rear. Such targeted terror appears to be an attempt to “clear the field” for enemy influence and internal provocations.
Despite this, the Security Service of Ukraine (SBU) has demonstrated high efficiency and adaptability to new challenges. In 2024–2025 alone, dozens of terrorist attempts were prevented, agents were exposed, and recruitment and explosives delivery channels were neutralized. Over the past two years of war (2022–2024), 2,000 traitors and 6,000 collaborators have been identified.
SBU is not just reacting – it is learning, expanding its tools, cooperating with partners, and proving that even in the toughest times, Ukraine’s security system is capable of mounting an adequate response.
Recommendations for countering digital terrorism
In hybrid warfare, combating digital terrorism requires not only the efforts of intelligence agencies but also broad societal participation. Modern threats include not only explosives or firearms but also messengers, manipulation, and fake friends in chats who impose foreign narratives. Effective counteraction requires a flexible response system, mutual trust between the state and citizens, and readiness to reconsider some notions of “privacy inviolability” in wartime conditions.
- Intelligence services must expand digital space monitoring, invest in Big Data, improve tracking of suspicious activities on Telegram and other social networks (including TikTok), and have legal tools for prompt intervention.
- Parents are the first line of defense, especially concerning teenagers: it is important to monitor whom the child communicates with, what they follow, and how they react to strangers online.
- Communities should remain vigilant: neighbors, acquaintances, and passersby must report suspicious behavior, paying attention to individuals who appear disoriented, nervous, or engage in long phone conversations near public institutions.
- Technical infrastructure is crucial: the number of surveillance cameras in cities, especially near military facilities, police stations, and registration centers, should be increased.
- Police and security services must have the right to check phones and belongings of suspicious individuals, especially if their behavior suggests nervousness or stress—signals often preceding terrorist attacks in 2025.
- Online job platforms require oversight: recruited terrorists often started with fake courier job offers promising high pay.
- Most importantly, society must understand that increased control does not contradict freedom if it saves lives. In the war between chaos and security, freedom means responsibility and collective action.
Conclusion
Russia’s hybrid war against Ukraine has entered a new phase, where terror is used as a tool of psychological pressure, destabilization, and rear-line disruption. The bet is placed not only on missiles or sabotage but also on mind manipulation –recruitment through chats, targeting socially vulnerable individuals, and using technology and fear as weapons. The enemy exploits war fatigue, economic inequality, and emotional vulnerability, attempting to bring the front line into every neighborhood and every phone. However, recognizing this tactic is already half the battle won.
Despite all the challenges, Ukraine is a state that learns faster than the enemy can devise new schemes. And that is why we will win.
Author: Volodymyr Savchenko.
