The SSU Counterintelligence has exposed large-scale attempts by the russian intelligence services to recruit Ukrainians under a false flag. The russian operatives have been posing as officers of the SSU and other Ukrainian law enforcement agencies, coercing citizens under various pretexts into conducting arson attacks, terrorist acts and other crimes.

In 2026 alone, the Security Service and the National Police uncovered dozens of such recruitment attempts.

During these operations, the russian intelligence services:

• call or message people via messaging apps, introducing themselves as officers of the SSU, the National Police, or other law enforcement agencies;
• use online shops’ customer databases to obtain personal data;
• blackmail people with the threat of criminal prosecution under fabricated pretexts (for example, for supposedly ‘purchasing medicines from russian websites’);
• demand money to close non-existent criminal cases;
• incite people to set fire to administrative buildings and Defence Forces vehicles.

The employees of russian intelligence services contact Ukrainian citizens directly by telephone and pose as law enforcement officers or use a variety of other covers and approaches.

One of the most common enemy tactics is to send fake summonses ‘calling for questioning’ to the SSU. To make them appear convincing, these ‘documents’ feature forged signatures of senior SSU officials.

People are then blackmailed. The ruscists convince their victims that they can help to have the relevant criminal cases dropped in return for carrying out certain tasks.

Those recruited are forced to commit illegal acts, such as surveilling a specific individual, transporting a parcel, purchasing chemical components and manufacturing an improvised explosive device, setting fire to a Defence Forces vehicle or an administrative building, and preparing a terrorist attack or act of sabotage.

Sometimes, russian handlers demand money from the victims to ‘evade’ imprisonment: they usually ask them to transfer funds to the enemy’s bank details or to hand over cash via a courier to ‘verify authenticity’.

The Security Service of Ukraine once again urges citizens to remain vigilant. Please note that the SSU operates exclusively within the framework of Ukrainian legislation and does not set any dubious ‘tasks’ or send official documents via messaging apps.

If you are approached with such proposals, if you spot suspicious objects or individuals, or have information on the activities of russian intelligence services or websites and social media pages they use for recruitment, please report this to the SSU using the Burn the FSB-man chatbot (t.me/spaly_fsb_bot), by calling 1516 or by emailing: callcenter@ssu.gov.ua.