Ukraine’s GUR Confirms Russian Operatives Behind Domestic Sabotage and Surveillance
Ukraine’s military intelligence service, the GUR, has confirmed that two Russian men, referred to as Ivan and Foma, are actively working for Kyiv to conduct sabotage and surveillance operations within Russia. Ivan, a former political opposition member, claims to have hidden drone components near military airfields and participated in strikes on strategic assets, including a drone factory in Yelabuga. Foma, living in exile in Poland, manages a network of undercover volunteers who surveil high-ranking Russian officers, such as Lt Gen Fanil Sarvarov, who was assassinated in December 2025. While the GUR acknowledges it cannot fully verify the men’s activities due to operational secrecy, it confirms their employment. The operations rely on decentralized, cell-based structures to avoid detection by Russian security services, with operatives often unaware of each other’s identities. Ivan notes that ideological recruits are scarce, as many have fled or been imprisoned, while Foma estimates his network includes 300 to 500 individuals across Europe and Russia. Both men emphasize that their actions aim to accelerate the fall of Vladimir Putin’s regime by targeting military infrastructure and personnel, though they stress that civilians are not the intended targets. The GUR maintains strict caution, noting that trust in agents is limited, with one handler stating, 'I'm not sure of anyone, except myself.'
Key points
- The GUR confirmed that Ivan and Foma are working for Ukraine’s military intelligence service.
- Ivan claims to have hidden explosives and drone components near Russian military airfields.
- Foma manages a network of undercover volunteers who surveil high-ranking Russian officers.
- Lt Gen Fanil Sarvarov was assassinated in Moscow in December 2025 after being surveilled by Foma’s network.
- The GUR acknowledges it cannot fully verify the activities of its agents due to operational secrecy.
- Foma estimates his network includes 300 to 500 individuals across Europe and Russia.
Background
This development follows a series of recent incidents involving Russian-linked sabotage and intelligence operations in Europe and Ukraine. In September 2026, Estonia accused Russian security services of orchestrating an arson attack on a drone maker, while the US charged five individuals in a Kremlin-linked plot to kill dissidents and sabotage infrastructure. Additionally, a joint European investigation revealed a Cuban salsa instructor in Russia recruiting 'disposable agents' for sabotage across four EU countries. These events highlight a broader trend of hybrid warfare and intelligence operations targeting Ukraine-supporting nations. The current story adds to this context by detailing internal Russian operations that directly support Ukraine’s military efforts, marking a shift from external sabotage to internal subversion.
Why it matters
The confirmation of active Russian operatives working for Ukraine’s GUR within Russia underscores the escalating internal conflict and intelligence warfare surrounding the Russia-Ukraine war. These operations, targeting military infrastructure and high-ranking officers, aim to disrupt Russia’s war effort and potentially accelerate the fall of Vladimir Putin’s regime. The use of decentralized, cell-based structures and the scarcity of ideological recruits highlight the challenges and risks involved in such operations. This development also raises questions about the reliability and trustworthiness of agents, as the GUR itself acknowledges uncertainty. The broader implications include increased tensions between Russia and Ukraine, potential escalations in hybrid warfare, and the growing role of internal subversion in shaping the outcome of the conflict.
What to watch
The GUR is likely to continue supporting and expanding its network of Russian operatives, focusing on targeting military infrastructure and high-ranking officers. Ivan and Foma may face increased scrutiny from Russian security services, leading to potential arrests or counter-intelligence operations. The decentralized nature of the network may make it difficult for Russian authorities to dismantle, but the risk of exposure remains high. Ukraine may further leverage these operations to disrupt Russia’s war effort, while Russia may intensify its efforts to identify and neutralize such agents. The outcome of these operations could influence the broader trajectory of the war, potentially accelerating or delaying the fall of Putin’s regime.
Want the full story? Read the original reporting
Read on BBC