Invisible front lines: Ukrainian intelligence cells inside Russia

Tuesday 23 December 2025

When people speak about the war, they usually picture trenches, drones and artillery. Yet there is another contest running in parallel, quieter but strategically potent: the struggle between intelligence services, waged through surveillance, recruitment, sabotage and targeted killings. Russia calls it terrorism. Ukraine tends to frame it as legitimate wartime action against commanders and infrastructure that sustain the invasion. Whatever the label, the pattern is increasingly hard to ignore.

The Moscow car bomb and what it signals

On 22 December 2025, Lieutenant General Fanil Sarvarov, a senior officer of Russia’s General Staff, was killed in Moscow when an explosive device detonated beneath his car soon after he set off. This sort of attack is typical of a grenade attached to the bottom of the car, whose pint was attached to the axle with a piece of string. Russian investigators opened a murder case and Russian officials publicly pointed towards Ukrainian involvement, while Kyiv has not claimed responsibility. 

In operational terms, a killing like this is less important for the physical loss of one man, however senior, than for what it advertises: that Russian counter-intelligence cannot reliably protect even high-ranking figures in the capital. It invites every general, procurement chief and security official to ask the same question: if this could happen in Moscow, what does “rear area” even mean?

What an “intelligence cell” looks like in practice

When commentators talk about Ukrainian intelligence cells operating in Russia, they are rarely describing a single, centrally run spy ring with a clear hierarchy. The modern pattern is more fragmented:

• Small, compartmentalised groups or individuals who perform narrow tasks (watching a routine, delivering a package, renting a flat, buying equipment), often without knowing the full plan.

  
  

• Cut-outs and proxies, including criminal intermediaries and ideologically motivated volunteers, used to distance state services from the last step in an operation.

  
  

• A blend of remote direction and local initiative, where an external handler provides targeting guidance and tradecraft while the on-the-ground actor manages access, timing and concealment.

This structure is not unique to Ukraine. It is how many states run covert action in hostile environments, because it reduces the damage from any one arrest. It also makes attribution politically messy, which can be a feature rather than a bug.

A pattern of senior-target attacks inside Russia

Sarvarov’s death sits within a series of high-profile incidents that Russia has blamed on Ukraine and that Ukraine, depending on the case, has denied, hinted at, or openly acknowledged.

Associated Press has summarised several of the best-known examples since 2022, including:

• The December 2024 killing in Moscow of Lieutenant General Igor Kirillov, which Ukraine claimed responsibility for.

• The April 2025 killing of Lieutenant General Yaroslav Moskalik, which Russian authorities also blamed on Ukraine.

• Earlier cases affecting pro-war figures and defectors, where Russian courts convicted perpetrators while Kyiv either denied involvement or did not confirm it. 

Two things are striking about this campaign as reported.

First, the targets are often chosen for what they symbolise. Senior officers and prominent propagandists are meant to be “safe” behind the front. Their vulnerability sends a message to the entire security and military establishment.

Secondly, these incidents create a rolling internal security crisis for Russia. Every protection detail, every travel pattern, every residential compound becomes an object of suspicion, and suspicion is corrosive. It wastes manpower on defensive measures, fuels elite paranoia and encourages internal blame-shifting.

Sabotage as the companion strategy

Assassinations get headlines because they are dramatic, but sabotage may matter more over time because it is scalable. Attacks on rail nodes, locomotives, power substations and logistics infrastructure impose costs that accumulate: delays, rerouting, repairs, higher guard requirements, insurance complications and lower confidence in the state’s capacity to control its own territory.

Conflict monitors have described an expansion in arson and derailment attempts affecting Russian freight and transport systems in late 2025, framing it as part of a wider shadow war that is increasingly fought behind the lines rather than only at them. 

Ukraine-linked partisan branding is also part of the psychological design: the act is meant to be seen, claimed or at least whispered about, because fear and uncertainty are themselves operational effects.

Who is likely running it

Ukraine has multiple security actors with overlapping remits, notably the Security Service of Ukraine (SBU) and military intelligence (HUR). Public reporting and occasional Ukrainian statements have associated different operations with one or the other, and sometimes with affiliated partisan movements. Russia, for her part, tends to attribute most such incidents to Ukrainian special services, sometimes without providing evidence that satisfies outside observers. 

Strategically, the incentives for Ukraine are clear:

• Deterrence and disruption: forcing Russia to divert resources to internal security and away from the front.

• Retribution and signalling: demonstrating that architects of the invasion are not beyond reach.

• Negotiating leverage: showing that time does not simply benefit the larger state, and that escalation can occur in Moscow as well as in Donbas.

Yet there is an equal and opposite risk: such operations can harden Russian public attitudes, invite retaliation and complicate diplomacy, particularly when peace talks are active or fragile. Reporting on Sarvarov’s killing noted the coincidence with ongoing diplomatic activity and the likelihood that hardliners will use it to argue against compromise. 

The Russian response: tighten the net, widen the suspicion

After each major incident, Russia typically responds along three tracks.

• Technical security: more cameras, more checks, more route discipline, more protective details.

• Counter-intelligence pressure: expanded surveillance, informant recruitment, raids and arrests.

• Information management: framing attacks as “terrorism” to justify harsher domestic measures and to rally support for retaliation.

The difficulty for Russia is that the very measures that might reduce risk in Moscow can amplify insecurity elsewhere. In a vast country security is uneven, and unevenness is exploitable.

What this means for the future

The emergence of a sustained covert contest inside Russia does not mean Russia is losing the war, but it does mean she is fighting it on terms she did not choose. The Russian state is built to project power outwards whilst asserting control inwards. Covert action flips that: it makes the state perform control as a visible, costly routine, day after day.

For Ukraine the calculus is harsh but comprehensible. When conventional superiority is out of reach, asymmetry becomes strategy. A handful of competent cells, or even a shifting mosaic of loosely linked actors can generate effects out of all proportion to their size, particularly when they create the impression of omnipresence.

For outside observers and policymakers, the key is to avoid simplistic narratives. Some incidents will be genuine Ukrainian state operations. Some will be opportunistic violence, criminality or intra-Russian score-settling mislabelled as Ukrainian work. Some will remain ambiguous by design. That ambiguity is not a side effect. It is part of the method.