Zhytomyr
A 17-year-old woman in Zhytomyr allegedly received a parcel containing a crystalline substance that investigators presumed was methadone. Police say she had been communicating via Telegram with a man who was likely a Russian security services agent. The case emerged after the poisoning of a serviceman. It was not an isolated incident. It was another point on a growing map of recruitment that reaches into Ukraine through the phones of its own citizens.
According to Vyhivskyi, Russian recruiters found young women via messaging platforms, promising easy money and directing them remotely. Some were instructed to search for Ukrainian military personnel on dating websites. They received money to rent apartments where meetings could take place. Others were told where to obtain methadone for lacing drinks. The method is notable for its simplicity. Recruiters do not need committed ideologues. They need people willing to perform discrete tasks for cash.
That distinction appears repeatedly in the evidence. One workshop participant reported that Ukrainian nationals are often offered about 10% of the amounts paid to recruits in Western Europe. In several cases, saboteurs were not paid at all. Low-level operatives are cheap. They are also expendable. The economics matter because they suggest a recruitment model built less on loyalty than availability.
Cheap operatives make scale possible when loyalty is no longer required
The pattern was visible beside railway tracks in Chernihiv in September 2024. A group of teenagers gathered near a village after Russia had struck a hospital. Prosecutors say 15-year-old Vitalii pried open cabinets containing Ukrainian railroad communication and signaling equipment. The boys poured flammable liquid over the cabinets and set them on fire, then filmed the flames before sending the footage onward. The alleged organizer, known as “Sania,” had offered hundreds of dollars online to perform specific tasks. Prosecutors say those tasks amounted to sabotage against the Ukrainian state.
The scale is larger than any individual case. Ukraine’s Security Service says more than 1,100 Ukrainians have been accused of committing arson, terrorism or sabotage in betrayal of their country during the war. That number shifts the question from isolated criminality to system design. How are so many recruits found, managed and directed without exposing the people running them?
Research cited by workshop participants points to the answer. Social network analysis shows that Russia’s low-level agent networks are highly hierarchical and compartmentalised, with GU and FSB officers directing operations. Strategic control is concentrated within command echelons and operations managers, while individual sub-networks have few visible connections to one another. A teenager setting fire to railway equipment and a young woman allegedly handling methadone may never know who sits above them. The structure ensures they do not need to.
Compartmentalised networks separate recruits from the people directing them
The recruitment channel has become a political issue in its own right. Ukrainian officials have called for tighter regulation of Telegram. Interior Minister Ihor Klymenko said Russian intelligence is increasingly using the app to recruit individuals for sabotage attacks inside Ukraine. Ivan Rudnytskyi, deputy head of the Security Service of Ukraine, said law enforcement agencies and state institutions should strengthen regulation to prevent online platforms from being used for criminal and terrorist activity. Their intervention followed an attack in Lviv that killed a 23-year-old police officer and injured 25 others. President Volodymyr Zelenskyy said Russia organized the attack and that the perpetrators had been recruited through Telegram.
Telegram rejects the accusation that it serves as a willing conduit. Devon Spurgeon, a Telegram spokesperson, said attempts to recruit people for sabotage on Telegram were routinely detected and removed. The company states that “Telegram is a platform for peaceful communication and privacy, not war.” Yet the dispute has moved beyond content moderation. Ukrainian intelligence services have concluded that Telegram poses a national security threat and say it is being used by Russia for activities ranging from disinformation to cyber operations. They further state that Russian intelligence agencies are capable of recovering deleted messages in Telegram, directly challenging the platform’s security claims.
The uncomfortable fact is that the system described by Ukrainian officials does not depend on large payments, ideological commitment or even successful compensation. Workshop participants noted that ideological motives sometimes reinforce financial incentives, but also warned that many low-level agents may simply not care whether they are paid by regular criminals or hostile states. That makes recruitment less a question of persuasion than of supply.
The argument over Telegram reflects a wider struggle over recruitment infrastructure
The pressure therefore lands not only on the people being recruited but on the infrastructure that connects recruiters to an apparently endless pool of disposable labor. Ukraine is arguing over Telegram because the platform sits at the intersection of two realities that can both be true at once: Telegram says it removes recruitment attempts, while Ukrainian authorities say Russian intelligence increasingly uses it to find recruits. Between those positions stands a war in which more than 1,100 Ukrainians have been accused of sabotage-related crimes, and a recruitment model that appears able to replace one expendable operative with another faster than the state can remove them.
