Behind the lines: How Ukraine has outgunned Russia in sabotage

On 3 June 2025, an underwater explosion occurred near one of the pillars of the Crimean bridge. It was Ukraine’s third attempt to disable the bridge, which has become a symbol of Russia’s ongoing aggression against Ukraine since 2014. The most striking of the three was the detonation of explosives smuggled in a truck driving across the bridge in October 2022. Russia repaired the damaged sections of the bridge by mid-2023, but shortly afterward, Ukrainian naval drones attacked it again, rendering it only partially operational until October that year. The June explosion shut down the bridge for only a few hours. In contrast, the Russian destruction of the Kakhovka dam on the Dnieper river on 6 June 2023 remains one of the most significant sabotage operations in the Russia-Ukraine war — and possibly in modern history. The explosion led to the flooding of parts of the Kherson region and denied Ukrainian forces, who were preparing for a counter-offensive, access to the shortest route to the Crimean peninsula. 

Most instances of sabotage in Russia and Ukraine do not grab headlines, however. Nor do they produce significant effects on either side’s war effort. Nevertheless, the sabotage campaigns waged by both countries are an important dimension of the shadow war occurring alongside the battle for Ukraine and the escalating air war. 

This report focuses on the evolving actors, tactics, and motivations for acts of sabotage, as well as the geographic spread of the phenomenon. It concludes ACLED’s series of analyses on the shadow war between Russia and Ukraine and Europe at large. ACLED data suggest that, as in the case of assassination attempts recorded on Russian-controlled territory, Ukraine appears to be waging a nimbler shadow war of sabotage by diversifying actors and tactics. Meanwhile, Russia relies on locally recruited proxies to carry out largely symbolic rather than meaningful operations across non-occupied Ukraine, after having adopted what appears to be an originally Ukrainian tactic. 

Domestic sabotage in Russia: From an act of resistance to a proxy war

Identifying the motivations of domestic perpetrators of sabotage can be useful for understanding the scale of internal opposition to the war. Sabotage has become commonplace since Russia’s all-out invasion of Ukraine in late February 2022. After demonstrations against the war were quickly suppressed and criticism of the official narrative was criminalized,¹ it became one of the few remaining avenues for expressing dissent. However, as a government crackdown increased the personal costs of involvement in sabotage, though not completely dissuading these acts, a growing share of events became the handiwork of individual saboteurs and small cells either recruited by pro-Ukrainian actors for monetary reward or duped online. 

Arson attacks at enlistment offices were the most common targets of sabotage in the first year of the invasion (see chart below), though the motivations for these attacks may have been at least partially self-serving. ACLED data show clear spikes in attempts in May when rumors of the mobilization of reservists loomed large² as the Russian army became bogged down in fighting in eastern Ukraine, and then in late September and throughout October after authorities announced a partial mobilization. Now digitalized,³ in the early stages of the war, enlistment offices mostly relied on paper records, rendering them an attractive target not only for anti-war activists but also for draft dodgers. 

Russia’s vast rail network has been a key enabler of the war as it remains the preferred mode of transporting weapons, supplies, and personnel. Over a third of sabotage attempts ACLED records have targeted rail infrastructure. Supratsiu, a Belarusian group, claimed responsibility for early incidents in 2022. Notably, in February and March, at least 16 rail incidents with the apparent goal of impeding the movement of Russian military trains also occurred in Belarus. A Russian group called Ostanovi Vagony, meaning Stop the Cars, was associated with subsequent incidents, mostly involving attempts to derail trains. Russian authorities censored the group’s online presence already in May,⁴ and by the end of the year, amended legislation to treat sabotage under terrorism provisions that carry harsher sentences.⁵ Since 2023, perpetrators have shifted their focus to relay cabinets and switchboards, hundreds of which are scattered in isolated areas along the tracks, thereby increasing the odds of escape.  

Three arsonists who are believed to have sabotaged railways in Russia’s Sverdlovsk region in February 2023 told investigators they were following “instructions of Ukrainian radicals.”⁶ Another man claimed online recruiters made him set fire to a bank in the Moscow region. These were the early instances of a phenomenon that became even more obvious with a wave of about 40 arson attacks on enlistment offices between May and December 2023, likely triggered by legislation seeking to expand the conscript pool.⁷ Phone and online recruiters were involved in about half of the incidents, either by promising financial rewards or swindling perpetrators out of their savings. Teenagers and older people appeared most susceptible to the scheme. 

The largest wave of scam-induced arson attacks occurred in late December 2024, with banking infrastructure being the preferred target during the holiday shopping period. ACLED records over 50 incidents, including 23 attempts to set fire to cash machines and bank branches, and 11 arson attacks on police vehicles. Duped older people carried out most of the acts, while a teenager committed suicide after being blackmailed into committing sabotage for a week.

Despite harsher prosecution⁸ of perpetrators, new anti-war Russian groups openly advertise their sabotage acts. Groups such as Liberator, Oblava, Severskiy Kray, and Skrepach account for only a fraction of attributed events; however, their exploits are indicative of ongoing internal resistance to the invasion of Ukraine.  

Pro-Ukrainian sabotage: From occupied areas to Russia itself

Pro-Ukrainian sabotage patterns in occupied areas of Ukraine and Russia itself reveal the varying levels of control Russia has over areas it claims as its own. Russia’s swift seizure of swathes of Ukraine’s Kherson and Zaporizhia regions in late February and early March 2022 triggered violent resistance in these regions, after invading forces suppressed protests against occupation and abducted, tortured, and executed scores of local opinion leaders. Local militias proliferated in the early stages of occupation, but ensuing repression may have rendered resistance there too costly, leading to a sharp decline in the number of events after Russia annexed four Ukrainian regions. The subsequent spread of pro-Ukrainian sabotage to Russia itself exposed the lack of a complete grip on the vast country, with the Wagner mutiny in June 2023 driving home a similar point.  

Pro-Ukrainian militias were particularly active in the first year of Russia’s invasion. As in the case of assassination attempts on armed personnel and imported or collaborating occupation authorities, they mostly relied on planting or hurling explosives at targets to disrupt Russian military logistics and efforts to administer and police occupied areas. The militias were particularly active in the run-up to hastily arranged referendums on accession of the Luhansk, Donetsk, Zaporizhia, and Kherson regions to Russia in September 2022. In the Donetsk region, Mariupol remained a sabotage hotspot in the months following Russian capture in May 2022, despite near-complete obliteration of the town and exodus of its population. Sabotage attempts dwindled in 2023 and 2024 as Russia consolidated control over the occupied territories (see map below). But they have shown signs of picking up again in 2025, especially in the occupied part of the Zaporizhia region, where the towns of Berdiansk and Melitopol remain the hotbeds of resistance to Russian rule. Pro-Ukrainian militias also switched their focus to military or dual-use infrastructure, possibly as a result of greater collaboration with the Ukrainian military and special services.

One of the main groups driving renewed sabotage activity in the occupied areas is Atesh — a pro-Ukrainian militia originally from Crimea⁹ that has expanded its footprint to other Russia-occupied areas of Ukraine since 2023, first to the Kherson and then to the Donetsk and Zaporizhia regions. It has accounted for over half of the over 30 sabotage incidents in occupied areas so far in 2025, focusing primarily on tampering with rail infrastructure and setting fire to vehicles used by the military or supporters of the invasion. Since 2024, Atesh has brought the sabotage campaign to Russia itself, with 32 events attributed to the group in 2025 (see chart below) across the vast country, from its European part close to Ukraine’s border, deeper inland, and all the way to the Far East. Apart from relay cabinets, it has also targeted energy infrastructure and telecommunications equipment.

Freedom of Russia, a militia of Russian expatriates closely aligned with the Ukrainian special services¹⁰ that raided Russia’s border regions in 2023 alongside the Russian Volunteer Corps, appears to have switched focus to sabotage on Russian territory. Like Atesh, it is mostly involved in blowing up or setting fire to rail and telecommunications equipment, such as cell towers. The two groups likely take advantage of their ability to slip through the border undetected by virtue of their Russian citizenship, which was imposed on residents of Crimea in 2014. 

Ukrainian special services, in particular the Main Directorate of Intelligence, the Security Service, and Special Forces, undertake the most daring acts of sabotage on Russian territory. Unlike opportunistic arson attacks typical of pro-Ukrainian or local anti-war groups and recruited proxies, professional saboteurs specialize in disabling military assets such as stationary aircraft, derailing and blowing up cargo trains, and blowing up pipelines carrying Russian oil and gas. In addition, since late 2024, at least six suspected mine explosions have occurred on oil tankers that called at Russian ports.¹¹ Ukrainian special services have also recently been targeting military units in remote parts of Russia, with the dual goal of punishing personnel for war crimes in Ukraine and chipping away at Russia’s superiority in terms of its number of troops. 

But the escalation of the professional sabotage campaign comes at a price for civilians, too. For instance, a train derailment in the Bryansk region that went awry on the eve of the Spiderweb operation killed seven and injured 127 civilian passengers. This incident shows the limits of sabotaging infrastructure by both military forces and non-combatants, even when carefully planned and executed. The extensive use of local proxies by both Russia and Ukraine lowers the bar for duty of care and puts both perpetrators and those who happen to be around them at risk. 

Russia adopts Ukrainian tactics for sabotage in Ukraine

The issue of pro-Russian sabotage in non-occupied Ukraine is an example of the cross-pollination of tactics seen in other dimensions of the war, such as the drone race in which Ukraine often pioneers technology that Russia replicates, improves, and scales.¹² Similarly, Russian special services appear to have adopted the originally Ukrainian method of recruiting local proxies to conduct sabotage. The problem of the dangerous offshoot of the “gig-economy” model¹³ is becoming more pressing not only in Russia and Ukraine but also in Europe at large, where suspected Russian activity is outsourced to locally hired proxies.  

ACLED data show a proliferation of sabotage attempts mounted by proxies in Ukraine since mid-2024. Local recruits of Russian special services committed about two-thirds of the around 400 incidents over the course of the war. The prospect of monetary reward rather than ideological conviction is the primary motivation for perpetrators, who are often young, unemployed, and addicted to illicit drugs.¹⁴ In several instances, these are also people who have been internally displaced. Teenagers appear particularly susceptible to recruitment, possibly as a side effect of their greater presence online.¹⁵ They may also not fully grasp the risks associated with being disposable agents, exemplified by the case of two teenagers who were blown up by their Russian handlers in the Ivano-Frankivsk region when they approached a train station in March 2025.

Rail infrastructure is one of Russia’s common targets, and, similarly to Ukrainian operations in Russia, they prefer to recruit non-professionals to carry out these operations of sabotage. Most often, they opt for arson attacks of easily identifiable targets associated with the military, such as military vehicles and civilian cars used by uniformed personnel, and, to a lesser extent, their residences. This, along with the concentration of events in larger cities such as Kyiv, Odesa, Kharkiv, and Dnipro (see map below), is indicative of a preference for accessible targets, which increases the odds of unhindered escape. Conscription offices are another preferred target, as they also provide a veneer of deniability for Russia, as tensions over mobilization policies and practices are simmering even without Russia’s meddling. Over the past two years, ACLED records a growing number of brawls and clashes between conscription officers and individuals they are trying to mobilize or their supporters. 

While most sabotage incidents in non-occupied parts of Ukraine could be catalogued as aggravated cases of vandalism meant to intimidate the men and women in the army, the use of explosives to blow up uniformed non-combatants, such as police, is a more dangerous trend. ACLED records about 10 attempts to blow up police stations, as well as at least three incidents in which police faced planted explosives when responding to hoax emergency calls. The practice echoes Russia’s systematic targeting of rescuers and medics arriving at the sites of Russian strikes with follow-up drone and missile attacks. Worryingly, in some instances, detained Russian recruits claim to have intended to set off explosives in public spaces such as shops, cafes, parks, metro stations, and even playgrounds.¹⁶

Russia’s apparent reliance on local proxies and lack of meaningful targets may have several explanations. One is the state of the information environment in Ukraine, where the media — otherwise varied and vibrant in both peacetime and under martial law, which has been in place since 2022 — could be refraining from reporting more consequential acts of sabotage. This is likely the case for Russian strikes on military infrastructure across Ukraine. The majority of sabotage reports ACLED records from open Ukrainian sources are, in fact, regurgitated releases of the Ukrainian police and security services. 

Another explanation could be a lack of will or means to infiltrate Russian operatives under the conditions of martial law in Ukraine — a pattern also noted in the case of assassination attempts. Most plausibly, however, Russia’s enduring dominance in the long-range aerial war makes the need for staging sabotage redundant. Russian forces face few restraints in bombing practically any part of the Ukrainian hinterland, regardless of the impact on civilians, as mounting non-combatant casualties and Russia’s ongoing attempt to knock down Ukraine’s power grid amid the cold season attest. Similarly, in 2025, ACLED records at least six drone strikes targeting enlistment offices in central and eastern Ukraine, while the number of strikes on rail infrastructure has tripled to over 100 compared to the previous year.  

A complementary war 

Sabotage alone cannot seriously hinder either side’s war effort. Routine attacks on each other’s vast rail networks have caused only temporary effects as both countries can swiftly repair the mostly minor damage and reroute traffic. Russia’s recent increase in drone and missile targeting of Ukrainian rail hubs and key junctions, leading to longer repairs,¹⁷ points to the validity of the assumption. Ukraine’s repeated attempts to destroy the Crimean bridge by planting explosives and conducting naval drone attacks have not been successful. The impact of eventually taking it out of operation may prove more symbolic than tangible. In the years of its occupation of southern Ukraine, Russia built an alternative rail route hugging the coast from Mariupol to Berdiansk to put it at a safer distance from the line of contact.  

Furthermore, the shadow war that Russia and Ukraine are fighting behind the lines is dwarfed by the scale of battlefield and aerial violence. Russia relies on its sheer firepower to pound Ukraine with long-range attacks and a seemingly endless flow of soldiers to press chronically understaffed Ukrainian troops. This allows it to focus less on sabotage. The asymmetry of both sides’ capabilities is also characteristic in the ongoing shadow war, with Ukraine responding where it can, even if the increasingly daring assassinations and sabotage attempts do not change much the status quo. 

But, even if clear military rationale or gains are lacking, the publicity effects of acting deep behind enemy lines and inflicting symbolic damage should not be underestimated. Destabilizing effects in Russia have brought the war closer to ordinary people, even in far-flung places, and have boosted morale at home. The recent targeting of Russian strategic bombers by smuggling attack drones deep inside Russia and the transport disruption at the height of summer travel due to drones loitering near airports and train stations are examples of such publicity stunts that do not necessarily carry military advantage but respond to Russia’s relentless blitz of Ukrainian cities. There is also a certain convergence of purely military and sabotage Ukrainian tactics. For instance, since August, Ukrainian drones have attacked bridges in Russia’s border areas by detonating explosives that Russian forces had planted earlier. The level of infiltration of Ukrainian operatives in Russia is also indicative of Russian authorities’ lack of control over their own territory, which is embarrassing for a regime couching an attempt to conquer Ukraine as seeking to improve the security of Russians.   

Of greater concern is probably the availability of non-professional recruits to stage sabotage. Anyone with access to an encrypted messenger is a potential recruit. The scale of online recruitment likely jolted Russian authorities into action. ACLED records several arrests of associates of Ukrainian online recruiters who operated within Russia. Furthermore, a rare daytime drone strike on Dnipro city in September 2025 may have targeted the offices of recruiters.¹⁸ 

On a policy level, Russian authorities are poised to block popular online messengers, though the primary motivation could be to impose a state-run alternative to control the population. Ukrainian authorities may find it more difficult to restrict access to online tools to prevent recruitment without triggering a backlash, the potential for which is exemplified by a wave of demonstrations that forced the reversal of an attempt to curb the remit of anti-corruption bodies in July 2025. 

Together with drone incursions, multiplying cases of Russian recruits across Europe — including Ukrainians displaced by Russia’s war — are posing challenges for a continent that was preparing to fend off missiles in case of a highly improbable attack, rather than deal with misguided individuals and hordes of cheap drones.    

Despite its effects being minuscule in contrast to conventional war, sabotage should not be dismissed as a mere sideshow. Lagging behind Ukraine in the versatility of tactics and actors involved, Russia is still well capable of pulling off significant sabotage operations, such as the blowup of the Kakhovka dam. There were suspicions of Russian sabotage that led to the recent month-long blackout at the Zaporizhia Nuclear Power Plant¹⁹ located in the midst of fighting, with Russia allegedly severing power lines connecting the plant to the Ukrainian power grid in order to reconnect it to its own. The threat of triggering a nuclear incident to press for better settlement terms could be looming large as Russia routinely employs nuclear saber-rattling to have its way. 

Regardless of whether such a major event occurs, the sabotage campaigns are set to continue for the duration of the war. As in the case of assassination attempts, they may outlast it, too. The tactic may pivot away from the standoff between Russia and Ukraine as ever harsher repression in Russia could spur to action domestic malcontents, including ethnic and religious minorities rooting for more rights or even secession, as well as demobilized troops struggling to adjust to civilian life. The level of expertise in handling explosives and drones that the latter have acquired in Ukraine may prove a combustible mix for years to come.