REPORT: Shadow Guides — How the SBU Dismantles Russia's Strike Spotter Network

Introduction: The War Behind the Lines, on Ukrainian Soil

Eight arrests in one week

There is a parallel war to the one that ISW maps and daily casualty reports document. It unfolds not at Kostiantynivka or along the Donetsk contact line — but in Ukrainian cities, in ordinary apartments, at gas stations from which a phone can guide a missile hundreds of kilometers away. In a single week of June 2026, the SBU (Security Service of Ukraine) arrested 8 people accused of espionage, guiding Russian strikes, and complicity with the Russian FSB from inside Ukrainian territory.

These eight arrests, documented by Euromaidan Press on June 23, 2026, reveal several different profiles: a mobilized soldier who abandoned his unit to work with the FSB in Zaporizhzhia, a woman from Kherson who installed hidden cameras to guide strikes, another from Chornomorsk. And alongside that picture, the SBU and National Police foiled an FSB plot against a Kyiv administrative building. This is not a crime blotter item — it is the shadow war in its daily reality.

What the spy network reveals about Russian strategy

Russia's strike targeting strategy does not rely solely on satellites and reconnaissance drones. It also relies on a network of human agents inside Ukraine — "spotters" who relay real-time information about Ukrainian positions, troop movements, locations of military equipment, and windows of vulnerability. These human agents are valuable to Russia because they can provide information at a level of precision and timeliness that satellites or drones cannot always guarantee.

Their recruitment takes several forms: pressure on relatives remaining in occupied territory, cash payments, pro-Russian ideology, or simply opportunism. The SBU must identify, surveil, and neutralize these agents while managing other operational priorities. This is counterintelligence work in a context of total war — under constant time pressure and with permanently insufficient resources.

The Zaporizhzhia Case: The Soldier Who Betrayed His Unit

A mobilized military man working for the FSB

Among the eight arrests of the week, the case of the Zaporizhzhia spotter is particularly revealing. He is a mobilized Ukrainian soldier who left his unit to work with the Russian FSB. This profile — a soldier who deserts to become a spy — illustrates one of the systemic vulnerabilities of Ukrainian defense: the extraordinary pressure placed on mobilized men can, in marginal cases, produce failures that extend all the way to betrayal.

This case is not representative of the mass of Ukrainian soldiers — the loyalty and courage of the Ukrainian army are documented and beyond dispute. But it reveals that the FSB actively seeks to recruit among Ukrainian military personnel in difficulty, offering illusory pay and protection. The SBU must therefore surveil not only the civilian population but also serving soldiers, in a context where pressure on individuals is extreme.

Zaporizhzhia as a particularly exposed espionage terrain

Zaporizhzhia is a city particularly exposed to Russian espionage. It lies near the front line, it houses Ukrainian military equipment in transit or stationary deployment, and it is the region encompassing the Zaporizhzhia Nuclear Power Plant — an installation that remains under constant Russian pressure. An effective spotter in Zaporizhzhia can guide strikes onto targets with high military added value.

The strike of June 20 — 10 glide bombs launched on Zaporizhzhia, 5 civilians killed, 12 wounded — illustrates what precise guidance can produce. Whether this strike benefited from on-the-ground human intelligence is unknown — available sources do not indicate it. But the precision of certain Russian strikes in this area suggests high-quality intelligence that can sometimes include human sources.

The Kherson Case: "Video Traps" That Guide Strikes

A woman, hidden cameras, and a strike on Kyiv

The case of the Kherson woman arrested on June 17 is particularly alarming for its technical sophistication. According to information published by Euromaidan Press, she installed "video traps" — a term likely referring to disguised surveillance cameras, perhaps hidden in ordinary objects — which guided a Russian strike on the Kyiv reservoir on May 24, 2026.

This modus operandi reveals a troubling level of sophistication in Russian espionage methods in Ukraine. These are no longer just agents relaying phone observations — these are networks of concealed video sensors providing a continuous remote information feed. This technical evolution in espionage methods is a response to Ukrainian countermeasures that made telephone communications more risky.

The Kyiv reservoir as a symbolic and practical target

The strike on the Kyiv reservoir on May 24, 2026 was not a targeting accident. Water infrastructure — reservoirs, pumping stations, main pipelines — are high-value civilian destabilization targets. Damaging Kyiv's water supply means creating a humanitarian crisis for several million residents, distracting Ukrainian authorities from military priorities, and striking at the population's morale.

The discovery that this strike was guided by an agent installing cameras from Kherson — a city officially liberated from Russian occupation — illustrates the persistence of FSB networks in Ukrainian-controlled zones. The physical liberation of a territory does not automatically equal the neutralization of its spy networks. This cleanup work is slow, difficult, and never makes front pages.

The Chornomorsk Case: Another Woman, Another Method

The profile of FSB-recruited agents

The arrest of a woman in Chornomorsk — an Odessa port city — adds to a picture that reveals the diversity of profiles recruited by the FSB. Russian agents in Ukraine are not all intelligence professionals trained in Moscow — they are often ordinary civilians recruited for specific missions, sometimes under duress, sometimes for money, sometimes out of ideology.

This diversity of profiles considerably complicates the work of the SBU. Identifying a professional FSB agent is difficult but achievable — their movements, communications, and contacts have recognizable patterns. Identifying an ordinary civilian converted into an occasional spotter is far more difficult. These low-level agents are not in existing databases. They have no prior suspicious behavior. They can pass through the net for a long time.

Chornomorsk and the vulnerability of ports

Chornomorsk is an important port for Ukraine — historically used for agricultural exports and, since the resumption of the grain corridor, for grain shipments to world markets. A spy active in this city can guide strikes on port infrastructure, vessels at anchor, grain convoys, or military equipment in transit.

Ukraine's economic resilience depends partly on its agricultural exports to generate foreign currency. Striking port infrastructure is therefore a Russian objective combining economic impact with military logistics impact. The SBU in Chornomorsk is not simply protecting a city — it is protecting part of Ukraine's economic capacity to finance its own war.

The Foiled Attack on a Kyiv Administrative Building

A joint SBU-National Police operation

Among the week's operations, the SBU and National Police jointly foiled an FSB plot targeting a Kyiv administrative building. The details of the operation — the precise nature of the targeted building, the planned mode of attack, the sophistication of the attempt — are not fully available in open sources. What is confirmed by Euromaidan Press: the attack was foiled before it could be carried out.

This preventive operation illustrates the most critical dimension of Ukrainian counterintelligence: identifying and neutralizing threats before they materialize. This is infinitely harder than reacting after the fact — but infinitely more effective for saving lives. The ability to identify a plot before its execution demands high-quality human and technical intelligence, as well as inter-agency coordination that was not guaranteed at the start of the war.

Inter-agency coordination as institutional progress

In 2022, one of Ukraine's identified weaknesses was the lack of coordination between the SBU (counterintelligence, internal security), the GUR (military intelligence), the National Police, and other security agencies. Each entity worked with its own sources and methods, and sometimes shared information insufficiently.

The joint operations documented in 2026 — such as the foiling of this Kyiv attack — suggest a significant improvement in this coordination. This is one of Ukraine's least visible but most important institutional advances during the war: the construction of a more integrated, more effective internal security architecture capable of confronting a multifaceted and sophisticated threat. This institutional progress is the silent foundation of Ukrainian resistance.

The Former Chostka Municipal Councilor: 15 Years for Guiding Strikes

An institutional profile, a maximum betrayal

The case of the former Chostka municipal councilor — sentenced to 15 years in prison for guiding strikes in the Sumy region — illustrates a particularly disturbing dimension of the collaboration phenomenon: individuals who held public office and turned against the community they were supposed to serve. A municipal councilor knows local infrastructure, roads, public buildings, and the habits of local security services. This information is of considerable value to a strike guide.

The 15-year sentence sends a clear judicial signal: collaboration with the enemy is treated with maximum severity by Ukrainian courts. This message serves both a deterrent and a punitive function. In the context of an existential war, the severity of criminal penalties is an element of national security doctrine.

The Sumy region: a difficult counterintelligence terrain

The Sumy region is a border region with Russia, exposed to incursions and constant pressure. It is in this same region that a Russian drone killed a 13-year-old boy, his father, and his grandmother on June 22. The precision of certain strikes in this region can sometimes indicate on-the-ground human intelligence — though this is not proven for the specific strikes mentioned in this report.

The SBU operates in a particularly difficult security environment in border regions: a mixed population with varying degrees of pro-Russian orientation inherited from the Soviet past, physical proximity to Russia facilitating border crossings, and a tradition of cross-border family and economic contacts that the FSB can exploit. Counterintelligence in these regions is precision work in a hostile and ambiguous environment.

The SBU and the FBI: International Cooperation Against Cyber Threats

Beyond strike guiding: cyber espionage

Russia's spy network in Ukraine is not limited to human spotters. Alongside the physical arrests, UNN reported on June 25 that the SBU and FBI jointly exposed Russian special services hacking operations targeting the messaging apps of officials in Ukraine, the EU, and the United States. This international cooperation reveals the systemic scope of Russia's information war.

Targeting officials' messaging apps — probably applications like Signal, WhatsApp, or government messaging systems — aims to obtain strategic information in real time: upcoming decisions on arms deliveries, leaders' positions on negotiations, sensitive information on military operations. This high-level intelligence is more strategically valuable than tactical strike guidance.

SBU-FBI cooperation as a partnership standard

Cooperation between the Ukrainian SBU and the American FBI on a cybersecurity operation is a sign of Ukraine's growing integration into Western security structures. This is not a client-provider relationship — it is a genuine operational partnership in which both agencies contribute intelligence and share findings.

This cooperation has implications beyond the specific operation. It builds habits of common work, information-exchange protocols, and mutual trust between intelligence professionals. These institutional foundations are more lasting than any military equipment provided. They constitute the substrate of a durable security alliance between Ukraine and the West.

The Profile of FSB Agents in Ukraine: An Anatomy

Who are the agents the SBU arrests

The profiles of the agents arrested this week reveal the FSB's recruitment strategy: diversity of social backgrounds (soldier, civilian, local elected official), geographic diversity (Zaporizhzhia, Kherson, Chornomorsk, Sumy, Kyiv), and diversity of methods (direct observation, hidden cameras, physical attack, phone guidance). This diversity is not random — it reflects a deliberate FSB strategy to make its networks more resilient and harder to dismantle.

Redundancy is an essential feature of spy networks: if one agent is arrested, the others continue. If one type of method is detected, others can take over. The FSB has learned from its intelligence failures at the start of the invasion and has systematically improved its methods since 2022. The SBU faces an adversary that adapts — and that has considerable resources to recruit, train, and deploy agents.

The vulnerabilities the FSB exploits

The FSB exploits several structural vulnerabilities in Ukrainian society at war. The first is economic: in a country under economic pressure, some individuals are susceptible to financial offers. The second is psychological: soldiers and civilians subjected to extreme pressure can present exploitable vulnerabilities. The third is ideological: a minority of Ukrainian citizens maintain pro-Russian sympathies inherited from the Soviet era or sustained by Russian propaganda.

The SBU must monitor all these vulnerabilities simultaneously, with limited human and technical resources, in a wartime context that generates thousands of new risk situations every day. This Sisyphean work is performed by SBU agents relentlessly, in the shadows, without the recognition that their visible operations will sometimes receive.

Counterintelligence as an Invisible Front

The SBU as a learning organization

The SBU in 2026 is a profoundly different organization from the one in 2022. The Russian invasion acted as a brutal catalyst for institutional transformation. Compromised officers were identified and removed. New vetting procedures were put in place. Cooperation with Western allied services — CIA, MI6, BND — was deepened and institutionalized. The technical training level of counterintelligence agents has increased.

It is not a perfect organization — none are, especially under the pressure of war. Agents are still compromised. Missions fail. Targets evade surveillance. But the overall trajectory is positive: an organization building competence, adapting to new threats, and developing lasting capabilities. That is exactly what national defense requires.

The growing effectiveness of counterintelligence

The fact that 8 agents were arrested in a single week — including a foiled attack and a 15-year sentence in a parallel case — suggests a growing effectiveness of Ukrainian counterintelligence. This is not luck — it is the fruit of systematic surveillance, patient intelligence work, and cooperation with international partners.

Each arrested agent represents not only a neutralized threat but also a source of information about the FSB network. Interrogations, data extracted from phones and computers, reconstruction of contact networks — all of this feeds the SBU's knowledge of the FSB's methods, structures, and targets. Counterintelligence is a permanent learning cycle: every arrest teaches how to make the next one.

The Legal Implications and Fundamental Rights

The legal framework for arrests

The SBU's arrests take place within a Ukrainian legal framework that has been adapted to wartime conditions while maintaining — with certain tensions — the fundamental principles of the rule of law. Those arrested are brought before courts, tried according to procedures in force, and sentenced on the basis of evidence. The 15-year sentence of the former Chostka municipal councilor illustrates that the judicial system functions, even in wartime.

This legal dimension matters for several reasons. It preserves Ukraine's international legitimacy — a state that upholds the rule of law even under the pressure of an existential war is a state that deserves the support of the international community. It also creates a precedent for the post-war period: collaborators will be prosecuted, but according to legal procedures, not through arbitrary reprisals.

The risks of security drift

War creates risks of security drift. Emergency measures, the pressure to address threats quickly, the emotional context of war — all of this can create conditions in which individual rights are sacrificed to collective security. These risks exist in Ukraine as in any country at war. The SBU is not exempt from legitimate criticism on some of its practices.

Signaling these risks does not disqualify the SBU's work — it is a reminder that the defense of Ukrainian democracy must also include the defense of democratic values inside Ukrainian democracy itself. This is the fundamental tension of any defensive war waged by a free state: being strong enough to defend oneself without ceasing to be what one is defending.

The Effects on the Ukrainian Population

Mistrust as a rational response

The existence of active Russian spy networks in Ukrainian cities inevitably creates a climate of mistrust in the population. Neighbors observe unusual behavior. Employers monitor communications. Communities seek to identify "suspicious elements." This generalized mistrust has ambivalent effects: it strengthens collective vigilance, but it can also fuel abusive denunciations and social tensions.

The SBU tries to channel this popular vigilance through reporting hotlines and formalized procedures, to prevent informal denunciation behaviors from degenerating into witch hunts. This is a difficult balance to maintain — but necessary to preserve the social fabric of a society under pressure.

Confidence in security institutions

The documented arrests of the week contribute to reinforcing the population's confidence in the SBU's ability to detect and neutralize internal threats. Each publicly announced arrest is a message to the population: we are vigilant, we are working, we are protecting you. And to potential FSB agents: you will be found, arrested, sentenced.

This public communication is a conscious component of Ukrainian counterintelligence strategy. It aims to deter potential recruitments, reassure the population, and demonstrate the effectiveness of security institutions. In a war as widely covered by media, perception management is a real component of the security strategy.

The Information War as an Extension of Counterintelligence

Russian disinformation and the Ukrainian response

Ukrainian counterintelligence is not limited to physical arrests. It also includes a counter-disinformation dimension: identifying and exposing Russian information manipulation campaigns targeting the Ukrainian population, Western allies, and international opinion. This dimension is managed partly by the SBU, but also by the Center for Countering Disinformation under the National Security Council.

Russia invests massively in information operations: fake profiles on social networks, disinformation sites disguised as local media, algorithm manipulation, and campaigns of doubt about arms deliveries. These operations aim to weaken Western support for Ukraine, demoralize the Ukrainian population, and normalize the Russian narrative about "NATO aggression."

The tools of counter-narrative

Ukraine has developed remarkable counter-narrative capabilities since 2022. Zelensky's direct communication via social networks has established a communication channel that is hard to destabilize. The Ukrainian independent press — Kyiv Independent, Ukrainska Pravda, Euromaidan Press — maintains quality journalism that provides a credible alternative to Russian narratives. And Western partners, through their support for independent Ukrainian media, help maintain this free information space.

In the cognitive war as much as the physical one, Ukraine is winning important battles. The international credibility of its institutions, its media, and its official communication is far superior to that of the Russian regime — whose repeated and documented lies have definitively destroyed its credibility with democracies.

The Protection of Critical Infrastructure: A Permanent Challenge

Power plants and dams under surveillance

Beyond the counterintelligence work directly linked to military strikes, the SBU must also protect Ukrainian critical infrastructure — power plants, dams, water distribution networks, telecommunications hubs — against sabotage operations that could cause large-scale civilian catastrophes. The destruction of the Kakhovka Dam in June 2023 demonstrated the catastrophic humanitarian impact of such an operation.

Protecting this infrastructure requires reinforced physical security, electronic perimeter surveillance, and rigorous access control for all personnel — including maintenance workers and subcontractors. This is work that mobilizes considerable human resources, often at the expense of other priorities. The SBU navigates these resource trade-offs permanently.

Communication networks as FSB targets

Ukrainian military and governmental communication networks are permanent targets of the Russian FSB and GRU. The joint SBU-FBI operation exposing the hacking of officials' messaging apps reveals an additional dimension of this shadow war: the permanent attempt to infiltrate secure communications to obtain strategic real-time information on Ukrainian military and diplomatic decisions.

Securing communications is a permanent project requiring constant technological investment, regular personnel training, and a cybersecurity culture across all government services. Ukraine has progressed rapidly in this area since 2022 — partly thanks to technical support from Western partners. But the adversary also adapts. Communications security is a permanent race between attackers and defenders.

The Human Cost of Counterintelligence: Between Security Necessity and Fundamental Rights

Mass arrests: risks of drift and procedural guarantees

Counterintelligence in wartime walks a razor's edge. On one side, the absolute necessity to identify and neutralize FSB agents who guide Russian strikes against Ukrainian civilians. On the other, the risk that emergency procedures become tools of arbitrary repression, targeting people on the basis of insufficient suspicion or opportunistic denunciations. Ukraine is aware of this risk — its Western partners regularly sensitize it to the issue.

The 8 documented arrests in this report all correspond to cases where the SBU presented tangible evidence: intercepted communications, reconnaissance footage, transmitted GPS coordinates, FSB identity confirmations. This is not a randomly cast net — it is targeted intelligence work that respects the minimum standards of the rule of law in armed conflict.

The protection of witnesses and double agents

Behind every spotter arrest, there is often a broader network of informants, witnesses, and sometimes Ukrainian agents who have infiltrated FSB networks to dismantle them from within. These people take considerable risks. The SBU must balance the transparency imperative — vital for maintaining the population's trust — with the necessity to protect its sources and operational methods.

The documented cooperation between the SBU and FBI in some of these cases reflects the growing sophistication of Ukrainian counterintelligence. Western agencies bring digital analysis capabilities, communication traceability, and identification of FSB recruitment patterns that significantly reinforce the effectiveness of Ukrainian operations. This is as much a war of intelligence as a war on the ground.

Conclusion: Vigilance as a Way of Life

Counterintelligence as a permanent imperative

The 8 arrests in the week of June 23, 2026 are a slice of work that never stops. Ukrainian counterintelligence operates 24 hours a day, 7 days a week, under extreme pressure, against an adversary with considerable resources and a long tradition of clandestine operations. The SBU does not win the war alone — but it creates the conditions in which defenders at the front can fight without constantly having to worry about the enemy behind their backs.

Internal security is the silent foundation of Ukrainian resistance. Every neutralized agent, every dismantled network, every foiled attack — this is a victory that does not make headlines but counts as much as military successes at the front. The war is also won in apartments in Kherson and SBU offices.

What Ukrainian resistance says about this people

The men and women of the SBU who hunt spotters in Ukrainian cities are part of a total national effort mobilizing every segment of society. From soldiers holding Kostiantynivka to engineers developing drones, from doctors treating the wounded to counterintelligence agents neutralizing FSB networks — this is an entire nation defending itself with everything it has. This spectacle of collective mobilization deserves not only our admiration — it deserves our unreserved and immediate support.

Vigilance has become the Ukrainian way of life. Not by choice — by necessity. But in that necessity, Ukraine has found something: a sharp consciousness of what it is, what it is defending, and why it is worth it. That consciousness may be the deepest victory that Putin never saw coming.

Signed Maxime Marquette, columnist

Columnist's transparency box

Editorial positioning

This report presents the Ukrainian counterintelligence work under a favorable angle, consistent with Maxime Marquette's support for Ukrainian resistance. The mention of security drift risks is included to maintain a balanced and honest perspective. No confidential sources were used — everything rests on information published by independent media.

Method and sources

The facts presented — 8 arrests, the Zaporizhzhia soldier, the Kherson woman and her cameras, the strike on the Kyiv reservoir on May 24, the 15 years for the former municipal councilor — come from Euromaidan Press of June 23, 2026 and UNN of June 25, 2026. No unpublished operational details have been included or invented.

Limits of the analysis

The precise methods used by FSB agents and the counterintelligence techniques of the SBU are not available in open sources. The author makes no claim to knowledge of classified operations. The reconstruction of agent profiles is based on information published by Euromaidan Press, without extrapolation beyond that data.

Sources

Primary sources

Euromaidan Press: Ukraine arrests eight people accused of cheering on Russian strikes from inside the country and spying — June 23, 2026

SSU Main page — Security Service of Ukraine — June 23, 2026

UNN: SBU and FBI expose Russian special services hacking messengers of officials in Ukraine, EU and US — June 25, 2026

Secondary sources

ISW: Russian Offensive Campaign Assessment, June 23, 2026 — June 24, 2026

Kyiv Independent: Russian attacks kill 11, injure 91 in Ukraine over past day — June 21, 2026

Ukrainska Pravda: Front updates — June 23, 2026