Ukrainian Security Service dismantled a Russian FSB spy network planning coordinated arson attacks in Ukraine, Poland, and the Baltic states on July 25, 2024.

Terrorism & Criminal Proxy TacticsTerrorismBomb threats, assassination plots, targeted killings

AggressorDefense

Summary

On July 25, 2024, Ukrainian authorities announced the dismantling of a Russian FSB spy network that intended to carry out arson attacks targeting civilian sites in Ukraine, Poland, and the Baltic nations. The group consisted of 19 members residing across Western and central Ukrainian oblasts including Ivano-Frankivsk, Dnipropetrovsk, Poltava, and Zaporizhzhya. They recruited operatives to attack shopping centers, gas stations, pharmacies, and markets using forged documents to facilitate cross-border travel. After attacks, operatives were to video record their actions and report back to the FSB. Following 37 law enforcement raids, authorities seized phones, notes, forged IDs, firearms, and approximately $89,000 in combined cash. The detained ringleader and an accomplice face charges of collaborationism and document forgery under Ukraine’s criminal code, potentially leading to life imprisonment.

Classification

Confidence: High

The event clearly describes hostile Russian FSB espionage and sabotage planning targeting multiple countries, which constitutes aggressor activity. It also involves Ukrainian Security Service and National Police operations to dismantle the network, representing defense preparations and counterintelligence actions.

Source URL

https://english.nv.ua/nation/ukrainian-security-service-dismantles-russian-fsb-spy-network-planning-arson-attacks-in-the-eu-50437473.html

Open source

Provenance

Publisher: extension
Submitted: Feb 1, 2026, 00:14 UTC
Last updated: Nov 8, 2026, 21:59 UTC
Event time: Jul 25, 2024, 00:00 UTC

Published as a Defense Preparations signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "c423ec66-8944-4d9a-9216-c04f9567f654",
  "url": "https://english.nv.ua/nation/ukrainian-security-service-dismantles-russian-fsb-spy-network-planning-arson-attacks-in-the-eu-50437473.html",
  "source": "extension",
  "status": "approved",
  "category": "Terrorism & Criminal Proxy Tactics",
  "subcategory": "Terrorism",
  "incident_type": "Bomb threats, assassination plots, targeted killings",
  "country": "Ukraine",
  "source_reliability": "C",
  "info_credibility": "3",
  "tags": [
    "Russian FSB",
    "spy network",
    "arson attacks",
    "Ukraine",
    "Poland",
    "baltic sea region",
    "Ukrainian Security Service",
    "SBU",
    "National Police",
    "forged documents",
    "collaborationism",
    "criminal network"
  ],
  "nodes": [],
  "countries": [],
  "where_text": "Land",
  "headline": null,
  "description": "On July 25, 2024, the Ukrainian Security Service (SBU) and National Police dismantled a Russian FSB spy network in Prykarpattia, Western Ukraine, that was planning arson attacks in densely populated areas of Ukraine, Poland, and the Baltic states. The group of 19 members recruited operatives for arson attacks against civilian targets such as shopping centers, gas stations, pharmacies, and markets, using personal criminal connections. They prepared forged documents to facilitate operatives' travel abroad and instructed them to record their attacks for reporting to the FSB. Law enforcement seized mobile phones, handwritten notes, forged documents, firearms, bank cards, and over $89,000 in cash during 37 raids. The ringleader and an accomplice face life imprisonment charges for collaborationism and document forgery under Ukrainian criminal law.",
  "summary_short": "Ukrainian Security Service dismantled a Russian FSB spy network planning coordinated arson attacks in Ukraine, Poland, and the Baltic states on July 25, 2024.",
  "summary_extended": "On July 25, 2024, Ukrainian authorities announced the dismantling of a Russian FSB spy network that intended to carry out arson attacks targeting civilian sites in Ukraine, Poland, and the Baltic nations. The group consisted of 19 members residing across Western and central Ukrainian oblasts including Ivano-Frankivsk, Dnipropetrovsk, Poltava, and Zaporizhzhya. They recruited operatives to attack shopping centers, gas stations, pharmacies, and markets using forged documents to facilitate cross-border travel. After attacks, operatives were to video record their actions and report back to the FSB. Following 37 law enforcement raids, authorities seized phones, notes, forged IDs, firearms, and approximately $89,000 in combined cash. The detained ringleader and an accomplice face charges of collaborationism and document forgery under Ukraine’s criminal code, potentially leading to life imprisonment.",
  "actor_primary": "Russian FSB spy network ringleader",
  "target_primary": null,
  "location_text": "Prykarpattia (Western Ukraine) region; activities also targeted Poland and the Baltic states",
  "location_region": null,
  "location_coordinates_lat": null,
  "location_coordinates_lon": null,
  "location_precision": "Regional",
  "is_aggressor_signal": true,
  "signal_type": "DEFENSE_PREP_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The event clearly describes hostile Russian FSB espionage and sabotage planning targeting multiple countries, which constitutes aggressor activity. It also involves Ukrainian Security Service and National Police operations to dismantle the network, representing defense preparations and counterintelligence actions.",
  "event_time_utc": "2024-07-25T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "pm24h",
  "created_at": "2026-02-01T00:14:46.177Z",
  "updated_at": "2026-11-08T21:59:20.894Z",
  "reliability_band": "strong",
  "location_precision_band": "regional",
  "time_precision_band": "within_24h",
  "severity_band": "moderate",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}

Public assessmentReliability: StrongSeverity: ModerateAttribution: HighSingle sourceTime: Same dayLocation: Regional

Source reliability

Info credibility

Event time

Jul 25, 2024, 00:00 UTC

Event time confidence

pm24h

Location

Prykarpattia (Western Ukraine) region; activities also targeted Poland and the Baltic states

Primary actor

Russian FSB spy network ringleader

Country

Ukraine

Tags

Russian FSB, spy network, arson attacks, Ukraine, Poland, baltic sea region, Ukrainian Security Service, SBU, National Police, forged documents, collaborationism, criminal network

Loading signal...

{ "id": "c423ec66-8944-4d9a-9216-c04f9567f654", "url": "https://english.nv.ua/nation/ukrainian-security-service-dismantles-russian-fsb-spy-network-planning-arson-attacks-in-the-eu-50437473.html", "source": "extension", "status": "approved", "category": "Terrorism & Criminal Proxy Tactics", "subcategory": "Terrorism", "incident_type": "Bomb threats, assassination plots, targeted killings", "country": "Ukraine", "source_reliability": "C", "info_credibility": "3", "tags": [ "Russian FSB", "spy network", "arson attacks", "Ukraine", "Poland", "baltic sea region", "Ukrainian Security Service", "SBU", "National Police", "forged documents", "collaborationism", "criminal network" ], "nodes": [], "countries": [], "where_text": "Land", "headline": null, "description": "On July 25, 2024, the Ukrainian Security Service (SBU) and National Police dismantled a Russian FSB spy network in Prykarpattia, Western Ukraine, that was planning arson attacks in densely populated areas of Ukraine, Poland, and the Baltic states. The group of 19 members recruited operatives for arson attacks against civilian targets such as shopping centers, gas stations, pharmacies, and markets, using personal criminal connections. They prepared forged documents to facilitate operatives' travel abroad and instructed them to record their attacks for reporting to the FSB. Law enforcement seized mobile phones, handwritten notes, forged documents, firearms, bank cards, and over $89,000 in cash during 37 raids. The ringleader and an accomplice face life imprisonment charges for collaborationism and document forgery under Ukrainian criminal law.", "summary_short": "Ukrainian Security Service dismantled a Russian FSB spy network planning coordinated arson attacks in Ukraine, Poland, and the Baltic states on July 25, 2024.", "summary_extended": "On July 25, 2024, Ukrainian authorities announced the dismantling of a Russian FSB spy network that intended to carry out arson attacks targeting civilian sites in Ukraine, Poland, and the Baltic nations. The group consisted of 19 members residing across Western and central Ukrainian oblasts including Ivano-Frankivsk, Dnipropetrovsk, Poltava, and Zaporizhzhya. They recruited operatives to attack shopping centers, gas stations, pharmacies, and markets using forged documents to facilitate cross-border travel. After attacks, operatives were to video record their actions and report back to the FSB. Following 37 law enforcement raids, authorities seized phones, notes, forged IDs, firearms, and approximately $89,000 in combined cash. The detained ringleader and an accomplice face charges of collaborationism and document forgery under Ukraine’s criminal code, potentially leading to life imprisonment.", "actor_primary": "Russian FSB spy network ringleader", "target_primary": null, "location_text": "Prykarpattia (Western Ukraine) region; activities also targeted Poland and the Baltic states", "location_region": null, "location_coordinates_lat": null, "location_coordinates_lon": null, "location_precision": "Regional", "is_aggressor_signal": true, "signal_type": "DEFENSE_PREP_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The event clearly describes hostile Russian FSB espionage and sabotage planning targeting multiple countries, which constitutes aggressor activity. It also involves Ukrainian Security Service and National Police operations to dismantle the network, representing defense preparations and counterintelligence actions.", "event_time_utc": "2024-07-25T00:00:00.000Z", "end_time_utc": null, "event_time_confidence": "pm24h", "created_at": "2026-02-01T00:14:46.177Z", "updated_at": "2026-11-08T21:59:20.894Z", "reliability_band": "strong", "location_precision_band": "regional", "time_precision_band": "within_24h", "severity_band": "moderate", "attribution_confidence_band": "high", "attribution_basis": "single_source" }