Since last year, Ukraine has recorded numerous cases of arson of military vehicles, terrorist attacks near military registration offices, and beatings of military or police officers. The perpetrators are often teenagers recruited by Russians on the Internet.
The Suspilne investigative editorial office managed to find one of the chats, where recruitment took place, and closely examined the process of how teenagers were turned into criminals who were supposed to help disrupt mobilization and make the atmosphere in the country even more alarming. The investigative documentary “Access Point” is available on the Suspilne’s YouTube channel. Here, we offer a text version about how Russians approach Ukrainians on Internet drug shops and, with the help of promises, money, intimidation, and beatings, carry out terrorist attacks in dozens of Ukrainian cities.
The bright room in the pre-trial detention center turned out to be unexpectedly cozy: warm cream-colored walls, lots of greenery in the corners and on the windowsills, and plenty of neatly arranged chairs around. Only the iron bars on the windows remind us where we are. Two guys, both 18 years old, were brought in for an interview. Here, behind bars, they looked like confused teenagers. Not long before, these boys had spent a month manufacturing, transporting, and planting explosive devices in a construction site in the city of Rivne. The explosives were supposed to kill police officers.
The first one is relaxed and feels quite confident. There is almost no emotion on his face with the remnants of teenage acne, his voice has a dry intonation, and his answers are thoughtful, though not always logical. On the other hand, the second detainee is the complete opposite. The guy looks tense, even scared: he has difficulty sitting on a chair, his movements betray anxiety, and his gaze is focused on the floor.
The guys have neither fanaticism in their eyes nor aggression in their voices. One used to be into electronic music, the other into programming. In our story, these guys are not the main criminals and certainly not the victims. They are a symptom, a consequence of the system that used them.
Suspects’ testimonies
To immerse you in the world that led the teenagers to imprisonment, we will share some of what we learned from them during our conversations in the pre-trial detention center.
The guys became members of a chat at one of the online drug stores. At first, they bought drugs there and talked about them with other members and administrators. Later, one of the administrators offered a “job”. The guys agreed.
The young men planted explosive devices made of grenades, cans, and mobile phones in a construction site on the outskirts of Rivne. After that, there was a phone call to the emergency police line about a human body lying there. The group of law enforcement officers who arrived there survived: one of the devices did not explode, and they managed to escape from the other because they heard the click of a motion sensor and moved back.
The Security Service of Ukraine detained the young men in less than a day.
Below is the first suspect’s story in direct speech.
“I was an electronic music performer. Spotify, Soundcloud, all that. The best success was a track on YouTube that got a million views. My favorite artists are [Russians] Platov, Kizaru. It does not matter where a musician is from, as long as their music is good.
We found out about this drug shop three months ago. I was not addicted. Sometimes I smoked weed and used mephedrone, amphetamine, and ecstasy.
There was a video chat, and the administrator of this channel often joined it and talked to people. We were there too. Later, in a personal chat, he offered us a job. At first, it sounded like we had to assemble a bomb. We said we needed time to think. We thought for three days, then he contacted us again and from that moment, the work began. Later, he passed us on to another person, as I understood it, to a good friend of his, with whom he had been collaborating for a long time.
We had video calls; he showed and told us in detail how to do everything. We took the grenades from a secret place. We bought all the other elements in different stores.
We were stalling for time to find a way to quit. Later, when we had almost done everything, we took a break for two or three days. During this break, we were threatened... There was a system where if the people he hired did not do their job properly, the administrator proposed [in the chat] a reward for beating them, burning down their apartment doors or even killing them. The administrator rented an apartment for us so he knew where we were.
The fear of going to jail was about the same as the fear of punishment from the drug store administrator. We realized there was no way back and hoped for luck.
When we were planting the explosive devices, we were on video call with the organizers. We showed them how we got there and they gave us instructions on what to do.
I did not know that the bomb was supposed to target police officers. The administrator told us that we should just make it and leave it in a secret place. Then someone else had to pick it up, detonate it, and throw it somewhere. We were promised two thousand dollars for it but we did not get anything.
These two administrators can speak Ukrainian fluently; one of them said he was in Zhytomyr region. I do not know with whom they are connected.
If we had known in advance where it would go and who it would affect, we would not have started doing this.”
Although the conversation with the second guy was more constrained, it added a few details about the preparation of the crime.
“A guy contacted us on Telegram. He said there was a job: to assemble, to plant and that was it. He offered it several times, we refused twice, and the third time we agreed. They told us to put the bombs in a certain place, and they would take them away. I do not know what was supposed to happen to them, they did not tell us. I did not even think about it. I just wanted money.
We put grenades in big cans. Then we had to take the phones apart and solder something. I did not think it would explode there, in the construction site.
There were thoughts of giving up. I was afraid and did not know what to do with the grenades. Money decided everything. I wanted money: to help my parents, for myself.
Now, I would refuse to do all this. I would not have done this if I could turn time back. I admit my guilt.
Who could benefit from this? The task was to blow up the police officers, right? Why would Russia blow up our police officers?”
We found the answer to this question with the help of experts and our own investigation.
Telegram chat as a recruitment center
Our investigation focused on one of many Internet drug stores whose advertisements can be found on the walls of high-rise buildings, in subways, or on social media.
The law enforcement did not want to tell us the name of the drug shop and when we ourselves found out what kind of drug shop it was, we understood why. We will not reveal any nicknames, titles, or names: everything has been changed for security reasons and so as not to advertise a brazen crime. After a few days of active searching, we realized that we came across an organized group.
We had no clues, except for a well-known among drug addicts acronym of letters and numbers. This acronym led us to a website from which one can access a Telegram account with the promise of work, as well as a channel and bot of a drug shop through which the user can select a city and the desired product.
The network operates on a principle similar to the Russian darknet market “Hydra”, which European law enforcement liquidated in 2022. Payments are made in cryptocurrency, a system of secret places with photo reports is in place, and the entire process guarantees anonymity.
We started reading the messages in the main Telegram chat of the drug shop. In its short period of existence, it has gathered more than three hundred users. Many of them did not try to remain anonymous and from their accounts, videos, and voice messages, it is clear that they are young people. In communication, there was a lot about drugs and alcohol. However, not only about this: the channel administrators set the audience against law enforcement agencies and military registration offices, and are engaged in recruitment.
The main administrator of the chat, whom we will call “Phantom”, and his assistant, whom we will call “Ghost”, offer in the chat various types of earnings. They promise money and drugs for personal details of police officers, setting cars and apartments on fire, beatings and advertising a drug store.
Phantom even looked for athletes, promising to pay them 200,000 hryvnias a month. However, there was a condition: to “get a job”, they had to beat up a military office employee or burn a serviceman’s car. Phantom said he was looking for one thousand such “employees”.
While investigating the drug chat, we repeatedly came across messages with orders. Later, photos and videos of crimes appeared in local news forums. The drug chat administrators left comments under the orders, added reactions, and reposted them in their chat.
We managed to establish that this drug shop might be involved in at least four crimes in the city Rivne alone.
After analyzing the correspondence, identifying many participants and administrators, we came to the conclusion that there is a circle of the most active users in the chat who have known each other for a long time and know each other’s real names. This circle includes at least five administrators and about a dozen regular chat participants. These are people from different regions of Ukraine. Some of them flaunt a lot of money and expensive cars on their social networks. Others show off weapons, advertise a drug shop, buy up cards of various banks and talk about rapid career growth – from a courier, for example, to a courier supervisor.
In the chat and on the drug store channel, we also found several videos of people being brutally beaten. Teenagers and adults were kicked and beaten with sticks, and one young man was threatened with a gun. After the beating, some were made to kneel, were tied up, and forced to apologize to Phantom for something. Phantom himself said that this is how they punish those who “decided that they can avoid being responsible for their actions”. He promises one thousand dollars for one such beating.
However, such punishment can be just the beginning. In May, Phantom proposed chat participants to set fire to the apartment door of one of the already beaten boys, posting the address and contact information of his family.
Why is it easy to recruit in drug stores?
“When we speak about a certain channel of prohibited content or the distribution of a prohibited substance, people there have already crossed the zone of the law. They are already ready for more difficult tasks and for certain proposals that the enemy can express to them more openly. Such a person is addicted to drugs and is more inclined to earn money under any pretext,” says Yevhenii Panchenko, acting deputy head of the Interpol bureau in Ukraine.
Panchenko believes that blocking Telegram will only change the channels of communication, but will not solve the problem. “Viber, WhatsApp, Signal, and other messengers remain popular in Ukraine. It is very difficult to predict where exactly the communication of Russian special services will go,” he says, adding that another active recruitment channel is chats in online games.
Evidence of the Russia’s involvement
We found information about not only the current channel and chat of this drug shop, but also about those that were active before, but were blocked by the Telegram administration. We also managed to find web traces of the drug shop administrators for the past year and a half. Due to this, we understood that from the very beginning of the network’s activity, the interests of the organizers covered all of Ukraine.
The current chat administrator, whom we will call “Fox”, has been an active recruiter from the very beginning of chat activity. In the summer of 2024, she posted numerous ads in open communities of Kyiv, Poltava, Dnipro, and in all-Ukrainian chats. These chats bring together people looking for work, dating, rent, etc. Some of them have tens of thousands of subscribers.
In August 2024, Fox began openly recruiting men to carry out missions against military registration offices. She posted advertisements for a new drug shop service: transporting abroad those who, as she said, were “tired of enduring the government’s treatment”. In these messages, Fox wrote that payment for transportation could be the performance of some “simple” work “related to reducing the aggressive influence of military registration offices”.
On the one hand, the drug shop administrators incite violence against law enforcement officers and military registration offices. On the other hand, they never directly say that they support Russia or act in its interests. Apparently, this behavior allows them to gather a very diverse audience.
“This, by the way, shows that, most likely, this chat is funded either by Russian special services or by some pro-Russian initiatives,” comments Serhii Mykhailyk, the crisis psychologist of the “Children’s Voices” charitable foundation. “Because the aggression is redirected quite carefully. They do not directly conflict with teenagers, they do not say, ‘No, you cannot kill Russians’. They persuade chat participants, ‘We need to deal with our bad people, and then with everyone else’.”
We managed to find evidence of the Russian influence in this story. We found that outside of the chat, at least three of its administrators create and promote Telegram channels that position themselves as “opposition forces of Ukraine”.
It seems that these channels work as ordinary distributors of narratives favorable to Russia: they talk not only about the corruption of the authorities, but also about the oppression of democracy. All this is supplemented by invented stories about the struggle of fictional activists against the authorities, poems by Shevchenko, and Ukrainian songs.
One of the videos distributed by such channels included a call to fight against military registration offices with a QR code to the Fox’s Telegram page.
In April 2024, these channels were promoted in various chats, and one of them, with the Russian name “Confrontation”, tried to order advertising on a well-known Ukrainian Telegram channel. The deal did not go through: it turned out that the account, from which the advertising request came, was registered with a Russian phone number.
Why have teenagers become a risk group?
“Now in Ukraine there are practically no ideological perpetrators of Russian crimes, so the Russian FSB and GRU employees have switched to a new tactic, which is financial motivation. They offer money for completing their tasks,” emphasizes Artem Dekhtiarenko, the Security Service of Ukraine spokesperson. “The Security Service of Ukraine has already identified many such FSB personnel. An evidence base has been collected for them, and they have already been notified of suspicion.”
According to the Security Service spokesman, since the spring of 2024, law enforcement officers have detained more than 700 people who carried out tasks for the Russian Federation, including arson, bombings, terrorist attacks, and sabotage. More than half of those detained are unemployed. A quarter of the perpetrators are teenagers.
“If to speak about a conventional portrait of a person who can carry out enemy tasks, age and gender do not matter here. Among the detained agents, the youngest was 11 years old. The boy committed arson. The oldest detainee was 66. The geography is also as wide as possible, because it is important for Russian special services to find anyone who will agree to carry out their tasks,” Dekhtiarenko adds.
Crisis psychologist Serhii Mykhailyk says that there are several risk groups. People belonging to these groups may agree to an offer to assemble an explosive device or bring it to a police station or military registration office. Among them are teenagers and people with addictions.
“In general, teenagers are a risk group,” explains Mykhailyk. “They are financially vulnerable, and if they are also addicted to alcohol or drugs, it is easier to push such people into some kind of activity.”
The actions of two young men from Rivne were classified under Part 2 of Article 258 of the Criminal Code of Ukraine – committing a terrorist attack by a group of persons. The law enforcement informed Suspilne that the men are collaborating with the investigation.
According to the sanction of the article, they face imprisonment for a term of 7 to 12 years with confiscation of property.
As a reminder, you can learn more about how teenagers were recruited and about the activities of the drug store from the Suspilne investigative documentary on YouTube.
The Security Service of Ukraine emphasizes that in the event of recruitment, it is necessary to report it to law enforcement agencies. For this purpose, the Security Service has launched the official chatbot “Expose an FSB officer”.
This publication was funded by the European Union. Its contents are the sole responsibility of the author and do not necessarily reflect the views of the European Union.