Matvii Pidlisnyi
Key Takeaways
- Russia wages a multifaceted internal destabilization campaign against Ukraine, operating alongside its military aggression to undermine national resilience and societal cohesion.
- This campaign integrates Kinetic attacks (sabotage, violence, often using recruited minors), Cyberattacks (disrupting services, data theft, deepfakes), and potent Information-Psychological operations (disinformation, exploiting social divisions).
- Info-psyops are particularly effective in eroding trust and social unity, while Russia constantly adapts tactics across all vectors, leveraging technology and exploiting vulnerabilities like social media recruitment.
- Ukrainian institutions actively counter these hybrid threats, but understanding the sophisticated interplay and evolution of Russia’s integrated strategy is crucial for developing effective defenses.
- Russia’s internal destabilization efforts represent an ongoing, adaptive threat aimed at fracturing Ukrainian unity from within, requiring sustained vigilance and counter-strategies.
From 2014 to 2025, during the years of war with Russia, as its hybrid phase evolved into a full-scale invasion, Ukraine faced numerous attempts to destabilize its internal situation. These efforts can be classified by their effectiveness and the types of attacks used, including information campaigns, cyberattacks, sabotage operations, and economic pressure.
When considering methods of internal destabilization, they can be differentiated based on their impact on key areas of public life: kinetic (forceful) attacks, cyber (hacking) attacks, and information-psychological operations.
The latest notable increase in terrorist acts and violence in Ukraine indicates a new tactical vector in Russia’s subversive operations on the country’s territory. Russian intelligence services have repeatedly relied on traditional destabilization methods, but the intensification of such activities today points to a shift toward more aggressive means and forms of influence.
Kinetic Attacks
This method of destabilization targets primarily those who play a crucial role in the country’s defense and resilience during wartime—military personnel, law enforcement agencies, emergency services, and others. This category utilizes terrorist acts aimed at intimidating the civilian population and destroying critical or civilian infrastructure. This method’s overall impact is primarily directed at undermining the morale of both the civilian population and the armed forces.
More specifically, kinetic attacks manifest in assaults on military personnel, car bombings targeting service members, terrorist attacks at military facilities or locations of military leadership, and attacks on infrastructure objects such as administrative buildings or railway stations.
Kinetic attacks are not merely a tool of physical confrontation and destabilization; they carry a psychological dimension, aiming to instill fear and uncertainty in society. The objective is to signal to the civilian population that all essential components of their safety are under threat, especially those who protect them—the military—and those who deal with the aftermath of shelling, fires, and destruction—emergency services and law enforcement.
In recent months, explosive attacks were carried out on territorial recruitment centers in Rivne, Kamianets-Podilskyi, and Pavlohrad; a premeditated terrorist attack involving the detonation of improvised explosive devices was committed in Ivano-Frankivsk; an agent of the Russian Federation preparing an attack in a residential area was arrested in Mykolaiv; and in Zhytomyr, a 16-year-old schoolboy was caught preparing to detonate a device near an administrative building. One of the methods used in such terrorist attacks is planting explosive devices and then calling the police to lure them into a trap. For instance, in November 2024, a grenade trap was discovered in an apartment after a fake domestic violence call – the agent responsible was detained.
According to law enforcement data, Russia typically employs these methods by recruiting minors, who are either eliminated after completing their tasks or left without support from their handlers. These methods are relatively easy to implement, given the ease with which Russian intelligence services can find executors via social media, particularly Russian platforms such as VKontakte and Odnoklassniki, offering financial compensation in exchange for task completion. Recruitment often takes the form of advertisements promising easy money with no experience required. This allows for the mass involvement of individuals who, after following a link, begin communicating with their handlers.
The complexity of assignments increases gradually: for instance, some are first asked to send photos of military vehicles parked in residential areas, others are tasked with purchasing gasoline or chemical mixtures, and eventually, new recruits are instructed to set vehicles on fire at specified coordinates. The recruiters never reveal the true nature of the tasks, presenting them instead as acts of personal revenge. Minors are not told that they are working for Russia; instead, their emotions are manipulated to gradually involve them in criminal activities. Deputy Head of the National Police states that in none of the cases were pro-Russian or anti-Ukrainian sentiments observed among the perpetrators—most acted purely for financial gain. There are also cases of blackmail-based recruitment, where personal information, e.g., photos, is collected and threats of exposure are used, like in the case of a 14-year-old girl in Ternopil who was making an improvised explosive device to plant under a police car.
Ukrainian intelligence services actively counter such sabotage efforts, and substantial information about these kinetic attacks can be found in official reports from the Prosecutor’s Office, police, and other agencies that have thwarted terrorist acts. In 2024 alone, 316 individuals were detained under Articles 113, 114, and 194 of the Criminal Code of Ukraine[1]: 205 men, 98 minors, and 13 women. As of early 2025, 76 individuals have already been detained: 50 men, 16 minors, and 10 women.
Improvised explosive devices are typically detonated remotely via mobile phone calls, which activate an electric detonator. Handlers often require the placement of a secondary phone to record the terrorist act, which is camouflaged nearby. These videos are then used by Russian propaganda channels, presented as if filmed on-site by witnesses, and used to portray anger or protest against certain institutions.
Cyber Attacks
This method primarily encompasses cyberattacks that pose a threat to communication networks and aim to disrupt the functioning of public services and access to information. These include attempts to infiltrate and hack private messaging platforms used by Ukrainians, cyberattacks on the energy system (e.g., disabling substations), and large-scale attacks on state registries of the Ministry of Justice and other governmental information systems, with the objective of depriving Ukraine of critical data.
Even before full-scale invasion, Russia’s cyberattacks were the subject of close scrutiny by the European Parliament, which, in its briefing, provided a detailed analysis of such attacks, its position on the matter, and a series of recommendations. This level of attention from the European community further underscores the systemic nature of these attacks. According to the European Parliament’s analysis, Russia’s cyberattacks have included assaults on communication systems such as Kyiv Post and the satellite KA-SAT network, the IsaacWiper attack on government websites, and a strike on a border control station designed to prevent refugees from entering Romania— all within the broader framework of Russia’s cyberwarfare against Ukraine. In response, the EU launched the EU–Ukraine Cybersecurity Program in 2021 to strengthen the country’s digital capacity to withstand such attacks.
Cyberattacks are typically conducted by hacker groups operating primarily from within Russian territory. These groups carry out systematic attempts to exploit technical vulnerabilities in the servers of private companies, government agencies, and NGOs. In the era of rapidly evolving information technologies, cyberattacks have become one of the primary tools used to destabilize a country from within. For instance, in 2024, the head of the Donetsk Regional Military Administration, Vadym Filashkin, was forced to publish a video statement debunking disinformation spread via social media using deepfake technology (a type of AI technology used to create fake videos or images that look very realistic by replacing a person’s face, voice, actions).
Given that today’s world is increasingly digitalized, with internet resources accounting for 90% of the population’s information intake and essential data across all state sectors stored in electronic formats, well-executed cyberattacks can be highly effective in destabilizing internal affairs. Russia’s cyber operations in Ukraine have most severely affected the state, energy, media, financial, business, and non-profit sectors.
Since February 24, 2022, even sporadic cyberattacks have had an indirect negative impact on the distribution of medicines, food supplies, and emergency assistance. While the targets of cyberattacks vary, their ultimate aim is the same: to cause chaos and dysfunction across multiple societal sectors by restricting access to services, stealing information, and spreading disinformation.
Phishing campaigns and spam emails targeting government institutions, the use of malware to destroy data, and attacks such as the February 2022 DDoS attack, aimed at disabling government websites, particularly in the banking and energy sectors, have had tangible consequences and real effectiveness, sparking panic among the population. Nonetheless, it should be noted that Ukraine’s IT infrastructure has proven significantly more resilient than Western experts initially anticipated. Therefore, Russian cyberattacks—as a method of destabilizing Ukraine’s internal situation—must be viewed as impactful across both military and civilian domains, though neither underestimated nor overestimated in their overall effectiveness.
Information-Psychological Attacks
This method of destabilization is widely used for psychological manipulation during wartime and aims to distort the perception of reality. In Ukraine, it manifested false reports of bomb threats targeting civilian infrastructure, fake news, and misinformation designed to fuel hostilities and deepen feelings of injustice or dissatisfaction among the population.
Information-psychological attacks primarily manipulate emotionally charged topics that resonate deeply with Ukrainian society. One such topic is the Revolution of Dignity, a mass protest movement that took place in 2013–2014. During this movement, Ukrainians took to the streets to demand democratic reforms and oppose government corruption. This event remains a defining and highly sensitive moment in Ukraine’s modern history—one associated with both civic pride and national trauma.
Russian information campaigns deliberately exploited these sentiments. For example, the so-called “Maidan-3” disinformation campaign (named after “Maidan,” the Ukrainian word for “square,” referencing the central square in Kyiv where the protests occurred) was a covert operation aimed at spreading panic and division. The campaign falsely suggested that Ukraine’s military should lead a new uprising to remove what it portrays as an illegitimate government. The goal was to fabricate internal conflict, erode public trust in institutions, and revive fears of national instability. These narratives were actively promoted by Russian intelligence services and heavily funded as part of broader efforts to destabilize Ukraine from
within.
Closely linked is a more recent narrative questioning the legitimacy of Ukraine’s President. As of February 2025, a KIIS survey shows 57% of Ukrainians trust President Zelenskyi, while 37% do not, indicating a decline in trust from 52% in December 2024. This has become part of a broader manipulative campaign by Russian intelligence designed to persuade Ukrainians that the country is descending into lawlessness and that power has been usurped. Despite the real figures of support for Zelenskyi standing at 57%, this narrative has managed to resonate even with the international public, amplified by global media outlets and political figures like Trump. Fake bomb threats serve a dual purpose: to lull the public into a false sense of security and to desensitize them to alerts, potentially leading people to ignore air raid sirens and, once complacency sets in, to carry out an actual terrorist attack.
Therefore, information-psychological attacks are perhaps the most cynical—and arguably the most effective—method of internal destabilization. They manipulate emotions and exploit socially sensitive topics. Its effectiveness lies in psychological pressure combined with the persuasive nature of disinformation, which is intended to sow doubt in society, fuel confrontation, and spread alternative narratives. The creation of an illusion of “alternative truth” is particularly dangerous. Its manipulative messaging is framed as a “different point of view” but is, in fact, based on distorted facts and outright falsehoods. This technique provokes uncertainty, fosters internal division, encourages the search for scapegoats within society, and obscures the image of the real aggressor. It is aimed not only at discrediting government institutions but also at undermining the social fabric—something that is critically unacceptable during wartime.
As early as 2022, the U.S. Department of State identified the goals of Russia’s information-psychological warfare: to falsely portray Ukraine as the escalator of the conflict, discredit Western values, and distort both historical and contemporary events.
A key feature of these attacks is their dynamic nature. In the information war, the advantage lies with the actor who “rides the wave” and most effectively adapts to the potential of social media and digital platforms. For instance, Russian media significantly outperformed Ukraine on TikTok, having mastered the platform’s algorithms and weaponized them for propaganda. By contrast, Ukrainian society has better-adapted platforms such as Instagram and Facebook for informational purposes. Telegram is often dubbed the “main messenger of the war.” Debates surrounding Telegram focus on its security, its safety for Ukrainian users, and the degree of cooperation between its developers and Russian actors, especially given agreements that allow the app to function freely in Russia.
Despite the immense pressure exerted by the Russian Federation with vastly superior financial and informational resources, Ukraine continues to demonstrate institutional resilience and societal cohesion. Ukrainian institutions—including the Center for Countering Disinformation, the National Security and Defense Council, and the State Cyber Protection Center—as well as the country’s law enforcement agencies, actively counter Russian attacks on all fronts, adapting continuously to emerging threats. However, Russia also adapts rapidly, developing new forms of pressure and refining its manipulation tactics. These actions underscore the flexibility of Russia’s information strategy, which seeks to weaken not only Ukraine itself but also its international support.
Conclusion
Thus, each of the aforementioned and analyzed methods has its own specific impact and varying degrees of effectiveness depending on the context in which they are applied. Based on a provisional categorization, kinetic methods pose a direct threat to physical safety and exert a strong psychological influence aimed at undermining the population’s morale. However, their effectiveness is significantly constrained by the efforts of Ukrainian security structures and special services.
Cyberattacks as a method of destabilization possess considerable potential due to the state’s dependence on digital technologies and the high degree of digitalization. Any technical disruption can significantly affect the functioning of critical institutions across both governmental and non-governmental sectors.
Information-psychological attacks are particularly effective, as they target public consciousness by manipulating emotionally charged and sensitive topics. Moreover, this method incites societal tension and facilitates the spread of disinformation, which is harmful to the public’s awareness and the cohesion of society.
[1] Article 113: Sabotage – refers to intentional actions aimed at undermining the functioning of vital systems and infrastructure of the state.
Article 114: Espionage – defines the unlawful gathering and transfer of state secrets to foreign entities.
Article 194: Intentional destruction or damage of property involves actions that cause significant harm to property or infrastructure, typically in an effort to disrupt national security or public order.
Disclaimer: The views, thoughts, and opinions expressed in the papers published on this site belong solely to the authors and not necessarily to the Transatlantic Dialogue Center, its committees, or its affiliated organizations. The papers are intended to stimulate dialogue and discussion and do not represent official policy positions of the Transatlantic Dialogue Center or any other organizations the authors may be associated with.
