Current Arson and Improvised Explosive Device (IED) Threats and Trends

Executive Summary

There is currently a trend of arson and IED attacks in Ukraine. These typically target Ukrainian military (UAF) vehicles; UAF recruitment (TRC) infrastructure; police stations, vehicles, and personnel; railway infrastructure; and government buildings.

The arson and IED attacks likely form part of a Russia-coordinated attempt to destabilise Ukraine and present a front of opposition to conscription rules.

In spite of the increased threat to NGO activities, measures can be taken to mitigate the risk.

20250124 – Current Arson and IED Threats and Trends in Ukraine

2024 saw a trend of sabotage in Ukraine, principally consisting of arson attacks and the use of improvised explosive devices (IEDs). On 22 Oct 24, the Ukrainian National Police (NPU) announced there had been a trend of an increase in arson attacks against UAF vehicles, with 266 arson cases reported against military vehicles or vehicles belonging to UAF servicemen in the first nine (9) months of 2024.[1] The Ukrainian National Police blamed the Russian Federal Security Service (FSB) for the activity.[2]

The NPU and Security Service (SBU) have responded, and detained 150 arsonists between May – Oct 24, and 450 over the whole of 2024. [3] [4]Despite the actions of Ukrainian security forces, the threat persists, and both sabotage and arrests continue to be reported.

For example, on 16 Jan 25, the SBU arresting two (2) individuals in Rivne Oblast for attempting to detonate an IED on a railway line (Fig 1).[5]

Fig1: IED Used in attack in Rivne reported on 16 Jan 25.

Although there have been no observed reports of sabotage against NGOs operating in Ukraine, the activity represents a new dynamic for NGOs in the country. As such, it is necessary to gain an understanding of the activity, including the devices or materials used, targeted infrastructure, the motivations of perpetrators, the likely aim, as well as the tactical and strategic consequences. This will inform advice on countermeasures NGOs can take, including prevention and mitigation strategies.

1. Recruitment and Methodology

On 8 Oct 24, Radio Free Europe’s investigative arm (RFE) published a report compiled by undercover journalists on the recruitment of Ukrainians on Telegram to commit acts of sabotage.

The journalists uncovered that adverts have been published on Telegram channels since May 24 by ‘handlers attempting to recruit individuals to set fire to UAF cars, Ukrzaliznytsia (Ukrainian Railways) equipment, and Territorial Recruitment Centre and Social Support (TRC) buildings, which organises the conscription and military service of civilians.

RFE found that several of the handlers were based in Russia, and an SBU spokesperson stated that ‘either the FSB or the GRU’ (Russian military intelligence) was behind the Telegram adverts.[6]

There are shared features to the arson attacks and communication between the handler and the potential saboteur:

• All would-be saboteurs are promised a monetary reward for a successful arson attack.
• Handlers reportedly typically request saboteurs to conduct a reconnaissance mission to identify a possible target, which is then approved or rejected by the handler.
• If a target is approved, the saboteur is required to record the arson and send the video to the handler as proof.
• Saboteurs may be asked to do a ‘test’ prior to the arson task, such as distributing leaflets.
• Although the saboteurs are promised money for their services, it does not always arrive.
• Handlers typically message in Russian, or in poor Ukrainian. [7] [8]

The Telegram messages offer ‘quick money’ for the arson attacks. When explaining his motivations, one individual who was arrested with his friends for arson stated, ‘we just wanted to make quick money’.

Furthermore, an SBU spokesman stated that ‘of the arsonists detained by the SBU…the only thing that unites them is motivation – not an ideology, not love for the ‘Russian world’, but money’. These factors indicate the main motivation for individuals recruited on Telegram is likely financial gain.

Additionally, reports have surfaced of family members of Ukrainian prisoners of war in Russia being contacted to commit arson attacks in return for family members receiving better treatment or early release.

The family members are reportedly called by a Ukrainian phone number, whereupon the handler offers a choice of targeting a TRC building, a military vehicle, or Ukrzaliznytsia electrical box, or alternatively revealing the locations of Ukrainian air defence units. Ukraine has reported that around 50% of all families of PoWs are contacted this way, however an SBU source stated that ‘the number of cases where relatives agree to work with Russia is small’.[9]

The table below details five (5) examples of arson attacks in Ukraine since Jul 24:

Five (5) examples of arson attacks in Ukraine since Jul 24

The five (5) examples show that arson attacks can occur throughout Ukraine. While targets are typically those that are specified on Telegram channels, the example of the targeted transformer substation on 15 Oct 24 suggests that other infrastructure types may also be targeted.

2. Use of Minors

One (1) notable trend in arrests reported by the SBU for arson is the large number of arrested minors. Of the 266 arrests reported by the General Prosecutor on 20 Sep 24, 50 involved minors.

The RFE investigation found that the handlers on Telegram were actively recruiting Ukrainian minors for arson attacks, including children as young as 12. Some handlers tried to reassure on the false premise that nothing would happen to them if caught on account of their age.

This is false, as under Ukrainian law minors are still liable for prosecution if found guilty of committing arson. Children from the age of 14 are liable to charges such as intentional destruction or damage to property by destruction, and those under 14 can be liable to compulsory education methods, such as compensating for the damage.[10]

The Russians target Ukrainian children as they are likely seen as being more susceptible to coercion to earn quick money due to lacking a full understanding of the possible consequences of their actions, including the wider implications for Ukraine’s military effort.

 Download Report

3. Relationship Between Arson and IEDs

Whereas arson is a longer-term issue in Ukraine (the NPU reported 98 criminal offences for arson against military vehicles between Jan – Jul 23[11]), until recently there were few reports of IED use by non-combat actors.

The first such attack took place in Odessa on 15 Feb 24, when an IED exploded in a military facility in Odessa, injuring a soldier. This was quickly followed by an attack on 19 Feb 24, also in Odessa, when an IED detonated under a van, setting the vehicle on fire and injuring two (2) paramilitary force members who were in the vehicle.

A further IED attack was reported on 9 May 24, when an attempted IED attack on a supermarket on Kyiv was thwarted by the SBU.

However, at the end of 2024 there was a significant increase in reported IED use in Ukraine. Figure 2 shows the number of observed reports of successful or attempted IED attacks in Ukraine between since 1 Jan 24[12]:

Fig 2: Observed reports of successful or attempted IED attacks in Ukraine since 1 Jan 24.

As shown by Figure 2, there have been 15 observed reports of attempted or successful IED attacks since 1 Oct 24, compared to six (6) between 1 Jan – 30 Sep 24. The map below (Fig 3) shows the locations of the successful or attempted IED attacks since the observed increase began from 1 Oct 24:

Fig 3 – Locations of attempted or successful IED attacks between 1 Oct 24 – 24 Jan 25

As shown in Figure 3, the most frequent location for IED attacks since 1 Oct 24 is Kyiv City (4), followed by Kharkiv and Zhytomyr oblasts (3 each). The map shows that IED attacks have been attempted across Ukraine. Attempted or successful attacks in Zhytomyr, Rivne (1), and Khmelnytskyi (1) indicate the threat is present in areas of the country that are typically less affected by Russian Federation Armed Forces’ (RFAF) activity.

The table below gives a breakdown of the attempted or successful IED attacks in Ukraine since the observed spike in Oct 24[13]:

Fig 4 (Numbers 1,2,3 below): IED Used in attack in Zhytomyr on 24 Dec 24. The images show the ball bearings packed into the device and phone used for initiation, the bag it is concealed in when in place, and the mobile phone set up to record the explosion.

Fig 5 – IED concealed in a soft toy, planned for use in Zhytomyr on 23 Jan 25

Many of the IED attacks have features in common with the arson attacks. These are:

• Saboteurs are commonly recruited on Telegram
• A high incidence of minors involved in IED attacks
• The frequent targeting of TRC Buildings and Railway Infrastructure (Fig 6)
• The use of mobile phones and other equipment to record the IED attacks, likely to send to the saboteurs’ handlers.
• A high proportion of the saboteurs caught were likely motivated by financial reward – indicated by the perpetrators often being minors, unemployed individuals, drug addicts, and others looking for ‘quick money’
• ‘Test missions’ prior to the attack
• Receiving instructions via Telegram, with messages written in Russian

Fig 6 – Section of an IED intended for use against railway infrastructure, reported on 18 Nov 24

Furthermore, several of the IED attacks have common features:

• IEDs are frequently filled with stones or metal objects, such as nails and ball bearings (Fig 7)
• Equipment frequently stored at a cache prior to its use
• The involvement of multiple individuals, either likely acting together or with a common handler likely located in Russia

Fig 7- An IED used in attack in Zhytomyr on 20 Nov 24 – The device concealed in the thermos was likely hidden in the bag. The image to the right shows the nails packed into the device.

The many shared features of the IED and arson attacks, including saboteurs being recruited on the same Telegram channels, the use of minors, common motivations, common targets, and common methodological features, such as recording the incident and ‘test missions’, indicate the two (2) activities likely form part of a common effort organised by hostile actors against Ukraine and perpetrated by individuals seeking financial gain.

This is supported by the common features of the IED attacks, indicating that the attacks may be coordinated by a higher actor. No observed reporting on the identified attacks mentions the perpetrators being the family members of UAF personnel or being contacted by phone call.

This, in conjunction with comments from the SBU of this being a limited modus operandi (MO) and the similarities of identified IED attacks to arson attacks perpetrated by those in search of ‘quick money’, indicates the main perpetrators of the IED attacks are unlikely to be individuals motivated by a desire to help family members in Russian captivity.[15]

In these terms, the increase in IED attacks from Oct 24 – three (3) months following the appearance of messages recruiting saboteurs – may be understood as a development of the arson MO. While it is comparatively straightforward to ignite a vehicle, it is more difficult to ignite buildings or railway infrastructure without the use of an explosive device.

Reports of those perpetrating IED attacks also conducting ‘test’ arson missions against UAF vehicles indicate that an IED attack may be a ‘step up’ from an arson attack. Recruited Ukrainians may be instructed to use IEDs when attacking buildings and railway infrastructure as this MO will likely result in greater damage as compared to an arson attack.

4. Aim

The 8 Oct 24 RFE investigation highlighted that the beginning of the mass campaign of arson against UAF vehicles coincides with the entry of the updated mobilisation law in Ukraine on 16 Apr 24, and that the purpose of the campaign is to create an impression that the majority of Ukrainian citizens were speaking out against the mobilisation.

The report found that handlers had not cared what vehicle the perpetrator targeted , and that the main thing was to make a picture. The report also found that there were cases when handlers had suggested to recruits to find a battered car, stick UAF symbols on it, and burn it.[16]

A separate investigation uncovered a text from a handler to a potential recruit, which stated that ‘this is happening all over Ukraine’, likely to create the impression of a widespread spontaneous anti-government campaign in Ukraine.[17]

Anecdotal reporting published by pro-Russia media channels and social media corroborates these findings.  On 24 Nov 24, a prominent sanctioned pro-Russian newspaper published an article detailing a series of arson and IED attacks between in Sep and Oct 24 against vehicles belonging to UAF personnel, police stations, and UAF vehicles.

When detailing a case of arson against a UAF vehicle on 10 Oct 24, the article states that as this was not the first case of arson ‘thus residents express their disagreement with forced mobilisation’.

The articles goes on to quote a prominent member of ‘The Other Ukraine’ who stated that ‘recently, against the backdrop of forced mobilisation, cases of arson against military vehicles belonging to the military have become more frequent in the country’.

‘The Other Ukraine’ is a Russian organisation founded by former Ukrainian pro-Kremlin politician Viktor Medvedchuk in 2023 which organises anti-Ukraine events in Russia. The article concludes by sharing a video depicting men resisting forced conscription in Ivano-Frankivsk Oblast and citing Ukraine’s new law on mobilisation.[18] [19]

The same pro-Russian newspaper published another article on 8 Dec 24 detailing further incidences of arson and IED attacks in Ukraine against a police station, a TRC office, and UAF vehicles. The article again concludes by citing the 16 Apr 24 Ukrainian mobilisation law.[20]

Furthermore, on 16 Dec 24 a pro-Russia Telegram channel published a post stating that it was ‘local partisans’ who had conducted the 14 Dec 24 IED attack in Dnipro.[21] The term «партизан» (partisan) in Russian often refers to a member of an organised resistance group as opposed to an independent actor, thus suggesting the attack formed part of a coordinated campaign.

As such, current arson and IED incidents across Ukraine likely form part of a Russia-coordinated campaign to create the impression of widespread opposition to mobilisation and against the war more broadly in Ukraine.

This likely forms part of Russia’s wider strategy to demoralise the Ukrainian populace, destabilise the country, and cause widespread damage to Ukrainian military and government infrastructure.

Parallels may be drawn to reports of Russia-coordinated sabotage activities in NATO countries, which likely aim to cause instability and division in ‘unfriendly countries’.

The activity in Ukraine may be influenced by internal dynamics within Russia with respect to mobilisation, as reflected by unrest in the country due to the introduction of mobilisation laws.[22] This may inform a Russian perception that violence and destruction gives the impression of widespread opposition to Ukrainian government policies.

5. Consequences

Of the 15 attempted IED incidents in Ukraine since Oct 24, 10 are confirmed to have detonated successfully. The consequences the successful attacks are outlined in the table below:

As shown in the table, across all identified successful IED attacks, three (3) people were killed, and four (4) were injured. Although seven (7) of the ten (10) successful attacks did not cause death or injury, it is noteworthy that of the 15 identified attempted IED attacks, only five (5) were prevented by the SBU or NPU.

Assuming no other attacks have occurred (see footnote 11), this casts doubt on the ability of Ukrainian security forces to prevent attacks. The elevated risk of death or injury due to IEDs across Ukraine may have a psychological impact on civilians and foreign NGOs operating in the area, as concealed IEDs are likely hard to spot and may be hidden in regular everyday items (Fig 8).

Fig 8 – IED Used in attack in Kharkiv on 8 or 9 Dec 24. The device was likely concealed in the box behind

Moreover, arson against UAF vehicles is likely detrimental to Ukraine’s military capability and the morale of personnel.

A UAF officer commanding a unit which lost a vehicle due to an arson attack stated that such attacks ‘ruin our mood’, and noting that it is a drain on logistics, time, energy, and the ability of his unit to fulfil its function.[23]

Similarly, attacks on TRC infrastructure may impact Ukraine’s ability to recruit personnel for the armed forces if buildings are damaged. Conversely, damage to railway infrastructure is unlikely to significantly impact Ukraine’s war effort, as the equipment can typically be quickly repaired.

6. Mitigations and Countermeasures

Despite the elevated threat, there are steps that NGOs operating in Ukraine can take to mitigate the risk from arson and IEDs. These include:

• Do not wear any clothing which may be mistaken as UAF uniform, such as camouflage or black boots.
• Avoid areas frequented by UAF personnel.
• Ensure any vehicles being used are distinct from UAF vehicles, and do not park in areas where UAF personnel may be present. Arsonists have targeted the personal vehicles of UAF personnel and may mistake vehicles parked near/among vehicles belonging to UAF personnel as also belonging to UAF personnel.
• Unless absolutely necessary, avoid UAF vehicles, TRC infrastructure, police stations and vehicles, railway infrastructure, and government buildings.
• If it is necessary to be in the vicinity of (IVO) these facilities, do not pick up or approach any objects.
• Avoid setting a pattern of life by varying infiltration and exfiltration routes.
• Be aware of atmospherics and the pattern of life in visit areas and take any behaviour changes into account.
• Consider bringing an extendable mirror to check underneath vehicles for IEDs.

While individuals recruited by handlers on Telegram to commit arson on vehicles are unlikely to target vehicles occupied by people, it is possible perpetrators may emplace an IED to the vehicle.

More broadly, it will likely take a continued concerted effort for Ukrainian security forces to combat arson and IED use. The SBU and NPU have introduced a campaign called ‘Burn the FSB Officer’, which includes a video footage reminding people of the inevitability of punishment for committing acts of sabotage or terrorism, and that even minors are liable for criminal proceedings.

The SBU has also introduced a chatbot for those contacted to commit crimes to report it and provide details on the individual who attempted recruitment.[24] The continued issuing of extended prison sentences for perpetrators of sabotage are likely to be a deterrent to even the most desperate individuals, and reinforce to would-be saboteurs the readiness of Ukrainian authorities to issue punishments for such activity.

Increased SBU and NPU patrols will allow personnel to identify arson or IED activity and arrest those involved, which will also likely act as a deterrent. In turn, this may encourage people to report being contacted by hostile actors, rather than engaging in the activity.

7. So What and Future Outlook

The threat of sabotage poses an increased risk to NGOs operating in Ukraine. However, if appropriate measures are taken, the risk can be further mitigated. Avoiding facilities likely to be targeted is likely to significantly reduce the risk, however considering this can constitute the personal vehicles of UAF personnel, this may not always be possible.

The likely Russian-coordinated sabotage campaign demonstrates the continued resolve of Russia to destabilise its enemies via hybrid warfare tactics.

If Ukrainian security forces are able to gain control of the situation, Russia may change tactics in its destabilisation and subversive efforts.

Russia has shown continued ability to adapt to realities of the conflict in Ukraine, such as introduce anti-drone electronic warfare (EW) measures, fibre optic drones and continuous upgrades to one-way attack uncrewed aerial systems (OWA UAS).

In this case, this could include targeting different infrastructure or telling operators to use different tactics when conducting attacks, making it harder for Ukrainian security forces to disrupt.

 Download Report

If you would like to learn more about Prevail Partners, have an enquiry or would like a similar report produced for your organisation, please contact us for more information.

[1] https://www.radiosvoboda.org/a/news-pidpaly-zamovlennya-rf-politsiya/33216521.html

[2] https://ms.detector.media/propaganda-ta-vplivi/post/36332/2024-10-03-anty-ttsk-yak-pratsyuyut-vorozhi-telegram-rekrutery-y-boty-yaki-verbuyut-ukraintsiv-dlya-dyversiy/

[3] https://www.radiosvoboda.org/a/news-fsb-pidlitky-pidpaly-avto-zsu/33151236.html

[4] https://armyinform.com.ua/2025/01/15/spaly-fsbshnyka-sbu-ta-naczpolicziya-poperedzhayut-molod-pro-nebezpeku-verbuvannya-speczsluzhbamy-rf/

[5] https://euromaidanpress.com/2025/01/16/

[6] https://www.radiosvoboda.org/a/fsb-pidlitky-pidpaly-avto-zsu/33149666.html

[7] Ibid.

[8] https://ms.detector.media/propaganda-ta-vplivi/post/36332/2024-10-03-anty-ttsk-yak-pratsyuyut-vorozhi-telegram-rekrutery-y-boty-yaki-verbuyut-ukraintsiv-dlya-dyversiy/

[9] https://www.bbc.co.uk

[10] https://www.radiosvoboda.org/a/news-fsb-pidlitky-pidpaly-avto-zsu/33151236.html

[11] https://www.radiosvoboda.org/a/news-natspolitsia-vypadky-pidpaliv-avto-viiskovyh/33168380.html

[12] Details of specific IED attacks are taken from open-source data, and as such dates may not be exact. Furthermore, although efforts have been made to conduct comprehensive open-source scrapes, not all events may be accounted for.

[13] Details are taken from open-source media reporting and as such may be incomplete.

[14] Exact date unknown.

[15] https://www.bbc.co.uk

[16] https://www.radiosvoboda.org/a/fsb-pidlitky-pidpaly-avto-zsu/33149666.html

[17] https://ms.detector.media/propaganda-ta-vplivi/post/36332/2024-10-03-anty-ttsk-yak-pratsyuyut-vorozhi-telegram-rekrutery-y-boty-yaki-verbuyut-ukraintsiv-dlya-dyversiy/

[18] https://iz.ru/1796146/2024-11-24/na-ukraine-soobshchili-o-roste-v-strane-chisla-diversii-protiv-silovikov

[19] https://www.kyivpost.com/post/19940

[20] https://iz.ru/1803994/2024-12-08/v-harkove-vozle-otdelenia-policii-progremel-vzryv

[21] https://t.me/rybar/66385

[22] https://www.themoscowtimes.com/2022/09/22/

[23] https://www.radiosvoboda.org/a/fsb-pidlitky-pidpaly-avto-zsu/33149666.html

[24] https://armyinform.com.ua/2025/01/15/spaly-fsbshnyka-sbu-ta-naczpolicziya-poperedzhayut-molod-pro-nebezpeku-verbuvannya-speczsluzhbamy-rf/