During the first eight months of 2026, 37 low-intensity sabotage incidents affecting vehicles and other non-strategic targets were reported in the Russian Federation and the temporarily occupied territories of Ukraine. These decentralised operations fall within standard partisan practices linked to the MICE framework. Processed intelligence indicates that no significant changes are expected in the short or medium term, although an increase in reported attacks is likely in the event of total or partial mobilisation in Russia.

Findings

1) Available intelligence indicates between 1 January and 16 August 2026, 37 low-intensity sabotage attacks on Russian military and state vehicles, as well as other low-intensity operations, were reported.

2) The most significant low-intensity operation took place in Kochegury, Belgorod Oblast, on 8 January 2026, where published footage distinctly showed the destruction of 15 military vehicles in a single operation.

3) At least 6 vehicles were targeted in the temporarily occupied territories of Luhansk during the first eight months of 2026, according to processed data. The nature of this type of activity is entirely decentralised.

4) Data segmentation by target type reveals a marked pattern focused on Russian military and state vehicles (49 destroyed vehicles). By contrast, only two buildings of non-strategic or non-tactical importance were targeted during the same analysed period. A symbolic activity was also reported.

5) Processed data indicates a pronounced predominance of destroyed assets in the Russian Federation (38 destroyed assets) over the temporarily occupied territories (14 destroyed assets). A trend towards the decentralisation of organisations (8 active organisations were identified) claiming responsibility is evidently identifiable.

Assessment

Processed information suggests sabotage attacks on Russian military and state vehicles constitute a subset of broader partisan operations. These encompass actions against railway infrastructure, airfields, substations, energy facilities and other miscellaneous targets (Bubble-1 operations), as well as attacks on factories, malls and warehouses (Bubble-2 operations). Such practices exemplify low-signature sabotage operations characterised by decentralisation and the use of disposable agents, with the explicit aim of overwhelming counterintelligence services. The MICE framework (Money, Ideology, Coercion, Ego) plays a significant role in shaping these low-intensity sabotage activities - a common trend observed since the start of Russia’s war on Ukraine.

Outlook

Short term: It is almost certain over the coming months, videos will continue to be published showing sabotage attacks on Russian military and state vehicles, as well as other non-strategic targets. The characteristics of these activities are expected to remain unchanged.

Medium term: The number of operations against Russian military and state vehicles will likely increase if a total or partial mobilisation takes place from October 2026 onward.

Long term: It is certain this type of activity will be among the first to decline in the event of an end to the war.

Sources:

Burkett, R. (2013). An alternative framework for agent recruitment: From MICE to RASCLS. Studies in Intelligence, *57*(1), 7–17 https://archive.org/details/mice_rascls_cambridgefive/burkett2013/mode/2up

Nyzio, A. (2025). Disposable spies: a proposal for a model. Security Journal, 38(1), 65.

https://link.springer.com/epdf/10.1057/s41284-025-00503-2?sharing_token=QdcUAsNQW47RpXwqHsJPw1xOt48VBPO10Uv7D6sAgHt9Krk3H3oo4U51OsTYQGPG1X5n487PF32CPrt1ljanUgcB_WNtpWtKx9zgQKh-poAaLsoW8EnRImG4LnhSMjZqHitNqjWxZHJ8QLTJ6dVfL6LeIYP53HaAcUCIiONx6yQ%3D

Addendum I - Low-Signature Sabotage Operations: Organisations claiming responsibility

Addendum II - Detailed Operations Log

Analysis of gathered data on partisan activities in the Russian Federation during the first half of 2026 provides different insights from those observed in the Russian-occupied territories of Ukraine. Processed data reveals an increasing number of IED operations against open-air facilities. Open-source data also indicates minimal changes within the structure of partisan networks, owing to their highly adaptive nature and decentralisation. Moscow remains an isolated area for the most complex disruptive activities carried out by Ukrainian intelligence operatives. It is important to note that all reported activities during the first half of 2026 were categorised into three distinct bubbles. Bubble 1 (activities targeting signal relay cabinets, locomotives, airfields, ancillary targets, substations, and other energy infrastructure), Bubble 2 (activities targeting factories, malls, and warehouses), and Bubble 3 (elimination, elimination attempts, and complex operations involving multiple layers of security and coordination among various actors).

Findings

1. Reported partisan activity during the first half of 2026 shows irregular patterns compared to 2025. Comment: Processed data indicates elevated levels of reported partisan activity within the Russian Federation. End Comment.

2. During the first half of 2026, at least 26 activities were attested in Moscow and its surrounding areas. A total of 13 disruptive operations were concentrated in Saint Petersburg and Leningrad Oblast, and 12 in Sverdlovsk Oblast. Comment: This pattern aligns with previously shared assessments and with the main urban areas of the Russian Federation (excluding Novosibirsk). End Comment.

3. Processed data indicates damage to railway infrastructure (78) is the most frequently reported type of sabotage in the Russian Federation. Sabotage against antennas and EW systems (38) constitutes the second most common category, and actions against energy infrastructure (28) the third, based on available intelligence. Comment: This is consistent with previously published assessments and with activists’ target dispersion. End Comment.

4. Eliminations and elimination attempts continued throughout the first half of 2026 (7). Comment: Most eliminations were concentrated in Moscow (4) and its surrounding areas. This indicates Moscow as an isolated operational area. End Comment.

5. Bubble 2 activities are significantly higher than those recorded in the occupied territories, with a total of 17 facilities attacked during the first half of 2026. Bubble 1 activities remain dominant. Comment: This pattern remains unchanged compared to 2025. End Comment.

6. Open-source intelligence indicates a rise in IED operations (10 activities reported). Comment: This pattern is consistent with the adaptive nature and decentralisation of partisan cells. End Comment.

Assessment

The analysis of processed data indicates partisan activity remained high during the first half of 2026, although the patterns do not fully match those from 2025. It is almost certain that this pattern will remain unaltered during the second half of the current year. The main Russian urban areas (excluding Novosibirsk) account for most of the reported disruptive operations. This trend, especially in Moscow and the Moscow region, enables the most complex operations by the HUR (the Main Directorate of Intelligence of the Ministry of Defence of Ukraine) against Russian military/intelligence assets linked to the war of aggression.

The characteristics of partisan operations carried out in the Russian Federation are shaped by a structure of three layers (Bubbles). As in 2025, analysed data demonstrates multiple focuses depending on the target. Available intelligence emphasises the role of Moscow as an isolated area for most complex operations (assassination attempts). There is high confidence that these characteristics will remain unaltered.

Filtered information suggests the adaptive nature and decentralisation of partisan cells involved in Bubble-1 and Bubble-2 sabotage operations. FSB ‘antiterrorist’ operations resulted in changes in attacked targets, increasing the number of attacks against antennas and EW systems during the first half of the current year. It is worth noting claimed Bubble-2 operations (fenced facilities where different layers of intelligence are required) are more frequently reported than in the Russian-occupied areas of Ukraine, while OWA-drones are targeting these same targets in the occupied territories. The increasing number of IED operations not only highlights the characteristics of “saboteurs” operating within Russian territory, but also indicates Russian limitations in antiterrorist and counterintelligence capabilities, particularly those of the FSB’s Second Service.

Outlook

Short term: It is very likely that disruptive cells in the Russian Federation will remain active during the coming months. The irregular patterns of reported activities do not suggest any imminent change.

Medium Term: HUR operations will continue in Moscow and the Moscow region. The available data suggests stable patterns in elimination and elimination attempts in Moscow. There is moderate confidence that Bubble-3 operations will occur outside Moscow Oblast.

Long Term: The overall structure of disruptive operations in the Russian Federation will likely remain unchanged. It is almost certain that partisan cells will remain highly adaptive, operating through locally established and decentralised networks. There is high confidence that the use of IEDs will continue across the territories of the Russian Federation.

Indicators and warnings

Confirmation of a decline in IED operations against Bubble-1 targets. Key indicators include the decreasing number of reported operations in the main Telegram partisan channels.

Reporting of crackdowns on sabotage cells. Key indicators include articles from Russian media and Z-channels reporting on operations against local activists.

FSB counterterrorist operations in Moscow against HUR operatives. Key indicators include articles from Russian media and Z-channels reporting on operations against Ukrainian intelligence assets.

Addendum: Detailed Operations Log

Addendum II: IED operations

Analysis of gathered data on partisan activities in the temporarily occupied territories of Ukraine during the first half of 2026 provides key insights into disruptive operations. Processed data reveals new patterns, with a decline in assassination attempts (hit-and-run attacks and IED operations). The findings also raise the hypothesis about a crackdown on local cells and exfiltrations carried out by the Main Directorate of Intelligence of the Ministry of Defence of Ukraine (HUR) and the Security Service of Ukraine (SBU) in the occupied areas of Donetsk and Zaporizhzhia. Open-source data also indicates minimal changes within the structure of partisan networks, due to their highly adaptive nature and decentralisation. It is important to note all reported and claimed activities during the first half of 2026 were categorised into three distinct bubbles. Bubble 1 (activities targeting signal relay cabinets, locomotives, airfields, ancillary targets, substations, and other energy infrastructure), Bubble 2 (activities targeting factories, malls, and warehouses), and Bubble 3 (elimination, elimination attempts, and complex operations involving multiple layers of security and coordination among various actors). Finally, no disruptive activities have been detected in third countries during the analysed period.

Findings

1. The patterns of reported partisan activity do not match month-over-month when compared to the same period in 2025. Disruptive activities have declined since April 2026. Comment: Processed data indicates a shift in the partisan operational environment. End Comment.

2. During the first half of 2026, at least 10 partisan operations were claimed in Kherson Oblast, alongside 7 in Luhansk Oblast and 6 in Crimea. Sabotage activity in the Russian-occupied areas of Donetsk and Zaporizhzhia remains minimal. Comment: Claims of disruptive actions lacking confirmed geolocation were primarily attributable to groups active in occupied Kherson. End Comment.

3. Processed data indicates eliminations and elimination attempts (14) represent the most frequently reported type of operation in the Russian-occupied territories. Sabotage against signal relay cabinets and railway infrastructure (5) constitutes the second most common category based on available intelligence. Comment: Target dispersion continued during the first half of 2026, with 3 operations against antennas and EW assets recorded. End Comment.

4. Eliminations and elimination attempts have not been recorded since April 2026. The overall decline in claimed partisan activity is largely attributable to this halt. Comment: This trend suggests a shift in partisan operational focus, possibly linked to repressive measures by occupation authorities. End Comment.

5. Bubble 2 operations are rarely reported as part of sabotage activity in the Russian-controlled areas. Comment: This is consistent with Ukrainian tactics in these areas. End Comment.

6. No disruptive activities were claimed in third countries during the first half of 2026. Comment: The number of reported activities in third countries was low in 2025, but 5 of them occurred during the first half of 2025. End Comment.

Assessment

Available open-source intelligence suggests a shift in the partisan operational environment, evidenced by the cessation of elimination attempts since April 2026. There is moderate confidence that this pattern will remain unchanged in the coming months. These shifting patterns are raising new hypotheses about a crackdown on partisan cells, as well as exfiltration operations by the HUR and the SBU, especially in occupied Donetsk and Zaporizhzhia. Notably, assassination attempts and IED operations focused on Russian soldiers (and Chechen units) were not documented during the first half of 2026 in the Russian-occupied areas.

It is almost certain that the characteristics of partisan operations will remain unchanged during the remainder of the current year. The crackdown on Ukrainian citizens living in the occupied areas is shaping local activists’ activities through three layers of operations (Bubble 1, Bubble 2 and Bubble 3 activities) characterised by target dispersion. This trend explains the resilience of sabotage operations against railway infrastructure and antenna/EW systems.

The available information strongly indicates the operational independence of Bubble 3 operations (mostly IED and hit-and-run attacks) from Bubble 2 and Bubble 1 operations. There is high confidence that this trend will persist in the long term. Bubble 2 operations are rarely reported among sabotage activity in the occupied territories because these targets are usually destroyed by OWA-drones. It is almost certain that this trend will remain unchanged throughout 2026.

Outlook

Short Term: The decline of elimination attempts in the Russian-occupied territories constitutes the most significant shift observed during the first half of 2026. It is very likely that this trend will remain unchanged over the coming months.

Medium Term: Processed intelligence indicates with moderate confidence that notable changes in assassination and assassination attempts are expected in the medium term. The available data suggests shifts in the operational environment due to the intensified crackdown on partisan cells, as well as possible exfiltration operations by Ukrainian intelligence agencies.

Long Term: The overall structure of disruptive operations in the Russian-occupied territories will likely remain unchanged. It is almost certain that partisan cells will remain highly adaptive, operating through locally established and decentralised networks. The question of whether high-risk operations will continue to decline remains open throughout the second half of 2026.

Indicators and warnings

The absence of assassination attempts and IED operations against Russian soldiers and local collaborationists in the occupied territories during 2026. Key indicators include the publication of partisan exfiltration operations by Ukrainian media outlets and official Telegram channels of the HUR and the SBU. The publication, by Russian media outlets and Z channels, of operations against partisan cells in the occupied territories.

The lack of partisan operations against Russian assets in third countries during 2026. Key indicators include raids on intelligence personnel deployed in third countries and local reports from third countries media. Official HUR statements are a second key indicator.

Changes in Bubble 1 operations in the occupied territories during 2026. Key indicators include the publication by Russian media outlets and Z-channels of operations against local partisan cells in the occupied territories.

Reporting of disappearance and torture cases involving Chechen soldiers who were previously deployed in occupied Ukraine. Key indicators include reports from NGOs and Chechen opposition media on torture and disappearance cases of soldiers who allegedly collaborated with Ukrainian intelligence.

Addendum: Detailed Operations Log

In May 2026, Chernaya Iskra and the United Front of Resistance claimed five IED sabotage attacks against open-air facilities. Despite ongoing FSB counterterrorist operations, these decentralised partisan groups continue to demonstrate adaptability, and such attacks are expected to continue in the near term.

Findings

· Between 16 and 31 May 2026, five sabotage activities were reported on railway infrastructure and gas pipelines within the Russian Federation. All of these operations involved explosive devices. Published footage shows an unidentified explosive compound (similar to C4) and a 20-millisecond detonator. Comment. This is consistent with adaptive characteristics of partisan cells operating in Russia. End comment.

· The available information indicates the decentralised structure remains unchanged, despite a shared methodology. During May 2026, the following incidents were recorded: two gas pipelines damaged in Leningrad Oblast (Tosno and Vsevolozhsk), two rail tanks (one in Naberezhnye Chelny, Republic of Tatarstan, and one in Krasnodar, Krasnodar Krai), and one locomotive in Belgorod (Belgorod Oblast). Comment. Previously reported IED operations were minimal. End Comment.

The sabotage operations have been claimed by Chernaya Iskra (Black Spark) and Obyedinennyy Front Soprotivleniya (United Front of Resistance). Both groups routinely publicise decentralised partisan operations conducted within Russia and in temporarily occupied territories. Comment. Published information indicates these organisations act as channels for the dissemination of sabotage claims. End comment.

· The available information indicates an evolving pattern of partisan attacks targeting open-air facilities. These operations typically involve low-complexity sabotage conducted by local, non-professionalised, and clandestine cells. Comment. Clandestine cells refers to civilians with regular daytime occupations who conduct sabotage. This profile is hampering FSB efforts. End comment.

Assessment

Intelligence reporting from recent months highlights the adaptive nature of disruptive activities inside Russia, despite FSB counter-terrorist efforts. The anonymous and decentralised network of partisan groups continues to pose significant challenges for Russian authorities.

The ongoing FSB crackdown on dissent is shaping opposition activists’ behaviour, particularly in target selection and levels of technical sophistication. It is almost certain that IED sabotage attacks against open-air facilities will continue in the near term, due to the decentralised structure of these partisan groups.

Available open-source intelligence also suggests clandestine groups are improving their technical capabilities in low-intensity operations and their ability to smuggle explosives across the Russian Federation and into the temporarily occupied territories (TOT) of Ukraine. Despite these developments, the types of targets attacked remain largely unchanged.

The leadership of these partisan groups has not been officially acknowledged. Nevertheless, available information indicates such operations are conducted by individuals with no established links to Ukrainian intelligence services. The employment of explosive devices further increases the operational complexity faced by Russian authorities when dealing with sabotage cells active in both Russia and the TOT.

Indicators and warnings

FSB seizures of explosives: FSB counter-terrorist operations targeting explosives smuggling networks within the Russian Federation. Such operations could disrupt current partisan logistics, degrade their technical capabilities, and expose the entire partisan network. Key indicators include increased FSB seizures of explosives, arrests of Russian citizens linked to these networks, and a subsequent reduction in IED sabotage operations.

FSB counter-partisan raids: FSB operations targeting suspected partisan members rather than smuggling networks. These raids could reduce the operational reach and impact of partisan activities in specific geographical areas. Key indicators include arrests of Russian citizens linked to partisan groups and a noticeable decline in sabotage operations claimed on partisan Telegram channels.

Crackdown on opposition: Sustained repression of Russian opposition circles may gradually shrink the pool of available volunteers for partisan operations. Key indicators include a reduction in the frequency of such attacks without any significant increase in FSB seizures or raids on opposition networks.

Sources

Chernaya Iskra Telegram channel, post 297 (16 May 2026): t.me/chernayaiskra2/297

Chernaya Iskra Telegram channel, post 309 (23 May 2026): t.me/chernayaiskra2/309

Chernaya Iskra Telegram channel, post 326 (31 May 2026): t.me/chernayaiskra2/326

United Front of Resistance Telegram channel, post 591 (29 May 2026): t.me/united_front_of_resistance/591

Processed intelligence during the first quarter of the year indicates changing patterns in Moscow partisan operations. For a correct approach to this type of activity, partisan warfare was categorised into three different bubbles: Bubble-1 operations (partisan activities against railway infrastructure, airfields, miscellaneous facilities/targets, substations or other energy infrastructure), Bubble-2 operations (sabotage against factories, malls, and warehouses), and Bubble-3 operations (assassination and assassination attempts).

The current analysis points to an adaptive nature of Bubble-1 operations despite Russian counterterrorism tactics. Nevertheless, the decreasing number of assassination attempts suggests that FSB counterintelligence efforts may be eroding those networks — and raising operational risks — associated with Ukrainian intelligence. The decreasing number of reported partisan activities may reflect the end of a partisan activity cycle rather than the result of Russian counterintelligence pressure.

Findings

· Processed intelligence indicates Bubble-1 operations were the most prevalent in Moscow and the Moscow region during 2026. Comment. This is consistent with the characteristics of sabotage campaigns. End Comment.

· Tailored data points to evolving patterns within Bubble-1 operations. Disruptive efforts against cabinet relays and railway infrastructure have nearly vanished during 2026. Comment. Russian authorities have most probably reinforced counterintelligence and security measures against this type of activity. End Comment.

· Open-source data reflects a clear diversification of Bubble-1 operations. Comment. Partisan operations against other types of targets surged due to the Russian authorities’ crackdown on dissent following attacks against cabinet relays. End Comment.

· Bubble-2 operations remained minimal during 2026. The last possible disruptive event was an unclaimed attack at the Voskresensk Mineral Fertilizers plant on 16 January. Comment. This underscores the independence of Bubble-1 campaigns from Bubble-2 and Bubble-3 activities, as well as a shifting pattern. End Comment.

· The number of reported Bubble-3 operations also waned during 2026. The last two reported assassination attempts were carried out on 6 February (against Vladimir Alexeyev, the GRU’s deputy head) and 23 February (against two police officers parked in Butyrsky District). Comment. This trajectory suggests a shift in partisan activity with several plausible hypotheses emerging as a result. End Comment.

Assessment

Aggregated intelligence indicates shifting patterns in partisan warfare. Changes in Bubble-1 operations highlight the adaptive nature of this type of activity, which involves different layers of security and actors compared to Bubble-2 and Bubble-3 operations. Developments in Bubble-2 and Bubble-3 also point to maturing Russian counter-intelligence tactics. It is almost certain Bubble-1 operations will continue despite tightening crackdowns on dissent.

The decreasing number of Bubble-2 and Bubble-3 operations raises several hypotheses about Russian counter-intelligence measures and the design of future underground networks in Moscow and Moscow Oblast. These trends suggest clandestine campaigns are becoming more difficult to execute, with a clear impact on the pace of the intelligence cycle. A second hypothesis suggests that the current decline in Bubble-2 and Bubble-3 operations reflects the end of a partisan wave rather than a structural degradation of underground networks.

The sharp contrast between Bubble-1 and Bubble-2/Bubble-3 operations serves as further evidence of the relative autonomy of the former. This pattern was also documented in previous intelligence assessments. Each bubble requires more layers of security than the previous one, along with different types of intelligence and a greater number of steps for successful execution.

Bubble-1 operations represent low-intensity disruptive activity driven by a fragmented, decentralised structure. This type of warfare is typically carried out by ordinary people who are not connected to Ukrainian intelligence.

Indicators and warnings

1. Escalation of arrests and legal persecution of local activists: Intensified repression against local activists and dissidents could make it increasingly difficult to build and maintain underground networks capable of conducting operations against Putin’s regime.

2. Counterterrorism operations against partisans: Increasing Russian counterterrorism and counterintelligence operations against decentralised partisan cells and individuals, including Bubble-3 operations linked to Ukrainian intelligence, will undermine underground networks and raise operational risks.

3. Emigration of Russian opposition activists: Systematic persecution and forced exile of opposition figures and activists may be eroding the potential for domestic resistance. This exodus could diminish intelligence feedback from local sources while increasing the operational risks for those who remain in Russia.

In early spring 2026, the Armed Forces of Ukraine intensified an open campaign against chemical and gunpowder factories located in the Russian Federation. Processed intelligence reveals a clear wave pattern of attacks between June 2025 and April 2026. During this campaign the FP-5 “Flamingo” has been used only to a limited extent.

Since mid-June 2025, at least 29 facilities have been targeted across Russia in 47 one-way attack drone and missile strikes. A total of 9 chemical companies were attacked multiple times, especially those located in Samara Oblast (Tolyatti) and Stavropol Krai (Budyonnovsk and Nevinnomyssk). The increasing number of verified attacks against chemical and gunpowder factories has not reduced other OWA-UAV operations.

Processed intelligence also suggests this coordinated campaign is already having some effects on the civilian use of ammonia and ammonium nitrate, prompting temporary restrictions on agro exports. Analysed data indicates OWA-UAV operations against chemical and gunpowder factories are likely to continue in the coming months because of the significant rise in verified drone attacks and the degradation of Russian radars and air-defence systems.

Geospatial analysis points to certain limitations in Volgograd and Rostov Oblasts. This pattern is consistent with the presence of SHORAD and HIMAD systems located in Rostov and the temporarily occupied territories of Luhansk. Drone routes are also playing a key role in determining the targeted factories.

Findings

· Several drone and missile operations were recorded since June 2025. Processed data reflects four waves of attacks against chemical and gunpowder factories between June 2025 and April 2026. Comment. This is consistent with coordinated campaigns focused on achieving long-term effects against the Russian Army. End Comment.

· Processed information reflects an increasing number of chemical and gunpowder factories being attacked in March. Comment. Published intelligence suggests an improvement in Ukrainian capabilities and the degradation of Russian radar and air-defence systems. End Comment.

· 47 chemical and gunpowder factories have been attacked since June 2025. At least 29 facilities were attacked, while 9 chemical companies were attacked multiple times. Comment. Data indicates the Tolyatti industrial hub (Tolyatti Azot, Kuibyshev Azot, and Togliattikauchuk LLC) was targeted 8 times. End Comment.

· At the end of March, the Russian Federation introduced several new restrictions on the export of ammonium nitrate. According to the Ministry of Agriculture, the ban is aimed at “prioritising the supply of Russian farmers”. Comment. It is a temporary ban from 21 March to 21 April 2026, but its dual-use potential for military explosives should be borne in mind. End Comment.

· The geolocation of chemical and gunpowder factories targeted by OWA-UAVs and missiles largely coincides with the location of Russian industry, but geospatial analysis highlights unaffected areas. Comment. This pattern implies limitations imposed by Russian radars and SAM systems located in Rostov and occupied Luhansk Oblasts. End Comment.

· Open-source data also highlights multiple Ukrainian UAV attacks on chemical factories located in the northern Caucasus (especially Budyonnovsk and Nevinnomissk in Stavropol Krai) and along the Caspian coast. Comment. Published information demonstrates Ukrainian drones are flying over the Black Sea through western occupied Crimea, where Russian defensive capabilities have been degraded. End Comment.

· Multiple drone attacks targeted distant locations in Perm Krai and Chelyabinsk (Gubakha and Kopeysk). Comment. Initially, this campaign was led by the SBU (the Security Service of Ukraine), but the increasing number of attacks and the use of FP-5 “Flamingo” missiles suggest multiple branches and units are now involved. End Comment.

· The increasing number of verified attacks against chemical and gunpowder factories has not reduced other OWA-UAV operations. Comment. Multiple operations were carried out against critical infrastructure in Ust-Luga, Primorsk and Novorossiysk, with a sharp increase in verified drone attacks across Russia and the temporarily occupied territories. End Comment.

· Processed data supports the early fielding of the FP-5 “Flamingo” in combined operations aimed at achieving long-term strategic effects. Comment. Only one FP-5 strike was reported in Chapayevsk (Samara Oblast) against the JSC Promsintez chemical factory. End Comment.

Assessment

Processed and analysed data demonstrates a clear and sustained campaign against Russian chemical and gunpowder factories. Chemical plants are a key element for the Russian army, particularly those facilities producing explosives derived from ammonia and ammonium nitrate, such as ANFO and other explosive compounds. This visible campaign is designed to achieving long-term effects by disrupting Russian military capabilities. Short-term consequences appear minimal and are mostly focused on agro exports.

It is almost certain Ukrainian operations will continue, driven by the dual-use nature of the product (agricultural fertilisers which can also be used for explosives) and the potential negative externalities on farming productivity and explosives production. Filtered data suggests a long-term strategy.

The improvement of Ukrainian capabilities and the degradation of Russian radar and SAM systems are expected to pave the way for multiple operations. It is almost certain that combined operations will continue in the coming months. Open-source intelligence reveals several active campaigns against refineries, chemical factories, radars, and air-defence systems, with a sharp increase in reported attacks.

Geospatial analysis highlights the importance of radar and air-defence systems located in the temporarily occupied Luhansk Oblast. The lack of UAV and missile strikes reported in Rostov and Volgograd points to the importance of medium-range campaigns in this occupied area. The analysis also underscores the strategic importance of radar and air-defence degradation in occupied Crimea. This degradation has opened the door to several strikes on chemical plants located in the northern Caucasus.

Processed intelligence emphasises the early operational deployment of the FP-5 “Flamingo” cruise missile. While the number of verified strikes remains low, this indicates the use of different tools and units across multiple operations. This pattern is likely to continue unchanged.

Outlook

Short Term: OWA-UAV operations against chemical and gunpowder factories are likely to continue in the coming months. These coordinated campaigns are part of broader operations targeting refineries and other critical facilities, including military factories and pumping stations. Processed intelligence reveals a clear wave pattern and points to a long-term strategy.

Medium Term: The current campaign is seeking to disrupt the production of fertilisers and explosives. Some temporary bans on agro exports are likely to continue, while the Russian Army will exploit its gathered stocks — such as those held in GRAU ammunition depots — as it attempts to adapt to Ukrainian warfare. It is important to note the continued dependency on explosives (for artillery shells and guided bombs) and chemical weapons, even as drone warfare gains importance.

Long Term: It is almost certain that coordinated operations will continue as result of the exponential increase in verified drone attacks and the degradation of Russian radars and air-defence systems. The current campaign has a clear strategic focus on disrupting the production of explosives used by the Russian Army. It is closely linked to the improvement of Ukrainian capabilities and to future UAV campaigns against Russian SHORAD and HIMAD systems located in the temporarily occupied territories of Luhansk. Russia’s ability to increase nitrate imports remains a key factor for the long-term effectiveness of this campaign.

Indicators and warnings

1. Rising OWA-UAV strikes on critical infrastructure: Published intelligence on the increasing number of OWA-UAV strikes against critical infrastructure inside Russia may point to preparations (new waves of attacks) for future combined operations against chemical and gunpowder factories.

2. Increasing FP-5 “Flamingo” production: The growing production of FP-5 “Flamingo”, and its verified use against several targets, may indicate a readiness for full operational use due to the combination of missiles and unmanned aerial vehicles during strategic campaigns.

3. Bans on agro exports: Legal restrictions on agricultural exports (particularly ammonia and ammonium nitrate) indicate a rationing of dual-use products for the Russian Army.

4. Production halts: Temporary shutdowns after drone campaigns at chemical factories could signal long-term disruption for dual use products.

5. Operations in Rostov and occupied Luhansk Oblasts: mid-range UAV strikes against SHORAD and HIMAD systems focused on opening new corridors against chemical factories could put at risk several facilities in Rostov (Shakhtinsky Polyester Plant, previously attacked) and Volgograd (JSC Volzhsky Orgsynthese, JSC Kaustic and PJSC Khimprom).

Overnight on 1–2 March 2026, a large-scale combined attack1 was carried out on Novorossiysk port in Krasnodar Krai. The strike was a coordinated operation2 involving the “Alpha” Special Operations Center of the Security Service of Ukraine (SBU), the Main Directorate of Intelligence of the Ministry of Defence of Ukraine (HUR), the State Border Guard Service, and the Special Operations Forces (SSO).

According to published information, at least 200 UAVs (Unmanned Aerial Vehicles) and several USVs (Uncrewed Surface Vessels) were used during this multiple attack against several facilities located in Novorossiysk port.

Several intelligence channels published IMINT sources assessing damage from the combined attack in this area. Available imagery confirms Russian Black Sea Fleet vessels were damaged during this operation. On 6 March, the Ukrainian General Staff confirmed3 damage to two Russian Black Sea Fleet ships (Admiral Essen and Admiral Makarov) as a result of strikes on Novorossiysk.

Processed information clearly suggests a developed strategy aimed at isolating the Russian position in the Black Sea. This is a strategy designed for a post-conflict scenario. Analysis of processed data also supports Novorossiysk’s vulnerable position since late November 2025 attacks. Indicators and warnings are critical for understanding Russian vulnerabilities and future attacks against the Russian Black Sea Fleet.

Findings

· According to IMINT sources4, several vessels were berthed in Novorossiysk port during the night-time strike. Specialised accounts identified a Project 1241 Molniya-class corvette (Tarantul-class), a Project 12700 minesweeper and at least two Grisha-class anti-submarine corvettes (Kasimov and Yeysk). Comment. The processing of IMINT sources confirms the reliability of published information. End Comment.

· Open-source analysts also published visual evidence showing two frigates from the Black Sea Fleet harboured during the attack: the missile frigates Admiral Essen and Admiral Makarov. Both are normally homeported in Novorossiysk after being relocated from Sevastopol due to increasing Ukrainian drone attacks. The same sources also identified two Project 266-series minesweepers: the Valentin Pikul (266ME) and the Ivan Golubets (266M). Comment. The processing of IMINT sources confirms the reliability of published information. End Comment.

· Two specialised accounts (Exilenova5 and Cyber Boroshno6) updated their assessments of the vessels damaged during the attack. According to IMINT sources, the missile frigate Admiral Essen and two minesweepers (the Project 12700 class and the Project 266ME Valentin Pikul) sustained damage. The same sources also reported damage to two Project 1124M Grisha-class anti-submarine corvettes (Kasimov and Yeysk). Comment. Published imagery confirms several vessels were damaged during this combined operation. End Comment.

· Detailed information was also published7 regarding the missile frigate Admiral Essen. Open-source intelligence analysts assessed the PK-10 jamming launcher, the TK-25 electronic warfare system, the MR-90 target illumination radar, and the Fregat-M2M radar were likely damaged during the UAV attacks. Comment. IMINT sources support the damage of several boats, but it is not possible to fully verify the accuracy of published information. End Comment.

· The attack also targeted additional assets around Novorossiysk port. At least one 30N6E2 radar from an S-300 missile system and a Pantsir-S1 missile system were reportedly destroyed during the combined drone strike8.

· According to published information, six of the seven oil loading racks at the Sheskharis oil terminal (operated by Transneft and part of Novorossiysk Commercial Sea Port) were struck by drones. Comment. Sheskharis oil terminal suspended oil loadings after the attack. End Comment.

· Four launching areas were identified during this combined operation: Odesa, Kherson, Mykolaiv, and Dnipropetrovsk9. Filtered information indicates Ukraine launched attacks from three established operative areas, while Dnipropetrovsk points to a shifting trend in the southern axis. Comment. This is consistent with recently published routes. End Comment.

· Analysed data suggests Ukrainian drones are successfully evading Crimean radars and defence systems. These drones also cross the eastern part of the southern axis and reach targets located in Krasnodar Krai.

· Shifting trends in drone routes to targets in Krasnodar Krai point to the degradation of Russian capabilities (radars and air-defence systems) in the temporarily occupied territories of Zaporizhzhia.

Assessment

The large-scale combined attack carried out overnight on 1–2 March 2026 demonstrates the continuation of a focused approach to Novorossiysk port facilities, with multiple branches of the Ukrainian Armed Forces and Ukrainian intelligence agencies involved. These operations are severely disrupting critical infrastructure and military assets, such as the Caspian Pipeline Consortium (CPC), the Sheskharis Oil Harbour and the Russian Black Sea Fleet. It is highly likely that attacks against these facilities will continue during the next months.

Processed information indicates that other Novorossiysk port facilities, such as the IPP terminal and the Novorossiysk Shipyard, remained unaffected by drone and missile attacks. These installations are now in a vulnerable position due to the degradation of Russian defensive capabilities in the Crimean Peninsula and Krasnodar Krai. Future attacks are likely to target these secondary facilities.

Analysis of open-source intelligence suggests a mature strategy aimed at degradating the Russian Black Sea Fleet. Filtered data indicates it is almost certain that different branches of the Ukrainian Armed Forces and intelligence agencies will carry out a massive combined drone attack on Novorossiysk port. Several indicators and warnings are critical for understanding this strategy.

Gathered and processed data suggests Novorossiysk port remains critically vulnerable following the November 2025 attacks. Despite the damage being only partially verified, IMINT sources confirm Ukraine has crossed the Rubicon in terms of drone operations against Novorossiysk port. It is almost certain that Ukrainian operations will continue with the aim of inflicting further damage on the Russian Black Sea Fleet.

Previously published reports referred to the likely redeployment of radar and air-defence systems in the southern axis (primarily Crimea and Krasnodar Krai). Processed data indicated the Russian Army would likely redeploy these military assets. This redeployment has not yet materialised, while alternative drone routes through the temporarily occupied territories of Zaporizhzhia remain active.

It is almost certain the Armed Forces of Ukraine will launch campaigns against Russian radars and air-defence systems located in the temporarily occupied territories of Zaporizhzhia and Crimea. Recent reporting in intelligence-specialised channels anticipates the need to closely monitor events in these areas.

Outlook

Short Term: Current coordinated campaigns against radars and air-defence systems will continue in the coming months. Most of these combined operations will focus on the occupied areas of Crimea and the Zaporizhzhia Oblast. It is almost certain drone attacks on Novorossiysk port will continue due to the degradation of Russian interception capabilities.

Medium Term: The aforementioned degradation of Russian interception capabilities will open the door to a combined attack involving UAVs, USVs and missiles on Novorossiysk port aimed at damaging the Russian Black Sea Fleet. The Russian Navy will likely relocate some of its assets to other Black Sea ports. It is almost certain other key locations in the Krasnodar Krai and Crimea will sustain damage due to the worsening condition of Russian air-defence.

Long Term: It is almost certain current operations are aimed at limiting the Russian Black Sea presence and its influence in the region. Coordinated campaigns are unlikely to cease because they are focused on a post-war scenario, and this is one of the few fields where Ukraine has the upper hand. The Montreux Convention is playing an important role in limiting Russian movements in the area. This will enhance Turkey’s naval position.

Indicators and warnings

1. Missile rationing: Patterns indicating a clear restraint in the use of missiles (especially Neptune and Storm Shadow/SCALP) over a prolonged period. This could indicate preparations for a future combined attack aimed at saturating Russian air-defence systems.

2. Increasing FP-5 “Flamingo” production: Verified reports of FP-5 attacks against unrelated targets inside Russia point to increasing production of Flamingos and early successful operational use aimed at improving results in future combined operations.

3. Operations in Zaporizhzhia oblast: UAV operations against Russian radars and air-defence systems aimed at consolidating attack routes to Novorossiysk port and other targets in Krasnodar Krai and Crimea.

4. Operations in Crimea and the Black Sea: UAV operations against Russian radars (and air-defence systems) located in Crimea and on Black Sea drilling platforms.

5. Increasing numbers of USVs: The increasing number of Uncrewed Surface Vessels (USVs) may indicate the degradation of Russian interception capabilities.

6. Multiple actors involved: The involvement of HUR and SBU suggests a long-term strategy aimed at significantly degrading the Russian Black Sea Fleet and reducing its regional influence in a post-conflict scenario.

Ukraine’s summer review of partisan operations offers useful intelligence findings for anyone seeking to understand the true dimensions of sabotage and neutralisation activities in both Russia and the temporarily occupied territories of Ukraine. Previously processed information has laid the groundwork for a more accurate understanding of the multiple, decentralised operations carried out in a highly multifaceted and repressive environment. Nevertheless, the summer article presented a picture with some partiality of disruptive operations, and highlighted the critical need for accurate inputs for any intelligence analyst seeking to understand the true characteristics of partisan activities and the serious challenges facing Putin’s regime and the Russian Army as occupiers.

It is important to note that all reported and claimed activities from 2025 have been included and processed in the current analysis. The previously developed Bubble theory is applied to provide a clear understanding of subversive operations. Accordingly, three types of activities are defined. Bubble 1 (activities targeting cabinet relays, locomotives, airfields, random facilities/targets, substations, and other energy infrastructure), Bubble 2 (activities aimed at destroying factories, malls, and warehouses), and Bubble 3 (neutralisation, neutralisation attempts, and special operations involving several layers of security and multiple actors).

What is happening

The processing and analysis of data gathered throughout 2025 has provided notable information. For example, initial findings suggested partisan operations in the temporarily occupied territories and third countries were showing a curious pattern. A closer look at monthly data from January to December 2025 confirms different waves rather than continuous escalation. These waves support the hypothesis that such patterns are largely secondary effects of hit-and-run operations led by Ukrainian intelligence under Russian occupation and in a highly repressive environment. Successful execution of these disruptive activities requires a complete cycle of direction, intelligence gathering, processing, and analysis. This structured approach underscores Russian counterinsurgency efforts (usually presented as “counterterrorism”) are failing to achieve results in the occupied territories.

Analysis of data on partisan and sabotage activity inside the Russian Federation exposes sharp growth during 2025. The main hypothesis could not be clearer: units countering sabotage and targeted elliminations (the FSB Second Service) are proving largely ineffective -likely because they are primarily accustomed to cracking down on domestic political dissent- while most sabotage operations remain highly decentralised across Russian territory and extremely adaptive. As a result, they are placing considerable strain on Putin’s regime capabilities.

The table of partisan operations by bubble illustrated patterns explained in my previous article. Although it’s not a perfect way to tailoring data, it illustrates the characteristics of disruptive operations in Russia, in the temporarily occupied territories of Ukraine, and in third countries. It is noteworthy that at least 24 Bubble-3 attacks reported were carried out during the Spiderweb operation, while the others consist of neutralisation and neutralisation attempts. Consequently, the number of neutralisations in the temporarily occupied territories is significantly higher than those carried out in Russia.

Another key finding relates to Bubble-2 sabotage activities in the temporarily occupied territories of Ukraine. These reported activities are minimal in comparison with those conducted in the territory of the Russian Federation. It is worth noting most reported Bubble-2 operations involve sabotage against warehouses. Thus, the nature of targeted Bubble-2 targets (factories, malls, warehouses, and other secured and guarded installations) varies according to their location.

Usually, most partisan operations against warehouses located inside Russia target suppliers to the Russian military —excluding those fires whose nature could not be verified as sabotage. By contrast, the same type of disruptive activities against warehouses located in the temporarily occupied territories of Ukraine primarily target logistical assets clearly linked to frontline areas. This explains two key things: the lower number of reported Bubble-2 activities in the occupied territories, and the high frequency of drone attacks reported against warehouses throughout the territories occupied by Russia. It is important to note that safeguarding HUMINT sources should always be prioritised in order to avoid exposing partisan cells in the occupied areas. Consequently, intelligence gathering carried out by partisans is almost invisible, but is providing important results in other fields.

Processed information also shows Bubble-1 activities constitute the main sabotage operations carried out inside Russia. These reported activities focus on cabinet relays and antennas. A stark contrast is also evident in our analysis, particularly between Bubble-1 and Bubble-3 operations. The latter, characterised by their complexity, are mainly carried out by the Main Directorate of Intelligence of the Ministry of Defence of Ukraine (HUR) and not by locally established cells.

The high number of neutralisations and neutralisation attempts reported during the last year (52 in 2025) provides clear evidence of HUR’s penetration deep into the occupied territories. This is a notable contrast in comparison to the same type of activities carried out in Russia. Secondarily, this trend offers another intelligence insight: the relative independence of Bubble-1 operations (sabotage actions carried out by locally established cells in a decentralised manner). Tailored data also highlights the pronounced contrast in Bubble-2 activities between the occupied territories and Russia. Reported operations against secured installations and critical infrastructure are minimal when compared with those carried out in Russia.

Processed information exposes a major challenge for Russia both as an occupier and as a country: with 30 neutralisations and neutralisation attempts, Russian authorities have been unable to halt HUR operations, while they face the same difficulties with independent cells conducting most of the typical sabotage operations against cabinet relays and antennas (with minimal damage to EW and defence systems) across Russian territory.

A close analysis of partisan activities carried out in the temporarily occupied territories of Ukraine and in third countries highlights several active campaigns developed during 2025. The first -and most prominent- is the ongoing campaign against tankers linked to the Russian shadow fleet. Other patterns emerged during the analysis, involving vessels that operated at Novorossiysk port or belonged to the Russian Navy. The clearest examples include the incidents reported involving the Seacharm, the Kildin-class destroyer, the Seajewel oil tanker, the Grace Ferrum chemical tanker, and others. During this campaign, Russian oil shadow fleet companies were clearly identified by OSINT analysts.

Filtered data from 2025 indicates the 70th Guards Motorized Rifle Regiment (headquartered in the Chechen city of Shali) suffered multiple Bubble-3 attacks. At least nine neutralisations or neutralisation attempts against Chechen targets were clearly identified during the year. As previously noted last summer, these units are deployed without establishing territorial control. At the same time, Chechnya remains a stateless nation, and some units are suffering partisan attacks, raising the hypothesis this stems from information leaked by personnel deployed against their will. This regiment is experiencing targeted elliminations from HUR while also engaging in illegal activities. Other units (such as Akhmat Vostok) are facing the same problems. Thus, the pattern is evident.

Processed data also reveals several neutralisation operations. For example, hit and run activities against patrolling units moving through the occupied territories are a common trend. The same pattern applies to operations aimed at neutralising individuals (such as Yevgeny Bogdanov, Manolis Pilavov, Mikhail Gritsay, and other collaborationists killed in August) who were working with the Russian authorities. This type of operation highlights Russian vulnerabilities as occupiers and the low acceptance among the local population.

It is important to note a clear pattern exists in both Russia and the occupied territories: targeted elimination attempts against people involved in Russian war crimes or the Russian military industry. The clearest examples include activities against the 76th Airborne Assault Division of the Russian Armed Forces (involved in Bucha war crimes) and the neutralisation/neutralisation attempts of Konstantin Nagayko, Armen Sargsyan, Yevgeny Rytikov, Andrey Kondratiev, and Zaur Gurtsev.

Specialized operations, such as the one targeting several FPV drone operators who were injured after IEDs hidden in goggles detonated in June, demonstrate two coexisting realities: Ukraine’s capability to develop the most complex activities under a highly repressive environment and a multi-pronged focus.

The high number of cabinet relays destroyed in the temporarily occupied territories confirms the independence of Bubble-1 activities from the more complex targeted elimination operations carried out by the HUR. Finally, regarding the only partisan operation reported in Belarus, I’m skeptical about the fire reported at the Naftan oil refinery in Navapolatsk (11 June 2025). It was reported as a possible disruptive operation, but evidence suggests it was simply a fire.

Tailored data on sabotage operations in Russia exposes a different environment from those activities carried out in the temporarily occupied territories. Bubble-1 operations (disruptive actions against cabinet relays and antennas) were the most typical reported actions and showed notable growth during 2025, with a sharp increase in November and December.

As noted earlier, a campaign against war criminals and people involved in the Russian military industry was identified, but other patterns emerged during 2025. For example, a second campaign targeted chemical and gunpowder factories (such as the Limpek chemical factory, the Perm gunpowder factory, or the “Elastic” gunpowder factory in Lesnoy) and a third targeted companies linked to the Russian Army —including the UralAZ MRAPs factory, the Onega Shipbuilding Plant, the APZ-20 bearing factory in Kursk, the Avangard defence plant in Saint Petersburg, the Zarya plant in Dzerzhinsk, and others.

I have doubts about classifying some partisan activities, such as the destruction of two “Zhitel” systems —Russian EW complexes— at the Protek plant (27 January 2025), or the two radars destroyed in Dolgoprudny (6 February 2025). Both appear to be HUR operations that could be classified as Bubble-3 sabotages due to the complexity and multiple actors and sources of intelligence involved.

I choose to retain some reported fires on warehouses despite limited information. Several warehouse fires have been reported or shared on social media without adequate verification. For the same reason, the fire reported at Pravoberezhny Market (December 10, 2025) should be excluded from the analysis. The conclusions would remain unchanged if the ten dubious Bubble-2 attacks (nine on warehouses and one market) were excluded. Typically (based on the most filtered and verified data), those reported fires involved supply providers to the Russian Army.

Analysed data also confirms Moscow constitutes an independent bubble, especially when it comes to neutralisation and neutralisation attempts. At least 10 neutralisation/neutralisation attempts were reported in 2025. For additional context, I published another article, but neutralisation attempts are generally minimal outside Moscow, while the most typical partisan activities target cabinet relays and antennas. Analysed data also confirms Bubble-1 operations remain independent from other Russian regions. At this point, we can conclude the FSB is facing considerable problems in Moscow: they have been unable to prevent most targeted elimination operations and the most simple and independent cells destroying cabinet relays and antennas.

The FSB’s Second Service is facing same difficulties in stopping independent cells operating across Russia. As demonstrated in the previous article, gathered and tailored data on partisan operations —classified according to their level of complexity— illustrate several campaigns, Russian vulnerabilities, and characteristics of partisan warfare adapted to the reality on the ground. The different types of partisan bubbles are operating independently and are highly adaptive.

The graph of partisan activities by region reveals some interesting patterns. For example, Zaporizhzhia and Kherson lead the number of reported operations. This is unsurprising when we consider Crimea and parts of Donetsk and Luhansk have been occupied for over a decade. As a result, Putin’s regime has had considerably more time to suppress Ukrainian dissidence, while HUMINT sources have primarily supported other types of operations (such as gathering information for future drone attacks).

Analysing partisan operations by region is essential —at least if we want to understand the real scope of partisan activity inside Russia. The filtered data highlights five major areas of disruptive operations. The most active regions are Moscow, Saint Petersburg (and Leningrad Oblast), Sverdlovsk, Rostov, and Stavropol Krai. In the remaining oblasts, a pattern of decentralised operations emerges, primarily targeting railway infrastructure and antennas.

CONCLUSIONS

2025 has generated intelligence insights about the nature of disruptive operations carried out in Russia, the temporarily occupied territories, and third countries. Processed data indicates that partisan operations are geographically dispersed and highly adaptive. At the same time, the analysis of the most complex operations led by Ukrainian intelligence demonstrates multiple campaigns against various targets linked to the Russian army and Putin’s regime.

Bubble theory is useful for understanding the real scale of partisan operations and the importance (and independence) of Bubble-1 operations (typically aimed at destroying cabinet relays and antennas) in both Russia and the occupied territories. It is almost certain that this type of activity will continue undisturbed during 2026. The FSB Second Service has proven ineffective at pursuing locally established cells.

The nature of Bubble-3 and Bubble-2 activities highlights a high level of focus and multiple sources of intelligence involved in the most complex campaigns carried out by the Main Directorate of Intelligence of the Ministry of Defence of Ukraine (HUR). It is very likely that these operations will continue during the coming months.

Finally, the analysis of Bubble-3 operations demonstrates an ongoing campaign against Kadyrovite units and, in particular, the 70th Guards Motorized Rifle Regiment. This pattern was identified during last summer’s partisan analysis and has since expanded to other units such as Akhmat Vostok. Pattern analysis also uncovers the high level of Ukrainian intelligence capability in surveilling illegal activities in which these units are involved. This indicates that Chechen soldiers may be cooperating with various branches of Ukrainian intelligence.

The current article examines the impact of partisan activities in Moscow and the Moscow Oblast. The previously published article (August 2025) presented only partial findings. Now, thanks to completed research spanning 2024 and 2025, this study offers useful intelligence insights. The final results demonstrate that conventional partisan cells conduct sabotage operations in a reactive and adaptive way, while those focused on neutralization and neutralization attempts remained largely unaffected and operational throughout the analysed period. In other words: FSB antiterrorist operations have proven largely ineffective.

Background

Previously processed information laid the groundwork for useful intelligence insights, from which several hypotheses have been drawn. Partially recovered information (the first article was published in August 2025) lacked important data, making it mandatory to complete the analysis through the end of the year for those seeking useful intelligence about sabotage and neutralization operations in Moscow. Reading the first article is strongly recommended.

Thanks to the first published article, it’s clear a three-bubble structure is currently operating in Moscow and the Moscow region. Every bubble requires more layers of security than the previous one, with different types of intelligence required and more actions needed for their fulfilment.

The summer of 2025 finished with a slight decline in Bubble-1 (railway infrastructure, antennas, airfields and open-air facilities) and Bubble-2 (factories, malls, and all types of warehouses) activities. At the same time Bubble-3 activities (classical neutralization attempts) remained active. Thanks to this intelligence, it became clear the FSB “antiterrorist” campaigns had negative effects on partisan cells while neutralization operations remained largely unaffected. The following analysis will show some interesting changes regarding the adaptive nature of Bubble-1 and Bubble-2 operations.

What is happening

Data partially collected in 2023 and 2025 provide a partial picture of the true scope of partisan operations in Moscow and the surrounding areas. Intelligence processed during 2024 was the starting point and, thanks to completing the information gathered during 2025, several important insights have emerged. Most notably, neutralization attempts continued throughout the year.

The collected information also reveals different success among partisan cells conducting the most difficult operations inside Russia, and more specifically in Moscow. The main hypothesis about the existence of “partisan bubbles” classified according to their level of complexity has been confirmed. At the same time, most Bubble-3 partisan operations (neutralization attempts) suggest this type of disruptive activity is carried out by volunteers who are not linked to current sabotage cells. In other words, these are people motivated to carry out more risky operations despite their lack of experience in this domain. This hypothesis offers a plausible explanation for the varying outcomes of neutralization attempts.

Intelligence analysed during the last months reveals the true scope of partisan operations in 2025, but one should bear in mind the conclusions developed in our previous article published a few months ago. Some suspicious activities (like Anton Egotsev’s assassination or the “incident” involving an FSB member killed after an explosion in a shopping mall near the Lubyanka building) are currently in a grey area. It is worth noting information published on Russian Telegram channels was “mysteriously” deleted due to alleged “doxxing”.

Current research clearly shows the sustained readiness of Bubble-3 operations despite FSB attempts to suppress any type of sabotage or neutralization attempt. At the same time, Bubble-1 (the most established partisan cell) activities are not linked to Bubble-3. The patterns are clear over time, and their “wave-like nature” is perfectly exemplified in the graphs.

The slight decrease in Bubble-1 operations during 2025 is more or less clear if we categorize the attacked targets: this type of operation diminished in open-air facilities (airfields and railway infrastructure) where security was strengthened after the first waves of sabotage operations. During the same analysis period other Bubble-1 targets (antennas, garages, etc) rose due to the adaptive nature of partisan cells.

Filtered information shows Bubble-2 activities dropped in factories but expanded in warehouses. It’s important to consider HUMINT is probably more necessary for achieving this type of disruptive operation. Processed data shows Bubble-1 and Bubble-2 operations are clearly reactive to FSB countermeasures, while Bubble-3 operations have intensified their complexity despite an overall decrease in volume. The latter are currently more sophisticated.

If we segment data between sabotage activities and neutralizations (and neutralization attempts) we see clear patterns provide useful intelligence insights: In 2025, Bubble-3 activities remained consistent, while Bubble-1 and Bubble-2 showed waves. It should be noted most of the partisan operations need a process of gathering intelligence, designing future activities, and acquiring the necessary materials while attempting to evade the Putin regime’s radar.

Conclusions

Several conclusions can be drawn after analysing the processed data from 2024 and 2025. The strengthening of open-air facilities (mainly railway infrastructure and airfields) underscores the resilience of clandestine cells currently operating in Moscow and the surrounding areas, as evidenced by their shift towards new targets being attacked. Bubble-1 and Bubble-2 sabotage operations are clearly reactive to the crackdown on dissent and counterterrorist operations conducted primarily by the FSB.

It’s important to bear in mind the highly adaptive nature of Bubble-1 and Bubble-2 activities. This explains their relatively passive posture and is perfectly understandable for any sabotage group operating under an oppressive dictatorship. By contrast, Bubble-3 operations are not shaped by this reactivity and remain consistent (and active) amid most conventional partisan operations and their waves.

Putin’s regime is not only facing problems in stopping conventional elimination tactics on its own soil: FSB counterintelligence has proven ineffective in halting any type of disruptive activity in Russia’s capital. While 2025 ended with fewer neutralization attempts, those which occurred were more dangerous due to increased complexity and depth.

The tri-border area between Belarus, Ukraine, and Russia gained particular interest in late 2025. Processed intelligence and published information clearly indicate this area will receive special attention in the coming months, especially in the first weeks of 2026.

In late December, several sources published information about the use of civilian infrastructure in Belarus in support of Russian attacks aimed at damaging/destroying civilian targets located in western Ukraine.

The non-stop shelling of Ukraine’s bordering towns in Chernihiv Oblast has prompted a 30-day mandatory evacuation in this area. Several patterns indicate Ukraine will increase operations in this area, especially along the A-240 / M-10 road and their nearby railway infrastructure.

Key Judgements

· On 25 December a Ukrainian specialized channel published unverified information that a SIM card from Belarus was used during a Shahed drone attack targeting a civilian train in Zhytomyr Oblast.

· On 26 December sources published information regarding the use of Belarusian infrastructure during Russian attacks against Ukraine. Published information clearly indicated that antennas and other necessary equipment used to guide Shahed drone attacks toward western Ukraine are located on the roofs of ordinary multi-story residential buildings.

· On 30 December the Ukrainian Defence Council ordered a mandatory evacuation of 14 settlements located in Chernihiv Oblast. The reason behind this decision was the non-stop shelling attacks carried out by the Russian Army. This planned evacuation must be completed in 30 days.

Assessment

The Russian-aligned position of Belarus could spark the current tri-border disruptive operations against targets located in Belarus, especially those located in Homyel Oblast or those which have clear links to Russian operations against Ukrainian infrastructure. It’s highly likely that Lukashenka regime will try to dismiss and minimize any published proof.

Processed information showed evacuations are focused on two areas (around Horodnia and Snovsk through the P-13 and T-2512 roads, and around Semenivka and Novhorod-Siverskyi through P-65 and P-12 roads). It is almost certain Russian FPV drone attacks against civilians will intensify Ukrainian disruptive operations along the tri-border area. The A-240 / M-10 road and the railway infrastructure connecting Belarus and Russia have attracted heightened interest.

Outlook

Short Term: Evacuation of bordering areas will continue throughout January 2026. It’s almost certain that Ukrainian operations against cell towers, gas stations, substations, Russian border posts, and drone operators will continue along the Bryansk border areas if Russian operations do not cease.

Medium Term: The use of Belarusian SIM cards and cell towers, as well as Belarusian infrastructure, could provoke attacks on Belarusian targets and locations used by the Russian Army. There is a low-to-moderate risk of attacks against cell towers and substations located in Homyel Oblast.

Long Term: It is almost certain that Ukrainian operations aimed at degrading Russian capabilities in this area will continue due to the constant threat of possible incursions. The tri-border area will gain importance if Russia decides to attack targets located in the border region between Ukraine and Poland.

Indicators and warnings

1. Movements of military columns: armoured and light columns of Russian military vehicles moving along roads in Russia and Belarus.

2. Increasing use of UAVs via Belarusian cell towers: Use of Belarusian assets aimed at guiding attacks on targets located in the bordering areas between Ukraine and Poland.

3. Civilian evacuations: Evacuation of towns and settlements near the border between Belarus and Russia – mainly in Chernihiv and Sumy oblasts.

4. Increasing Russian FPV and shelling attacks on bordering villages: Particular focus on targeting mobile phone antennas, petrol stations, and electrical substations.

5. New cross-border incursions: Russian attempts to carry out limited incursions into Ukrainian territory, aimed at pressuring Ukraine due to the lack of Russian strategic gains.

6. Intelligence leaks in media: Publications revealing the use of Belarusian infrastructure during Russian attacks against Ukraine.

Analysis of processed intelligence from January 1, 2024 to November 30, 2025 reveals key changing trends. The non-stop destruction of radars along the southern axis, as evident in the increasing number of reported attacks between 2024 and 2025, makes Novorossiysk port more vulnerable. It is almost mandatory to read the Intelligence Assessment 1/25 for a better understanding of the current events in this area.

Raw filtered data on Novorossiysk reveal a changing trend since last summer, exemplified by a sharp increase in reported attacks and operations in the city. Following mid-December underwater drone operation, the Russian Army will strengthen security measures at the attacked facilities, but the degradation of Crimean radars and air-defence systems opens the door to future operations in Krasnodar Krai.

Tailored open-source intelligence reveals a special focus on Novorossiysk Bay, combining drone attacks, surface/underwater drone attacks, and missile attacks with the aim to damage and destroy port facilities (especially those used for fuel exportation and those harbouring the Russian Black Sea Fleet). Current trends emerging from the ongoing research point out that this specialized focus will not change.

Finally, technological innovation and geography play a key role in these changing trends at Novorossiysk facilities. The ongoing deterioration of the air-defence radar network and Russia’s limited defence capabilities would have only minor consequences without the influence of these two factors.

Key judgements

· Processed open-source intelligence indicates an increasing number of reported attacks on Novorossiysk port (from 2 to 22 verified attacks) between January 1, 2024, and November 30, 2025.

· The same OSINT data reveals an increasing trend in reported attacks during summer and especially from late November. This increasing number involves missiles, drones and surface drones.

· Analysed intelligence reveals a focused approach to Novorossiysk facilities, with multiple branches of the Ukrainian Armed Forces and Ukrainian intelligence agencies working closely together.

· The changing trends in Novorossiysk port and its inner facilities can’t be understood without keeping in mind the key judgments published in the 1/25 intelligence assessment.

· The destruction of integrated air defence systems in Crimea, as well as the destruction of multiple S-400 launchers in late November in Novorossiysk, has consequences for the analysed area.

Assessment

Analysis of open-source intelligence between January 1, 2024, and November 30, 2025, shows the consequences of radar destruction in Crimea. Additionally, the destruction of the air-defence system is another element that should be prioritised in any analysis of Russian defensive capabilities. A deep and tailored analysis of Crimea is mandatory for a better understanding of any events that have taken place in Novorossiysk Bay.

Putin’s regime has no alternatives to the Novorossiysk port, and the entire fleet is trapped and heavily dependent on the degradation of Russian defences (with its main elements previously mentioned) and the evolution of Ukrainian capabilities through the use of new drones, surface drones, and missiles. At this point, it is almost certain that the current attacks on the Russian Black Sea Fleet will continue.

It is almost certain that strikes on Novorossiysk port facilities will continue. Ongoing trends in both Crimea and Novorossiysk indicate a non-stop degradation of radars and air-defence systems along the southern axis. Analysed intelligence proves that multiple attacks carried out in November were a turning point in the analysed area. Current operations, mainly focused on the Caspian Pipeline Consortium and the Russian Black Sea Fleet, will continue and it is highly likely that other infrastructures (like the Sheskharis Oil Harbour, the Novorossiysk Shipyard, and the IPP terminal) will be attacked due to the downgrade of Russian defence capabilities.

The Russian Army will likely redeploy radars and air-defence systems currently located in other areas in order to mitigate the consequences of last month’s strikes. It is almost certain that port facilities will be enhanced in an effort to minimize the potential damage from surface/underwater drone incursions.

Forecast

The Russian Black Sea Fleet is trapped in Novorossiysk due to the degradation of Russian capabilities -and Ukrainian military innovation. At the same time, geography is a second, but equally significant reason for this situation. Thanks to open source intelligence processed, it is clear that attacks on radars and air-defence systems located in Crimea are having effects in the Krasnodar Krai, especially with the increasing combined attacks in Novorossiysk Bay.

Analysis of tailored and raw gathered data indicates that these combined attacks will continue in Novorossiysk, especially those targeting the Russian Black Sea Fleet. It is almost certain that Russian authorities will enhance protections against surface/underwater drone attacks. The different wings of the Ukrainian intelligence (mainly the HUR and the SBU), as well as the Ukrainian Armed Forces (generally the Unmanned Systems Forces and the Special Operations Forces), will take advantage of this vulnerability once a window of opportunity is open in the analyzed area.

The ongoing deterioration of the air-defence radar network along the southern axis jeopardizes the Caspian Pipeline Consortium, the Russian Black Sea Fleet and other strategic assets located in Novorossiysk. Among them are the Sheskharis Oil Harbour, the Novorossiysk Shipyard, and other assets linked to the IPP and Transneft. It is almost certain that strikes on secondary targets will be reported during the next three months.

It is worth noting that these radars are critical for early warning against drones and surface drones, as well as missiles aimed at the Russian-occupied peninsula and other places located in the southern axis. At this point, any attack against targets located in Krasnodar Krai must bypass the occupied peninsula. We should keep in mind that Krasnodar Krai ports serves as a gathering point for an important portion of the Russian Black Sea fleet and for other targets of strategic value. Our ongoing research on the Crimea attacks shows that the number of radars destroyed increased in 2025, while changes in the number of air-defence batteries destroyed remained relatively stable.

Raw filtered data shows that the current campaign targeting radars on the Crimean Peninsula started last January and intensified from spring through summer 2025. Our open-source analysis clearly demonstrates that these attacks strongly correlate with subsequent attacks on Krasnodar Krai. Since the spring of 2025, verified attacks surged one month later after successful attacks on radar and air-defence systems located in Crimea.

The progressive downgrading of Russian interception capabilities (radars and air-defence batteries) on Crimea – which has escalated since spring 2025– opened the door for future attacks on Krasnodar Krai. Current trends suggest that the Russian Black Sea Fleet are now highly vulnerable to further Ukrainian attacks. For this reason, updates in Novorossiysk must be closely monitored for a correct evaluation of drone attacks, surface drone attacks, and missile attacks against strategic targets.

Key Judgements

· OSINT analysis shows that the number of air-defence systems destroyed in occupied Crimea was similar between 2024 and 2025, with a marginal increase from 23 to 29 of these destroyed systems. The current research reveals the quantity of radars (22) and air-defence systems (23) destroyed in 2024 was similar. The same evidence from 2025 suggested a Ukrainian campaign against radars located on the peninsula.

· OSINT analysis indicates that the number of radars destroyed in the Crimean Peninsula increased significantly between 2024 and 2025, from 22 to 96 destroyed radars in the occupied territory.

· The number of confirmed missile attacks in Krasnodar Krai increased from 4 to 15 between 2024 and 2025. During the same analysed period the number of confirmed drones and surface drone attacks doubled from 44 to 93.

· The comparison between attacks against radars and air-defence systems located in Crimea and drone attacks and strikes in Krasnodar Krai is correlational. The cumulative number of confirmed attacks showed that the number of attacks in Krasnodar Krai increased after a rise in the verified destruction of radars and batteries in occupied Crimea.

· The number of destroyed assets in Crimea increased from the beginning of 2025. Filtered intelligence suggested the destruction of radars and batteries in Crimea is paving the way for more attacks in Krasnodar Krai.

Assessment

Gathered and analysed data from 2024 and 2025 suggested that the Ukrainian Armed Forces are carrying out a focused campaign against radars located in Crimea. Tailored raw data confirmed this hypothesis after analysing the air-defence batteries destroyed in the occupied peninsula during both years. The total number of destroyed radars is sharply increasing in the southern axis; this has enabled a rise in drone attacks and strikes in Krasnodar Krai. At the same time, the number of destroyed air-defence batteries has remained largely stable.

It is almost certain that the ongoing campaign focused on Crimea will continue because the downgrading of Russia’s capabilities has paved the way for last year’s attacks in Krasnodar Krai. At this point, the destruction of these radars is almost mandatory for successful drone and surface drone attacks, as well as for missile strikes. Radars are key to intercepting all of them.

An important portion of the Russian Black Sea Fleet is currently harboured at Novorossiysk port after leaving Crimean ports. The current degradation of interception capabilities (i.e. radars and air-defence batteries) in the occupied peninsula is placing the Russian Black Sea Fleet in a highly vulnerable position.

Forecast

Current trends suggest that it’s almost certain that drone attacks against radars and air-defence batteries will continue in the near future, both in Crimea and in the Krasnodar Krai. At this point, a focused analysis of Novorossiysk and its surrounding area will be required.

It’s almost certain that Ukraine will carry out attacks on Novorossiysk, mainly against the port and the CPC (the Caspian Pipeline Consortium) facilities. It’s highly likely that the ongoing non-stop campaign against Russian radars located in Crimea will open the door for attacks on the Russian Black Sea Fleet in Novorossiysk. We should keep in mind that this area is more heavily protected than the CPC port infrastructure.

FPV drone operations and partisan activities in the southern Bryansk area increased exponentially since late summer 2025. Gathered data since the beginning of the year suggested that Ukraine’s position has evolved into an offensive stance, although initial operations were aimed at disrupting Russian logistics and halting possible incursions. It’s highly unlikely that Ukraine will carry out deep incursions into Russian territory near the tri-border, but the increasing number of reported attacks proved that Putin’s regime is facing a worsening scenario. Gathered data confirmed a multi-layered approach with active operations by partisan cells, the Main Directorate of Intelligence of the Ministry of Defense of Ukraine (HUR), the Unmanned Systems Forces (USF), the Special Operations Forces of the Armed Forces of Ukraine (SOF), and the Security Service of Ukraine (SBU) in this region. Mapped and tailored data clearly showed that disruptive operations are increasing along the A-240 road, most notably from Pogar to the south and west directions.

Background

The Armed Forces of Ukraine carried out several incursions in Bryansk, as well as in other areas like Belgorod and Kursk, since 2023. The latest offensive operation in Kursk was characterised by a chaotic withdrawal from Russian territory due to the obvious degradation of Ukrainian positions. Gathered data over the last few months show that drone attacks and clandestine operations are sharply rising in the tri-border area despite Ukraine’s overall defensive stance.

The tri-border area is a strategic region between Belarus, Ukraine and the Russian Federation. The area encompasses the eastern part of Homyel oblast (Belarus), the northern and eastern parts of Chernihiv and Sumy oblasts (Ukraine), and the southern parts of Bryansk oblast (Russia). Since the beginning of 2025, Ukraine has intensified various operations aimed at damaging Russian logistics, thwarting possible mechanized incursions, and diverting human resources deployed from other frontline areas.

The tri-border area between Ukraine, Belarus, and Russia has a trapezoid shape on a map. Analysts usually recognise this area by the New Yurkovichi border crossing in the western part of the analysed territory, the A-240/M-10 international road (the Bryansk – Homyel axis), and the Troebortne border crossing. The proliferating number of FPV drone operations has evolved into a dangerous scenario and has disrupted daily operations for the Russian army and Russian security forces.

What is happening

Recent attacks heavily damaged key Russian (and Belarusian) infrastructure along the tri-border region. Analysed data confirm that the damaged targets are not only focused on operational issues but also have clearly strategic consequences. The clearest examples were the recent attacks on the Naitopovichi pumping station, which hampered the mutual energy dependence between Russia and Belarus through the Druzhba pipeline.

Collected intelligence since the beginning of the current year suggested an exponential growth of operations along the tri-border area. Several patterns designed to avoid Russian incursions are well evidenced in the current analysis, as is a potentially dangerous scenario for the Russian army due to its limited capabilities. At this point, both Ukraine and Russia have no chance of driving in deep offensives, but Ukraine has the upper hand in carrying out disruptive operations along the border.

I created this map for a better interpretation of the current events along the tri-border.

Border crossings

It’s important to understand that there are several border crossings between Ukraine, Russia, and Belarus -one of them at the tripoint. Since 24 February 2022 all the vehicle, train and pedestrian border crossings remained closed along the analysed area. Previously, FSB Border Service personnel were stationed for obvious reasons. However, after the closures, these facilities were repurposed as drone operation posts, command posts, and supply points for Russian units trying to make incursions, sabotage actions and reconnaissance missions into Ukraine. When we analyse such facilities, we must recognise that they represent a clear threat to Ukraine.

Compiled evidence showed that since last February the Ukrainian Armed Forces carried out at least 7 attacks on border crossings. Troebortne, Pogar, and Belaya were attacked twice, with most of these types of attacks being launched in winter but continuing through summer. OSINT sources also show that the Russians are using these facilities despite the high level of damage because they are useful as coordination points. It’s important to attack such type of buildings because they are mandatory to use them in case of fast movements (and subversive activities) towards Ukrainian territory. For the same reason, these facilities should be destroyed if the goal is to enable fast, open, and mechanized movements. You can operate effectively if you blind the enemy.

Factories

During 2025 the Armed Forces of Ukraine (and most probably the Unmanned Systems Forces) carried out at least two attacks on Russian facilities in Bryansk. The first one was an attack against JSC “Konservsushprod in Starodub, while the second one was against the JSC “Karachevsky Plant Electrodetal”. Both attacks must be followed closely if we want to provide useful intelligence insights. For example, the attack against JSC “Konservsushprod” was aimed a factory that usually makes dry rations for the Russian army, while the Electrodetal plant was used for producing electronic equipment and is located in the eastern part of the map. The second attack (located in Vishnevka, in the eastern area of the map) is probably un-linked to the triple border events and has clear ties with strategic campaigns focused on weakening the eastern axis. For this reason, it’s mandatory to analyse every single target and geolocate it on a map. The gathered data showed clearly that most of the attacks and disruptive operations were carried out from Pogar to the west, between areas close to the A-240 road and the Ukrainian border.

Roads and transportation

Drone attacks and disruptive operations against roads and transportation provided a clearer picture of the tripoint operational area. These operations are the main headache for the Russian army. The destruction of the Vygonichsky Bridge at the beginning of the summer was a big problem for Russian logistics because this attack halted railway transportation between Bryansk and Potxep. At the same time, it was a big problem for railway and road transportation from Homyel to Bryansk, especially for fuel and cargo transportation through the M-10/A-240 axis. The partisan operation on the Unecha-Zhecha section in Bryansk also disrupted railway Russian logistics and temporarily “isolated” Starodub as a logistical hub. Both attacks demonstrated the Ukrainian ability to cross the border and carry out sabotage actions using a large quantity of explosives -thereby disrupting Russian logistics through a Bubble-2 operation.

Finally, the FPV drone attack on Rudnya Tsata (just in the western part of the analysed area) provided useful information because this bridge was connecting the Novye Yurkovichi border post to the A-240 road via Klimovo. This is a typical operation to conduct if you aim to prevent offensive movements from the enemy. We should remember that the Russians placed TM-62 mines under the bridge, which further proves that the Russian army distrusted Ukrainian intentions. It’s important to note that this sabotage was carried out one and a half month before the Belarusian – Russian joint strategic military exercise, also known as the Zapad exercises.

Aftermath of Vygonichsky bridge collapsing on 5/31/25.

Random attacks

At the end of October, the Russian Army’s unpreparedness around Bryansk’s borderland areas was critical. The number of attacks on strategic targets in this area was growing exponentially, along with FPV drone operations. On the 28^th of October pro-Russian channels published messages directing soldiers to wear civilian clothing in Bryansk —in a clear violation of the Geneva Conventions—after several unmanned aerial vehicle attacks were reported in Pogar.

The table summarizing the number of attacks revealed patterns that should be analyzed on a map for clearer interpretation. The attack on two soldiers in Brovnichi, and a second one on the Klimovo police station, demonstrated the Ukrainian capability for surveillance of any movement across the border. The lack of EW equipment gives Ukraine the upper hand.

Energy infrastructure

The attacks against energy infrastructure should be tailored for a proper analysis. At this point, the several and multiple drone attacks against the Naitopovichi pumping station have had long-term effects on the Russian energy system. This pumping station was used to transport refined fuel from Belarus to Russia and is clearly linked to the ongoing drone strike campaign targeting refineries and pumping stations.

Mapped and compiled data also revealed that the attacks against Bryansk substations were carried out along the A-240 road to the south. These attacks are disrupting the daily operations of the military and security forces alongside the tri-border. Both missiles and drones are used during these types of operations. Gathered data also reveals that Klimovo is an area of interest for all types of actions. Given the plurality of attacks and partisan operations it’s obvious that multiple Ukrainian units are involved in this operational area.

Communications

Finally, the partisan attacks against antennas showed that most of the partisan activities around the triple border are Bubble-2 operations -probably made through SOF incursions from Ukraine. There are only two Bubble-1 operations carried out during the last year and both were registered at the end of October against antennas.

Conclusions

Processed intelligence since the beginning of the year has provided several insights that should be properly explained and developed. The attacks on border crossings are aimed at blinding the Russian army, preventing infiltrations, sabotage operations and possible “offensive” movements like the ones that are currently taking place in Vovchansk (Kharkiv oblast). Any Russian presence in border facilities is a clear threat and an attempt to coordinate attacks on Ukrainian territory.

Initially, Ukraine conducted a series of sabotage operations against road and rail infrastructure with the explicit goal of disrupting and preventing Russian offensive maneuvers. The destruction of the Rudnya Tsata Bridge in late summer — despite TM-62 anti-tank mines placed beneath it by Russian forces — clearly demonstrated the effectiveness of this preemptive tactical approach. The attacks on railway infrastructure not only exemplified Ukraine’s operational capability, but are also intended to disrupt Russian logistics, slowing them down, and making any Russian movement along the border vulnerable — especially along the A-240 international road to the south and south-west. It’s the same logic behind the JSC “Konservsushprod” attack in Starodub.

Due to the current frontline situation, it’s highly unlikely that Ukraine will carry out deep incursions into Russian territory, but it’s almost certain that small incursions, disruptive operations and attacks against strategic targets will continue in the short term because of Russia’s defensive degradation and unpreparedness (a clear lack of EW and anti-drone systems) in the analysed area.

The body of data gathered has shown that Klimovo and Pogar are more important than some analysts previously thought as a result of the FPV drones presence and the variety of critical infrastructure attacked in the area. Drone operations will likely continue along the tripoint, with a special focus on the area from Pogar to the south and west directions.

The compiled evidence of attacks against energy infrastructure paved the way for two clear conclusions. Multiple attacks on the Naitopovichi pumping station were aimed at undermining the Russian energy system and halting Belarusian collaboration in this critical economic sector. These attacks have long-term consequences and a clear strategic impact. At the same time, FPV drone attacks on substations located around the A-240 road, and sabotage operations against antennas are aimed at disrupting the daily operations of the Russian army and security services in the area and preventing any incursion attempt from Bryansk. These disruptive operations have short-term consequences and tactical impacts. All of them should be analysed together with other attacks and the ever-increasing FPV drone operations against multiple targets.

Analysed data showed that Ukraine is changing its tactics in the borderland area (between Ukraine, Russia and Belarus), evolving into a long-term strategy to prevent incursions like the one Ukraine is currently enduring in Kharkiv. Current operations allow Ukraine to conserve resources critical to other frontline areas. At the same time, it’s almost certain that Russia will have to divert resources at a critical moment. Sabotage operations are also affecting road and train transportation between Belarus and Russia -a strong message sent to Lukashenka’s regime so that it withholds from further involvement in the conflict by Ukraine. Russian logistics now face a serious crisis because of Ukrainian daily operations.

Processed data enables us to establish that partisan cells, the Main Directorate of Intelligence of the Ministry of Defense of Ukraine (HUR), the Unmanned Systems Forces (USF), the Special Operations Forces of the Armed Forces of Ukraine (SOF), and the Security Service of Ukraine (SBU) are operating throughout the sector. Thus, a multi-layered approach is clearly being applied over the Bryansk operational area.

The exponential growth of Ukrainian operations demonstrated that the current scenario is worsening for Russia. Analysed data proved that the Armed Forces of Ukraine have incentives to carry out attacks and disruptive operations. This is also a chance to prevent future Russian attacks. It’s an area where Ukraine has the upper hand, and drone operations as well as partisan operations are highly likely to continue.

Partisan operations in Temporarily Occupied Territories of Ukraine, Russia, and third countries increased exponentially during the summer of 2025. Gathered and tailored data of partisan operations according to their level of complexity exemplified several campaigns, Russian vulnerabilities, and characteristics of partisan warfare adapted to the reality on the ground. Partisan cells are operating without problems throughout the occupied areas of Zaporizhzhia and Kherson. The different types of partisan bubbles are operating independently. Analysed data also revealed a problem among Kadyrovites, in particular the 70th Guards Motorized Rifle Regiment, and three open campaigns against suppliers of the Russian army, gunpowder and chemical factories, and the Russian shadow fleet.

Background

Summer is the most important season of the year. Improvement of weather conditions in Ukraine paved the way for military pressure along several areas of the southern and eastern axis. Better weather conditions also intensified partisan activities in the Temporarily Occupied Territories of Ukraine (TOT), the Russian Federation, and also in third countries. Such weather makes it easier to gather intelligence, process the information, and carry out disruptive operations.

For the following article I analysed the disruptive actions in Russia, the Temporarily Occupied Territories of Ukraine, and also those operations carried out in third countries between June 1 and 31 August 2025. The gathered data revealed several patterns, highlighted some vulnerabilities of Putin’s regime and the Russian Army during the ongoing invasion of Ukraine.

What is happening

The total number of partisan operations showed an exponential growth during June, July, and August. This subversive activities growth was identified in the Russian Federation and the Temporarily Occupied Territories of Ukraine. During the current analysis, we added a partisan operation carried out in international waters, but our conclusions remained unchanged.

Our current research tailored the insurgent actions through three bubbles. Bubble 1 (for cabinet relays, airfields, random facilities/targets, and substations or other energy infrastructure), Bubble 2 (factories, malls, and warehouses), and Bubble 3 (neutralization, neutralization attempts, and special operations where several layers of security and multiple actors are involved). I decided to modify my bubble theory for intellectual honesty: the intelligence necessary for special operations, like SpiderWeb, is more developed and complex than Bubble 2 partisan operations.

At this point, Bubble 1 operations are the typical low-intensity activities led by local activists with broad knowledge of the area where they are operating. Usually, these subversive activities are carried out by a single partisan. The clearest Bubble 1 examples are the destruction of cabinet relays that are decentralized across Russia and the occupied territories. Bubble 2 operations, as I mentioned before, depend heavily on internal intelligence from other intelligence gatherings (HUMINT) and involve greater complexity because they require at least two layers of security and some reliance on third parties. Bubble 3 activities are the classic elimination tactics and special operations where multiple actors and multiple intelligences (SIGINT, IMINT and OSINT) are usually involved -and designed by the Main Directorate of Intelligence of the Ministry of Defence of Ukraine (HUR) and the Security Service of Ukraine (SBU).

Partisan warfare by bubbles showed interesting information that should be properly explained. For example, 24 elements from Bubble 3 operations were airplanes destroyed or damaged during Spiderweb operation. Despite this modification, data demonstrated that Bubble 3 operations had less impact in Russia (27 of 87) than in the Temporarily Occupied Territories of Ukraine (26 of 43). It’s a clear contrast of 31,03% of Bubble 3 activities in Russia vs 60,46% of Bubble 3 activities in Ukraine -and third countries. Bubble 3 operations prevailed in the TOT of Ukraine while Bubble 1 operations (47 of 87) are the most typical in the Russian Federation. Bubble 2 operations are unnoticed because they are typical targets attacked by drones and missiles throughout the occupied territories, while tailored data showed that most of Bubble 2 operations in Russia affected military suppliers. This pattern shows that Bubble 2 and Bubble 3 activities are clearly separate from Bubble 1 partisan activities. It's a typical thing if we analyse Bubble 1 activities and how they are rooted (and decentralised) across Russia.

Usually, FSB counterterrorism efforts were focused on Bubble 1 operations (actions carried out usually by local activists) and tried to link these disruptive activities with Bubble 2 and Bubble 3 operations. This is a clear example of malpractice by Putin's regime because they are cracking down on local opposition while the most important activities (shaped by different types of intelligence and more resources) remain active. Independence within partisan cells (and bubbles) can also be proven with the exponential growth despite Spiderweb operation and dynamics adjusted to the analysed territories. Different methodologies for different realities.

Some patterns are evidenced if we analyse gathered information from underground operations carried out in the Temporarily Occupied Territories of Ukraine between the 1st of June and the 31st of August. For example, most of the cabinet relays were destroyed in Zaporizhzhia and Kherson while neutralizations and IED explosions are more frequently in Zaporizhzhia with some presence of HUR operations in Luhansk oblast. Filtered information proved that the 70th Guards Motorized Rifle Regiment (headquartered in the Chechen city of Shali) suffered several Bubble 3 attacks (IED explosions / neutralization attempts). Published information during summer reported several attacks (7 attacks in 90 days) against “Kadirovites” in both Zaporizhzhia and Donetsk oblasts. At this point, it is clear that Chechen detachments have faced multiple partisan actions - although sometimes the regiment attacked is not specified or partly specified.

Several hypotheses can be established after analysing gathered data of summer partisan activities. The first one (and simplest) is that Chechen units are deployed without maintaining territorial control. At the same time, Chechnya is a stateless nation and some units are suffering partisan attacks thanks to information leaked from people deployed against their will. Both hypotheses are obviously not mutually exclusive and should be considered if we want to understand what is happening.

If we focus on subversive activities carried out in Russia, we clearly detect that Bubble 1 operations are obviously decentralised. At the same time, processed data about Bubble 2 operations showed that HUR continued their attacks against chemical factories (like Aleksin plant in Tula) and gunpowder factories (like Lesnoy in Riazan and Orsk in Orenburg). Finally, Bubble 3 operations in Moscow and Tarskoe (North Ossetia) were followed by secrecy in comparison to classical elimination attempts carried out in the TOT.

Filtered data also identified other patterns. For instance, usually Bubble 2 operations are against companies supplying the Russian Army. An obvious thing if we keep in mind the complexity of this disruptive operations and long-term effects. If we analyse both developed tables, we can note a wave of disruptive attacks against the Russian shadow fleet -that was active before summer. Those attacks against tankers showed HUR’s capacity to deploy and carry out activities in third countries. Partisan attacks adjusted to specific targets and territorial characteristics showed independence between different bubbles and campaigns.

Conclusions

Thanks to our gathered and filtered data, we can settle several conclusions. Some of them are pretty obvious and well explained in other articles, but others are new and should be followed closely. At this point we can establish that the partisan activities experienced exponential growth during the summer. This growth has occurred both in Russia and in the occupied territories.

Bubble 3 operations have been predominant in the occupied territories, while Bubble 2 operations have gone unnoticed because they are the typical targets destroyed by drones and HIMARS. Neutralizations and IED explosions are more than frequent in the TOT of Zaporizhzhia, but the HUR has also been operating in the TOT of Luhansk.

Due to its characteristics, the Spiderweb operation was classified as Bubble 3. This type of complex of activities has generally been less frequent in Russia than in the occupied territories. Bubble 1 operations are typical in Russia (and completely decentralized) and were frequent in Zaporizhzhia (and Kherson) but not in Donetsk and Luhansk. Bubble 2 operations carried out in the Russian Federation were against companies that supplied the Russian Army.

The two Bubble 3 actions in Moscow and the one carried out in Tarskoe (North Ossetia) have been accompanied by considerable secrecy compared to actions in the occupied territories. The analysis from Bubble 3 operations revealed a problem between Kadyrovite units and, in particular, the 70th Guards Motorized Rifle Regiment.

The different types of partisan bubbles operate independently (based on the type of actions and targets) and demonstrate a long-term strategy against Russian military assets. The summer ended with open campaigns against Chechen units, suppliers of the Russian army, gunpowder and chemical factories, and the Russian shadow fleet.

Moscow is the ideal place for those organizations seeking to conduct disruptive activities. Data collected between 2023 and 2025 showed three types of partisan operations (Bubble 1, Bubble 2, and Bubble 3 partisan operations) according to their level of difficulty. Between 2024 and 2025, those resistance actions shaped by less readiness but more local knowledge (Bubble 1 and Bubble 2 operations) decreased while more complex operations (Bubble 3 operations) were less altered. Processed data proved that small cells with local implantation are facing problems due to counterterrorism actions, while classical elimination tactics – carried out by the Ukrainian intelligence and shaped by their complexity – remained active until 2025 summer. Nevertheless, we should wait until the end of the second half of the year to prove this hypothesis, but it’s clear that a three tier of resistance operations was established and the third one remained apart from most classical disruptive operations.

Background

Moscow serves as a critical hub for organizations opposing Putin’s regime, including political groups or operatives from Ukrainian intelligence agencies, such as the Main Directorate of Intelligence of the Ministry of Defence of Ukraine (HUR) and the Security Service of Ukraine (SBU). With a population of nearly 13 million in the city and an additional 7 million in the surrounding Moscow Oblast, Russia’s capital and largest city provides a fertile environment for resistance activities. Compared to smaller Russian cities or occupied territories, Moscow’s dense urban setting enables subversive groups to operate with easily in comparison to smaller Russian cities or the occupied territories.

Data collected and analysed proved that during 2023 and 2024 insurgent actions remained highly active, but a new trend emerged during 2025 and some of them are declining rapidly. The crackdown of dissent and counterterrorist operations are proving partial results against insurgent cells operating in Moscow city and Moscow oblast. The characteristics of partisan warfare are the main elements to differentiate between them and pave the way to develop useful conclusions.

What is happening

I started my database on 21 April 2023 by gathering all the partisan activities, drone attacks against strategic targets, and strategic bombings. I tried to evaluate the impact of Ukraine’s summer offensive, and as it turned out, the information was useful for several reasons and I decided to continue. Finally, this database provided me the necessary inputs to publish intelligence insights and evaluate all types of elements that are not usually published by other OSINT and intelligence analysts.

In the following article I analysed the total number of disruptive actions in Moscow and Moscow region by month. Then I tailored the data with those activities aimed to harm or neutralize targets. Analysed data during the last two years showed a big contrast between the total of underground operations carried out by opposition cells and those activities -generally more complex ops -focused against specific people.

Processed data enabled us to see that the number of partisan activities decreased during the last three months in Moscow and Moscow oblast. At the same time those activities focused on neutralizing targets remained active from April 2024 to February 2025 and were distinct from general disruptive activities. This suggests a clear distinction between typical insurgent actions and targeted neutralization efforts.

Analysis of partisan operations and their targets reveal three distinct categories of disruptive activities (bubbles). At this point we have Bubble 1 (for cabinet relays, airfields, random facilities/targets and substations or other energy infrastructure), Bubble 2 (factories, malls, and warehouses), and Bubble 3 (neutralizations and neutralizations attempts) operations.

Although we have partial information (we started to gather information during the spring of 2023) we can establish several conclusions. For example, Bubble 1 operations remained active in 2023 and 2024. This type of disruptive action is the typical low-intensity operation where knowledge of the area is highly needed. It’s obvious that these are the typical risky tactics led by local activists. Most of “antiterrorist operations” carried out by the FSB are focused on this type of activities and activists are usually paying a hard price for these actions.

Several conclusions can be drawn despite limited data collection. Bubble 1 operations remained active throughout 2023 and 2024. This type of disruptive action is the typical low-intensity operation where knowledge of the area is highly needed. These operations, typically led by local activists, are high-risk and have been the primary focus of FSB counterterrorism efforts. As a result, activists involved in these actions are usually paying a hard price.

Bubble 2 operations -targeting factories and warehouses- require at least two layers of security and detailed knowledge of both the facility that is going to be attacked and its surrounding area. Unlike the low-intensity hit-and-run tactics of Bubble 1, these operations depend heavily on internal intelligence from other intelligence gatherings (HUMINT) and involve greater complexity. Data indicates that Bubble 2 operations declined in 2025 compared to the previous year.

Bubble 3 activities are the classic elimination tactics (or at least trying to harm specific targets) designed by the different wings of the Ukrainian intelligence. Most of them are led by the Main Directorate of Intelligence of the Ministry of Defence of Ukraine (HUR), with occasional involvement from the Security Service of Ukraine (SBU). These operations require more sophisticated intelligence gathering than the previous bubbles. At this point HUMINT is not only more complex, but rather, so are the other types of intelligences (SIGINT, IMINT and OSINT) are important for these disruptive actions. During 2025 Bubble 3 ops remained active but mostly vanished during summer.

Analysis of data from 2023 to 2025 reveals that Bubble 1 and Bubble 2 operations are distinct from Bubble 3 operations. Bubble 3 operations are designed by the Ukrainian intelligence, whereas Bubble 1 and Bubble 2 rely mostly on locally gathered intelligence. Antiterrorist efforts made by the Russian authorities (mainly the FSB) probably decreased Bubble 1 and Bubble 2 activities, but Bubble 3 remained active until summer. We should wait until the end of the year to prove if Bubble 3 partisan ops decreased, as preliminary findings remain inconclusive.

If we focus on specific data about Bubble 3 activities, we should note that the multiple-attacks against MOKB “Mars” (Moscow Experimental Design Bureau, a Rosatom subsidiary company) top employees were assaulted in winter, but visual evidence was published a few months later. No specific data about the day in which the assaults were carried out was published in resistance channels. Finally, I have some doubts about Anton Egovtsev’s assassination because published articles from Russian authorities are not clear as to why or how Egotsev was murdered, but I added his neutralization on the list.

Conclusions

Analysed data from disruptive operations carried out in Moscow and Moscow oblast clearly showed that Ukraine and its allies (mainly local organisations fighting against Putin’s regime) developed a three-bubble structure. Every bubble required more layers of security than the previous one, with different types of intelligence required and more actions needed for their achievement.

The different types of partisan activities -Bubble 1, Bubble 2 and Bubble 3 operations -are not linked or coordinated among them. Bubble 1 and Bubble 2 activities heavily decreased this summer, but we should wait until the end of the year for Bubble 3 operations. Despite partial results, FSB efforts aka “antiterrorist campaigns” probably dwindled disruptive movements. Crackdowns from Russian authorities paved the way for a diminished insurgent groups/cells where fewer layers of intelligence were needed.

Finally, Russian authorities showed difficulties in bringing to a halt Bubble 3 partisan operations during 2023 and 2024. Putin’s regime is facing problems in stopping classical elimination tactics on their own soil and is only able to stop those ones that are locally established and politically motivated -whereby Russian intelligence deployed its assets to crack down opposition. We should wait until the end of the year for more conclusive results about Bubble 3 partisan operations and their operational capacity.

Ukraine started a drone campaign against chemical and gunpowder factories located in Russia. At least seven attacks were carried out by the SBU (Security Service of Ukraine) between the 3^rd and 25^th of July. This campaign is aimed at downgrading Russian offensive capabilities and protecting the Ukrainian cities. We should wait between two and four months for results.

Background

Ukraine is suffering a slowing down scenario along the frontline after three years and a half of facing a great-scale invasion from Russia - and ten years after the occupation and illegal annexation of the Crimean Peninsula and several areas of Donetsk and Luhansk oblasts. Actually, both Russian and Ukrainian movements through the contact line are minimal, mostly tactical and usually with low strategic impact.

There are several reasons for this slowing down that were clearly shown over the last few months. At this point, as other analysts noted, the main evidence which explains these slow movements along the frontline is the normalized use of FPV drones and the high level of surveillance provided by those unmanned aerial vehicles. Technical changes (the use of new fiber optic drones) as well as the lack of rotations and artillery shortages paved the way for the current scenario.

The improvement of weather at the beginning of summer brought with it a change of tactics carried out by the Russian Army. Conditions for “offensive” actions emerged after leaving the muddy season, so it's not a surprise that Russia pressed Ukraine from multiple areas while visual evidences of transferred equipment towards Zaporizhzhia frontline appeared on Telegram specialized channels. Ukrainian attrition warfare proved its results with a downgrade of Russian capabilities; IFV vehicles were replaced by motorbikes and were replaced by soldiers walking until they are killed by a drone. Probably you watched some of these types of videos and this explains why I'm writing "offensive" actions using inverted commas, but most of small gains from Russian occupiers are coming from this type of kamikaze tactics.

With a clear need to shake things up, Kyiv recognized Putin’s limitations: Technological impact made by international sanctions, the price of processing raw materials (clearly shaped by international sanctions), the need for ammunition, and the improvement of missiles and drone production. Ukraine also faced limitations from their allies through banning the use of provided missiles against targets located inside Russia’s non-bordering areas or attacking Russian refineries (this ban remained more or less active from 03-25-2025 to 08-02-2025). We should note that those types of attacks previously increased the cost of oil production (and more problems for Putin’s regime through limitations of oil and oil derivatives exportations) and paved the way for shortages in the market, as well as logistical problems for the Russian occupiers and decreasing profits for Putin’s regime. To overcome this limitations Ukraine (mainly the SBU and other elements from the Ukrainian Armed Forces) started a drone campaign against Russian railways (pretty well explained here) and another against chemical and gunpowder factories. In the following lines I’m going to explain the second one campaign.

What is happening

The current Ukraine's drone campaign against chemical and gunpowder factories is designed for long-term results. It's clear that the main objective is aimed at downgrading the Russian army and its advances due to a lack of offensive capacity (shortage of ammo and artillery).

There are other important ideas behind these attacks, like downgrading Russia's ability to produce all types of ammunition and increase manufacturing explosives costs -and increase dependence on North Korea and China regimes. The secondary objectives are the total halt of missile production that targeted civilian areas (Kyiv and main Ukrainian cities) as well as Ukrainian strategic installations like ammunition depots, airfields, recruitment centers, training facilities, etc.

Conclusions

It's too early to establish any type of conclusion, but the movements and the patterns are clear. We should wait between two and four months -after the end of summer -if we want to analyse the results of current drone attacks. Probably Moscow will make some “diplomatic” movements to stop the current campaign.

We should note that Russia enhanced its capacity to avoid sanctions through third countries and improved its missile production capacity. Ukrainian partners should push for more sanctions or at least speed up the delivery and deployment of batteries. Finally, it's a matter of time that Ukraine will combine the use drones and self-made missiles to avoid current dependence with their partners.

Subscribe now