From Shadows to Spotlight - The Kremlin’s Not-So-Covert Gambit for Ukraine
by Annabel Peterson
Introduction: The Culmination Points
The war in Ukraine has been raging for 19 months and is yet to exhibit a conclusive imbalance of forces and means. This is good news for Ukraine, who was expected to surrender within days, and an unprecedented embarrassment for Russia, who planned for a Crimea 2.0. What we are witnessing today is undoubtedly the result of a cluster of Russian intelligence failures, both in terms of reconnaissance and operational support. A lot has been written about the general errors in autocratic intelligence management, as well as Russia’s resistance to modern tactical realities such as crowdsourcing open-source intelligence (OSINT), but few have considered the overall weakness of the underlying strategic intelligence assets. For Russia, a loyal collaborator network, the Russian Orthodox Church (ROC), and certain advanced cyberwarfare were central to preparing the ground for a quick surrender. All of these, however, reached their culmination points after the initial intervention in Ukraine 8 years prior.
The culmination point of attack is a well-known Clausewitzian military concept describing the inevitable equilibrium reached as a result of the defender’s counterbalancing activities and the attacker’s consequent loss of initial superiority. At this point, the attacker is still able to hold the defence, yet continuing the offensive in the same manner would mean defeat. In Russian doctrine, the same laws apply to a clandestine battlefield, where the culmination point is reached with the exposure of one’s true goals, means, and methods. Intelligence operations that fail to adapt to the operating environment and enemy responses naturally become counterproductive to the attacker’s strategic goals.
The annexation of Crimea was an example of a successful deployment of clandestine means at the height of their strategic influence. The operation has been described as a clever adaptation of tactics after being cornered by the failure of Russia’s original active measure campaign in 2013. However, the aftermath of that operation brought the remaining Russian influence assets to their culmination point, thus calling for a clear change of strategy. The Kremlin’s political-strategic goal – ever since Ukraine’s declaration of independence – has been to subordinate it to Moscow’s will. In pursuit of that, Moscow has attempted to instal various puppet entities into Ukraine’s political system, starting with the illegitimate “Donbas people’s republics” in 2014. Eight years and two Minsk Agreements later, the Kremlin had not achieved the desired results and decided to extend the puppet network into Kyiv’s central government. Similarly to Crimea, a successful power transfer merited a quick (and preferably bloodless) surrender of the government. Setting the stage for a Crime-type power transfer was, therefore, the venerable goal of the Russian intelligence services in the leadup to the invasion.
The Federal Security Service’s (FSB, Federal’naya Sluzhba Bezopasnosti) 5th Directorate – tasked with combatting dissent in Russia’s “near abroad” – carried the heaviest weight in preparing Ukraine for invasion. Some western security officials would even hold the FSB accountable for the trickle-down failures of the Main Directorate of the General Staff of the Armed Forces (GRU, Glavnoye Razvedyvatelnoye Upravlenie) and Russian military intelligence, who were forced to work with flawed base information regarding the potential for Ukrainian resistance. Adding to this the obsoleteness of Russia’s agent network, Orthodox authorities, and cyberwarfare upon which its success largely relied, the invasion was doomed to fail from the start.
1. A Network Without Collaboration
The primary covert asset – required for a swift occupation of Ukraine – was a reliable Russian agent network on the ground to provide strategic intelligence and prepare the information conditions enabling a smooth power transfer. Such a cultivation of the soil for a Russian takeover started already in the 1990s, eventually unleashing a competition for the most impactful ground presence among the Russian intelligence services. According to Bellingcat’s lead investigator, Christo Grozev, Russia’s internal security service and military intelligence, in particular, have been competing to set up the most far-reaching fifth column in Ukraine. In pursuit of that, both the FSB and the GRU have targeted not only Ukrainian politicians, activists, and security officials but also the judiciary, journalists, and former Yanukovych associates.
By 2014, Russia’s agents of influence had provided enough leverage to convert existing political divisions, weak institutions, and high- levelcorruptionintoaquicksurrenderof Crimea and Donbas. Researchers from the Estonian Academy of Military Sciences identified the saboteur network’s systematic spreading of panic and propaganda as a key factor enabling Russian success in Donbas. It entailed fake news that alleged heavy Ukrainian casualties and the untrustworthiness of the government in Kyiv. Separatist collaborators, together with professional Russian intelligence officers, stood at the centre of these information operations. Such officers would, for instance, arrive at conflict hotspots, alongside the “journalists” specialised in propaganda, and fabricate the developments to appear unfavourable to Ukrainian resistance. It meant that by the start of the physical confrontation in Donbas, the region had been thoroughly primed for Russian intervention and that incoming troops had no trouble convincing Ukrainians to surrender entire settlements without resistance.
Weeks prior, a similar scenario had unfolded in Crimea, with the collaborator network enabling deep deception and fast evolution of events on the ground. At the height of that unprecedented operation, the appearance of Russian troops without insignia made it difficult for Ukrainian counterintelligence to diagnose and respond to the situation, not to mention the paralysing confusion in local civilian masses. The covert operation ran smoothly, owing its success to widespread collaboration from the local police, security service, political, and criminal elites, whom the Russians had managed to infiltrate and corrupt. The efficient informational cover and timely intelligence provided by the collaborator network allowed Russian forces to swiftly seize key strategic positions on the peninsula and thus deny grassroots resistance by deception.
However, what the Kremlin may not have realised in 2022 was that underlying the success in Crimea were extremely favourable political conditions and the complete novelty of the chosen approach, which could not be replicated in other operations. Moscow’s human intelligence (HUMINT)-enabled and deceptive diversion operation in Ukraine, therefore, reached its culmination point in 2014. At that moment, Russia still retained enough plausible deniability to avoid direct proportional consequences, but the opposing security communities became hyper- focused on the “hybrid” elements in Russian offensive operations, thereby suggesting exposure of the Kremlin’s covert methods. The operation’s political technologist, Vladislav Surkov, was sanctioned by the US immediately after the annexation, despite the frantic efforts of his aides to deny his involvement to the Western public. Experts interpreted Surkov’s careless reaction as a mere bluff.
Notwithstanding the evident exposure of the covert operation, Russia’s game plan for a successful military intervention in 2022 remained unchanged. As the most comprehensive post-mortem of the intelligence failure details, the Russian asset network was meant to paralyse the Ukrainian state and condition Ukrainian officials to accept a pro-Russian course; the next step would be provoking mass protests against the government’s sudden inability to serve Ukrainian national interests. The systematic spreading of false narratives regarding the protests would help fracture Ukrainian resistance and provide a moral justification for an invasion. Analogous to the 2014 operations, Moscow’s agents on the ground were supposed to maintain pro-Russian sentiments in the contested territories until Russian forces secured critical strategic positions. The main goal of the GRU’s ground network was to ensure the physical passage of Russian troops and members of the FSB’s planned puppet government. A principal role in this was to be played by one of the GRU’s most crucial assets and a member of the Ukrainian Parliament, Andriy Derkach, recruited in 2016. By the time of the invasion, Derkach and his assistant Igor Kolesnikov had been put at the centre of the entire network.
However, at the final preparatory and initial active stages of the invasion, multiple malfunctions occurred, signalling a premature burnout.
• The first setback was the sanctioning of Andriy Derkach in 2020 for his interference in the 2016 US presidential election. In addition to provoking mass protests and misleading Ukrainian counterintelligence, Derkach was to lead the dissemination of disinformation about the dangers associated with Ukrainian nuclear energy production – all of which failed to materialise after his landing on the blacklist. Complete exposure of Russia’s intended psychological operations became clear weeks prior to the invasion when the UK and US had strategically declassified comprehensive intelligence about Moscow’s plans to politically subvert Ukraine. Remarkably, the Security Service of Ukraine (SBU, Sluzhba Bezpeky Ukrainy) had apparently been aware of the Derkach network – and allegedly neutralised it at the beginning of the invasion by detaining Kolesnikov, identified as the key manager of funding.
• The second setback partly followed from the first. Such public and attributed disclosure of Russian psychological operations gained superiority for the Ukrainian narrative and mobilised a resolute international alliance (even though Ukrainian officials had been initially denying the possibility of a Russian attack). Moreover, in the face of Russian aggression, domestic public opinion was uniformly in favour of EU and NATO integration. This should have been interpreted as a clear sign that the lack of societal cohesion and international support no longer formed a weakness to exploit. Unlike in 2014-15, there were indicators that the West would intervene. However, the FSB chose to conduct its own polls, overseen by a former Yanukovych aide in charge of sleeper agents, and then interpreted the numbers to support the armed intervention. As RUSI researchers have explained, the invasion was likely based on the premise that those institutions in which the population showed the most trust – i.e., the military and the civil society organisations – could also be easily neutralised by the Russian network on the ground in Ukraine. Battlefield success during the initial stages of the invasion, therefore, relied on similar influence and diversion tactics as in 2014. In grave contrast to the former, the invading troops instead found the local population in the contested territories assisting the Ukrainian intelligence services to sabotage Russian positions. Hence, sticking to the methods of 2014 was counterproductive for the agent network of 2022.
• This led to the third setback: the questionable loyalty of Russian junior agents and informers in Ukraine. The FSB’s strengths in the Ukrainian theatre came with a considerable expansion of its operations and the establishment of a “curator system,” whereby over 120 FSB curators would manage around 5-10 asset relationships. It involved a shift from targeting exclusively the highest- ranking officials in 2014 to virtually everyone associated with influential people, down to their service personnel in 2022. A key characteristic of this approach was that assets were recruited on a flexible, temporary, and project basis, which sometimes did not align with their professions and, therefore, took a toll on the assets’ quality and loyalty. In the words of the SBU’s reserve Major General Viktor Yahun, the expanded spy network in Ukraine was corrupted by its own structure. As assets got tangled in a “circle of responsibility” to cover comrades and improve their own results, the intelligence reaching the decision- makers at the top was being tailored to support the illusion of an easy Russian victory. The status of Putin’s favoured service, earned by the successes of 2014, also deepened patrimonialism within the curators themselves, whose tool to advance one’s career was to validate the Kremlin’s pre-decided policies. The GRU was facing the same problem: most of the influence agents they had recruited would not cooperate directly with their curators after “D-Day,” suggesting that they may have never been supportive of an operation of this kind. In this regard, Christo Grozev brings a noteworthy example of an asset inside the SBU that the GRU had to execute to preserve its credibility among other collaborators.
The structure and modus operandi of the Kremlin’s agent network in Ukraine, therefore, suggests that it was expected to behave similarly as did in 2014 – i.e., to condition both the authorities and the local communities to surrender without resistance. However, as one puts all the setbacks together a clear picture emerges: once a functioning asset network had been reduced to ashes by the start of the invasion.
2. A Church Without Faith
The collaborator network was interconnected with the ROC – a de-facto state institution that, in the words of Russian religious scholar Sergey Chapnin, “less and less resembles a church in the traditional understanding of this word.” It is rather a multifaceted influence asset of the Russian state that has prematurely culminated first on the strategic and then on the operational level.
The ROC attains its strategic significance from its special status as a formally depoliticised extension of the state’s hand – its main function ever since Peter the Great’s imperialistic reforms. Stalin’s revival of the church during WWII and the recruitment of its priests as the People’s Commissariat for Internal Affairs (NKVD, Narodnyi komissariat vnutrennikh del) agents set up a patrimonial security structure that outlasted the collapse of the USSR. Up to date, Patriarch Kirill, the current leader of the ROC, continues to emphasise the close relationship between the church and the state. A deep dive into its history shows that in 1992, the church’s public discourse began to glorify Russian combat soldiers as saints. Indeed, in the context of war, there is no asset as useful as one that can justify and encourage dying en masse for the Motherland.
However, events took a downturn for the ROC on the eve of the Crimean annexation. Leaked emails from the operation’s leading architect, Vladislav Surkov, revealed that the ROC had failed its grand strategic mission already in the leadup to the Ukrainian Euromaidan, making the annexation the last resort rather than a demonstration of power. This happened as the Kremlin sought to use the church as a tool to steer Ukrainian public sentiments towards “Eurasia” but, after various propaganda campaigns, found all the Orthodox churches in Ukraine still formally favouring integration with the EU.
Having failed to influence the general direction of Ukraine, the ROC, nevertheless, maintained substantial social authority in the target country. The FSB’s polls found that ahead of the invasion, the church was still highly regarded by over half of the Ukrainian population. The deep intelligence infiltration of the Moscow Patriarchate’s domains allowed the church to remain the main cover organisation for Russian operations since the 1990s. The ROC’s impact was the most visible in Ukrainian domestic politics, where its presence secured Russia’s claims to Ukrainian territory by cultivating a “religious nationalist” political faction, promoting the narrative of inherent religious unity between the two nations. Drawing on this uncontested institutional authority, the real value of the ROC was in enabling the Kremlin to uphold an elected pro-Russian representation in the Verkhovna Rada of Ukraine throughout multiple election cycles.
What was left of the ROC’s strategic influence on Ukraine’s political and religious divisions peaked just before the start of the conflict in 2014. The culmination point was reached with the annexation of Crimea when the church first came under fire. Yet, it was still able to escape blame and distance itself by portraying the Russian intervention as a religious dispute within the context of a “Ukrainian civil war.” Since no creative adaptations to the strategy followed, the increasing public questioning of the ROC’s loyalties after the annexation took a toll on its influence, eventually leading to a formal secession of the Ukrainian church from the Moscow Patriarchate in 2019. It delivered a fatal blow to the ROC as its main reason for existence had become the “one Orthodox nation” myth used to maintain control over Ukraine. Whereas the ROC’s central strategic narrative had simply failed to make an impact before the occupation of Crimea, after the annexation, it was outright swept out of existence.
Beyond political strategies, the ROC also had an operational role in capturing Ukraine. In the 2014 battles, for instance, priests were found fighting among separatist ranks in Donbas and operating torture chambers on the premises of religious facilities. Paramilitaries with a distinct Orthodox identity made a significant contribution to the separatist war effort, especially wing to the participation of local “Kazak” units familiar with the landscape.
In the ongoing war, Estonian Foreign Intelligence recognised the ROC’s provision of multifunctional safehouses to be a critical constituent of the Russian ground network. Even more importantly, it was the ROC’s associates who provided the most valuable HUMINT if compared to the otherwise underperforming network. Naturally, the church’s special status as a religious institution, with a mandate to oppose the Kremlin, grants it the most auspicious position to conduct social network analysis and gather overall situational awareness. Christo Grozev also admits that church associates constitute a pool of trustworthy pro-Russian “spies and gunners” who assist with the actual conduct of hostilities. In continuation of the 2014 efforts, ROC priests were again among the most important local agents promoting the invaders and reporting the non-conformists to the Russian occupant forces.
The ROC’s operational community manage- ment duties maxed out during the initial phases of the occupation in 2022, with the loss of plausible deniability regarding its involvement. Following the secession of the Ukrainian Orthodox Church during Poroshenko’s presidency, the ROC’s positions began to deteriorate, while the reach of malicious Russian networks and influence tools embedded in it was reduced. It had, nevertheless, enjoyed relative immunity up until the invasion due to the Ukrainian government’s political fear of limiting religious freedom and offending the remaining Ukrainian patriots among the ROC’s followers. However, uncovering the extent of Russian war crimes during the Ukrainian counteroffensive left the ROC no more room for denial and resulted in a systematic targeting of the church and its associates. It was at this point that the maintenance of the ROC as an operational asset became counterproductive. Ukrainian counterintelligence soon confiscated its physical property and made sure to expose all suspicious findings to the media. Statistics show that most believers consequently began to see Russian Orthodox priests primarily as intelligence agents; a tectonic shift in formal allegiance to the Ukrainian Orthodox Church has occurred, thereby dealing a final blow to the ROC’s legitimacy in Ukraine.
3. Attack Without Leverage
The final asset – crucial to shaping sentiments on the ground and complementing Russian military strikes – was state-sponsored cyberattacks on Ukraine’s critical infrastructure. One particular GRU cyber unit named “Sandworm” was the prime actor associated with this task since the beginning of the war in Ukraine. After hacking various news and government websites to spread disinformation and encourage the population to surrender to occupation authorities, the GRU’s cyber strategy culminated with a large-scale attack on Ukrainian critical infrastructure in December 2015, leaving thousands of civilians without power for a prolonged period. This was another classic attempt to undermine societal trust in Ukraine’s capabilities to withstand aggression and provide for its citizens. For external observers, Sandworm’s attack constituted both an escalation from previous disruptive incidents and the first successful sabotage of a state’s energy infrastructure by a covert cyber campaign. The West – while acknowledging the campaign’s highly sophisticated and systematic nature – was left dumbfounded by Russia’s technical capability and fearful of Moscow’s potential to politically subvert Ukraine. That ominous precedent exemplified to multiple stakeholders and observer states the necessity of securing their power grids from hostile foreign state actors.
The 2015 attack became Sandworm’s culmination point: Ukraine was severely affected but recovered fast amidst the international attention. The GRU managed to hit the target’s weakness in a highly unexpected manner while initially retaining an umbrella of deniability, plausible enough to avoid legal repercussions. In theoretical terms, a retreat – or change of strategy – at that point was warranted to avoid burnout. However, the GRU approached the attack rather as reconnaissance by combat – i.e., a subtype of reflexive control aimed at gaining intelligence on the target’s capabilities and potential responses by way of attack. Having witnessed Ukraine’s inability to resist or respond to such incidents, Sandworm carried out occasional attacks in the following years. Continuing the cyber campaign without any modifications became counterproductive when private companies and other external entities entered the game on Ukraine’s side. By 2022, highly capable private actors such as Microsoft had already pre-emptively intervened and offered real-time assistance to Ukraine in countering Russian cyberattacks throughout the invasion. Likewise, the Starlink communications technology not only derailed Russian attempts to disturb Ukrainian command and control but became a lifeline for civil resistance. In a direct affront to Russia’s cyber campaign’s goals, the donated Western technology enabled sophisticated intelligence collection and fire support operations capability for the Ukrainian forces.
The turn of tables became apparent with two main events.
• First, in the beginning, stage of the invasion, Sandworm launched large- scale wiper attacks on Ukraine’s critical digital infrastructure, with Viasat, a military communications provider, among its targets. As in the old playbook, the goal was to undermine Ukraine’s political will and collect intelligence on all levels. While significant tactical complications
for the target followed, the attack failed to affect Ukraine’s societal and military morale as planned.
On the contrary, the Ukrainian Armed Forces managed to leverage the public for intelligence value, further strengthening societal resilience.
• Second, reassured by the 2015 experience, Sandworm attempted another ambitious cyberattack on the Zaporizhzhia nuclear power plant a few months into the invasion, aiming to leave millions without energy. However, this time, the aid provided by Ukraine’s private supporters enabled a complete denial of the fatal attack or any force-multiplying effects to entail. Furthermore, the resemblance of the offensive software to the 2015 attack facilitated a faster neutralisation of the cyberweapon.
Russia’s efforts again failed to account for the greatly enhanced resilience that Ukraine’s digital infrastructure would display after learning from the initial shock attack. The Ukrainian side, on the contrary, demonstrated an understanding of the GRU’s modus operandi and gained silent battleground superiority by capitalising on the initial exposure of Sandworm.
Conclusion: The Common Denominator
There was one common denominator between Andriy Derkach, the ROC leadership, and Sandworm: they were all products on the Kremlin’s covert action shelf whose expiry date had passed almost a decade ago (although they may still often come up to describe Russia’s hidden strategy to condition Ukraine into a quick surrender). What started as a markedly successful leveraging of covert assets in support of territorial gains and political concessions in 2014 culminated with a complete strategic blunder that was the 2022 invasion.
A premature culmination of those three strategic assets is one way to explain the outcomes. After the successful annexation of Crimea and destabilisation of Donbas, the FSB expanded its Ukraine operations but failed to realise that the loyalty and public sentiments that triumphed in 2014
would not be the default in 2022. The GRU’s efforts against Ukraine were exposed both on the ground and in cyberspace, which helped Ukraine gain external support and build up resilience against the two types of subversion. In the meantime, the FSB and the GRU were heavily relying on the ROC, which had been gradually losing all leverage in Ukraine after the 2019 schism and the 2022 exposure of its direct involvement in the conflict.
On the one hand, the turn of events suggests that Russia’s tools and theories of hybrid warfare may be neither as sophisticated nor effective as feared after the annexation of Crimea. The flip side of this implies that the current war will rely more on Russian biomass and hard power, especially now when assets of influence and non-military subversion have been exhausted. On the other hand, our understanding of Russia’s performance in this regard may be somewhat biased since we are, by definition, only able to analyse intelligence failures – not achievements.
Another aspect to consider is the continuing revelations of Russia’s successful meddling in democratic political processes abroad, which suggests that some Russian covert assets outside of Ukraine may yet reach their culmination points. The central questions are if and what the Kremlin learns from the strategic failures in Ukraine, as well as whether it becomes more open to the structural improvements needed.
