In Ukraine, Contract Saboteurs Fuel Propaganda About a Pro-Moscow Resistance

Last April, a young man with light brown hair entered a small railway station in central Ukraine, where he loitered for an hour before approaching a metal cabinet.

The nondescript gray box housed electrical equipment that controls critical railway functions, including traffic signals and track switching. Damage to the unit could cause a collision — or at the very least, paralyze train activity in the Vinnytsia region.

Standing in front of the cabinet, 26-year-old Victor Gherus pulled out a bottle of lighter fluid and doused it over a duffle bag. He then set fire to the bag and wedged it into the top of the cabinet’s door.

He recorded his handiwork with his phone and sent the video to a handler who was directing the sabotage remotely over Telegram.

The reply was swift: the visuals weren’t good enough.

“Pour it in the cracks! The fire’s gotta burn, man,” the handler texted in broken Russian, according to messages intercepted by the Security Service of Ukraine (SSU). “This is some bullshit, it’s just a rag smoldering. We’re not getting paid for this shit,” he added.

This type of vandalism-for-hire has become increasingly common since Russia’s 2022 full-scale invasion of Ukraine. Across Europe, arson attacks, bombs, railway disruptions, and more complex spying and assassination plots have been carried out by recruits found on social networks like Telegram. 

European officials suspect the campaign is ultimately directed by Russian intelligence, which the Kremlin has consistently denied. While the physical damage from these operations can be limited, analysts say the goal is to undermine a sense of security and order on the continent, spreading fear, discontent, and division in its place. 

In Ukraine, several recent cases have pointed to a more specific and insidious goal: Though the fire set by Gherus in the Vinnytsia train station did not ultimately lead to any major train disruption, the act was used to fuel a misinformation narrative about a violent resistance movement opposing the government and embracing Russia.

Per his handler’s instructions, Gherus filmed the fire while holding a sheet of paper with the words “Ukraine Against” written in Russian alongside the date, April 4, 2025. The video was later published on a pro-Russian Telegram channel, with a caption claiming it was carried out by members of a Ukrainian dissident movement. 

Yet Gherus is not even Ukrainian. 

He and another young man — both of whom were caught by authorities within 48 hours of the fire — had traveled by bus from neighboring Moldova to carry out the act. The two men were convicted of sabotage and sentenced to 10 years in prison this February. 

Court records show they cited financial compensation — about $300 total — as their motive.

Speaking to OCCRP from the Vinnytsia detention center where he is serving his sentence, Gherus said it wasn’t until he was asked to write the sign that he realized “this was somehow connected to the war.”

“That’s when it dawned on me that something wasn’t right. Especially the message — it immediately triggered some kind of disturbing association in my mind. And I realized that something bad was happening.”

He is not alone. Ukrainian prosecutors told OCCRP 18 other foreigners have been convicted on sabotage-related charges since 2024, joining a list of hundreds of Ukrainians who have been convicted of similar acts since Russia’s 2022 invasion.

The country's security services told OCCRP they suspect the work is ultimately directed by Russian intelligence, noting that there has been a ramp-up of such attacks since 2023. 

“They involve minors, people with drug or alcohol addiction, and other individuals vulnerable to recruitment, who are easier to manipulate into illegal activities,” the SSU said in a statement.

Some of these sabotage acts — including those carried out by foreigners like Gherus — are being used by pro-Russian propaganda networks to create the impression of an “underground movement” that is “awaiting some sort of liberation” from Moscow, prosecutors told OCCRP.  

The narrative “was planted from the very beginning of the full-scale invasion to serve as a pretext and justification for the war,” said Kostiantyn Gozdup, head of the Compliance Monitoring Department at the Vinnytsia Prosecutor’s Office.

A tiny minority of Ukrainians feel positively toward Russia, according to a poll from October. But there is no evidence of a nationwide or violent movement against the government.  

“A resistance movement requires coordination; it implies some kind of unity among these forces," said Liubov Tsybulska, an expert on hybrid warfare who leads Join Ukraine, an NGO that advises the government on information and security matters.

“But these are all sporadic cases where Russian special services recruit individual people via social media,” she said, adding that the saboteurs are typically motivated by a financial reward.  

Moscow’s goal, she said, is “to create a rift between the people and the political and military leadership.”

The Russian government’s press office did not respond to requests to comment.

'Join Our Ranks'

In their order authorizing Gherus’ detention, judges framed his act of arson as part of “a significant increase in the sabotage activities of the special services of the aggressor state.”

Russia’s security structures have recruited saboteurs through “intimidation, blackmail or material incentives,” the order said. 

It noted that investigators were unable to determine the identity of Gherus’ handler, by the name Denis Stanciu, who delivered payments via cryptocurrency.

Reporters could not independently confirm Russia’s direct involvement, and Stanciu, a name that Ukraine authorities said they believe to be an alias, did not respond to requests to comment sent to his Telegram account. 

The Telegram channel that later shared the video, and which has more than 19,000 subscribers, was created in April 2024 and lists a Russian phone number as a contact person. The channel regularly publishes videos and photos of what appear to be sabotage acts in Ukraine, and attributes them to members of its so-called movement — often invoking the phrase "Ukraine against mobilization." 

“Join our ranks. We will teach, guide, and support! Everyone can help,” the Russian-language posts regularly add.  

On July 23, 2024 the channel shared two videos of fires that were described as "the results of a night sortie in the city of Odesa.”

“This is not everything we did during the night, but some things we film, some we don't, and some things we post after a long pause,” the post reads. 

Reporters found other similar Telegram channels that circulate anti-government rhetoric, and call on people to support and join the movement, sometimes promising money for their work.

Andrei Curăraru, a Moldovan expert in security and public policy, said that online messaging apps have become a cheap — and low-risk — recruitment tool for Russian intelligence. 

“You can identify vulnerable individuals, give them a narrow task, request a video as proof, and pay them without direct contact,” he said. “This type of sabotage increasingly resembles a clandestine gig-economy marketplace rather than traditional espionage networks.”

Those who carry out the vandalism “often do not even understand whose interests they are serving,” he added.

“These people are expendable, and everyone in the chain of command knows this — except for the recruits themselves.” 

'I Didn’t Want to Harm Ukraine'

Both Gherus and an accomplice, a 26-year-old Moldovan named Iurie Lupu who was also sentenced to 10 years for the sabotage, had the type of vulnerable profile recruiters search for: the young men were short on cash and had troubled histories with drugs and the law.

Lupu confirmed to reporters that he first received a Telegram message from a user named “Denis Stanciu,” offering a chance to “make some money.”

Reserved and speaking with reluctance, Lupu said he didn’t know why he was contacted or who the man really was, but that he brought in his friend Gherus because he also needed cash.

Gherus had been released from a Moldovan prison just a few months earlier, after serving four years for a drug conviction.

“After I got out, it was hard to find a job,” he told OCCRP, adding that he was only able to earn some 10-15 euros a day loading goods at a market. “That’s only enough to buy some food in the evening, and that’s it.”

Gherus’ mother told RISE Moldova that he had gotten caught up in synthetic drugs but was a “timid” young man, who mostly stayed home on his computer or phone. He lived with his mother, grandmother, and younger brother in a two-bedroom apartment in the center of Chisinau, but wanted to find a place with his girlfriend.

She said he told her he was going to Ukraine to look for work because many houses needed rebuilding due to the war.

“My health has already suffered,” she said tearfully of the anguish she has experienced over her son’s imprisonment.

Lupu’s mother said her son didn’t want her to know why he was going to Ukraine.

He had also spent time in prison for drug-related offenses, records confirm. According to his mother, he suffered from epilepsy, which made it difficult to hold down a job. Employers would fire him as soon as they learned of his diagnosis or witnessed his seizures, she said. 

The young men planned to split the money they would receive from the job in Ukraine, according to court documents. Stanciu sent Lupu $200 through a crypto wallet to cover their travel to Ukraine, and promised an additional $100 for the work.

Gherus told reporters he didn’t know the significance of the railway cabinet before setting it alight. 

"I didn’t want to harm Ukraine, to be honest," he said. “I am against the war. I am for world peace in general.”

“I would do anything to start living my life completely from scratch,” he added. 

More Moldovan Recruits

Though other foreign saboteurs in Ukraine have come from farther afield, like the Balkans, Middle East countries, and Russia itself, at least two more also hailed from Moldova — an impoverished neighbor that, according to Curăraru, is an unsurprising source of recruits.

“Moldova concentrates several conditions favorable for recruitment: economic vulnerability, regional mobility, relatively easy access to Ukrainian territory, and linguistic compatibility with the environments in which Russian coordinators operate,” he said. 

Last October, a Moldovan citizen received an offer via WhatsApp to burn Ukrainian military vehicles in exchange for money, according to court records. 

He arrived in Odesa, where one evening he torched a vehicle belonging to a non-governmental organization of military chaplains. He then traveled to the Kyiv region, where he gave the same treatment to a vehicle used by a man who worked as a driver and electrician for a military unit.

As with the relay cabinet incident, the actions were filmed with a sign bearing the phrase “Ukraine Against.” The videos were then published on the same Telegram channel and framed as an act of Ukrainian resistance. 

"Movement members burned an SUV of the Armed Forces of Ukraine," reads the caption of his Odesa video. 

In February, the Moldovan was convicted by a district court in Kyiv of unlawful acts against Ukraine’s military and intentional damage to property, and sentenced to five years in prison.

In 2024, Russian media outlets covered acts carried out by another Moldovan citizen as evidence of Ukrainians revolting against their government. 

Contacted by an anonymous handler via Telegram, this one was promised $1,000 in July 2024 to burn military vehicles in the Vinnytsia region. He too was detained and sentenced to seven years in prison.

"Ordinary Ukrainians continue to protest the arbitrary actions of the Kyiv regime,” an article published by a Russian news site wrote after his arson attacks.

Kinga Redlowska, a finance and security analyst at the London-based think tank RUSI, noted these sabotage operations are organized in a way that reinforces the perception they are “local and spontaneous, even when it’s being directed from outside.”

“You have loosely connected individuals, small payments, often in crypto, and very little traceable structure,” she said. “It provides deniability, but more importantly, it shapes perception – making it look like instability is coming from within.”