Українською читайте тут.
Analysts at the Detector Media Research Center have uncovered and joined Telegram communities that offer financial rewards for setting fire to military property.
On September 20, the Office of the Prosecutor General reported 266 cases of arson involving the vehicles of military personnel and volunteers. According to Ivan Vyhovskyi, head of the National Police, these acts are coordinated by Russia’s FSB, which recruits Ukrainian youth for such operations. There are reports of over 50 instances where minors were involved in setting military vehicles on fire.
These criminal activities began in 2024. In June, it was revealed that Russian intelligence services are using darknet forums to recruit individuals to carry out arson attacks on vehicles of military enlistment offices (TTsKs). The Center for Strategic Communications and Information Security reported that advertisements for such arsons appeared on the Hydra forum, a platform known for drug trafficking. The ads offered financial compensation for burning vehicles. However, the darknet is not the only platform Russian intelligence uses to recruit arsonists. A spokeswoman for the Prosecutor General’s Office, Nadiya Maksymets, noted that in most cases, those setting fire to military property in Ukraine and Europe are coordinated via messaging apps. Telegram is frequently mentioned in this context by law enforcement.
Detector Media analysts identified recruiters operating through Telegram. This article explores the recruitment mechanisms and how these arson attacks are used to fuel Russian propaganda.
The Anti-Military Enlistment Office Campaign
On August 24, Telegram co-founder Pavel Durov was detained in Paris. French authorities’ main concern with the platform’s founder is the lack of moderation, which allows organized crime to operate freely, and Durov’s refusal to provide information necessary for investigations.
Following his arrest, Durov promised to comply with government requests for IP addresses and phone numbers of those engaged in illegal activities, and he has started cooperating with French law enforcement. However, Telegram’s collaboration with authorities seems limited to France, as there have been no reports of similar cooperation with Ukrainian law enforcement. As a result, Telegram remains a “playground for criminals, extremists, and terrorists” in Ukraine, as well as in many other countries, as described by The New York Times in an investigation. Naturally, Russian intelligence services also exploit the platform for their operations.
The organizers of these arsons benefit from Telegram’s lack of moderation, which allows them to remain anonymous and avoid being blocked. As we found out, they post their messages in group chats where employers leave information about job opportunities. These posts promise salaries of $800 to $1,000 or more.
Upon contacting an “employer,” individuals receive details about the “job”: they are asked to locate military vehicles, confirm the target with a supervisor, record the act of arson, and then await payment, which is promised via cryptocurrency.
Conversations about such work can also start with a Telegram bot. Users who click on a job advertisement promising high pay may be redirected to a bot. After sending the command “/start,” the bot or recruiter provides more detailed “job instructions.”
Text on the left:
"The job is unusual.
Payment of 40,000 UAH [~$1,000] for one completed task. Payment in BTC/LTC/USDT/ I can wire it though an online money exchange. You need to perform as an arsonist once or repeatedly. You will burn, on YOUR choice, TTsK cars or their buildings. You chose the targets yourself. You can do it either at night or during the day. You can do it alone or with friends. I will explain the arson methods and combustible liquid options.
Reporting with video. All work is done anonymously.
I will send an example from the point of view of the performer, a “first-person video, “ as well as a video of a performed work. This is happening right now everywhere, all over Ukraine. If you are ready, write to me."
Text on the right:
"Hello! Looking for work? Which city?
Great! Look, we’re doing anti-TTsK!
Doing the most damage to them for money
We burn cars and the doors to their buildings
You approach, douse the door in combustible liquid, film the arson on video, and get out of there, all quick and well in 1 minute, the same with cars, pour the liquid in the radiator grill, light it, and get out, pay is decent and it’s done immediately to a card on binance
Interested?"
The messages received by Detector Media analysts from these recruiters (left, likely a human recruiter; right, likely a bot) show that these arsons are not limited to vehicles but also target buildings associated with military enlistment offices.
The screenshots show that the “recruiters” are also targeting arson attacks on TTsK-related premises.
In one of the screenshots, a recruiter states at the end, “This [vehicle arson] is happening right now everywhere, all over Ukraine.” Those behind the Telegram bots and recruiters are likely attempting to create the impression of an organized or spontaneous anti-government movement opposing mobilization in Ukraine. However, the Telegram ads offer money, not ideology, as the motivation for these acts.
This is corroborated by law enforcement. According to Prosecutor General’s Office spokeswoman Nadiya Maksymets, “About 90% [of vehicle arson cases] involve financial incentives. It’s simply the desire for easy money.”
Arson is just one level of the “assignments.”
“Requests don’t always start with car arson. It can be some easier requests, for example, to put up leaflets. Or to distribute them somewhere. And then, when this task is completed, the more difficult ones come in the form of car arson.,” says Maksymets.
Kyiv Police Chief Dmytro Shumeiko explains, “Enemy intelligence services offer money through social media - from 600 to several thousand dollars for setting cars on fire. But none of those who agreed ever received this money.”
Nadiya Maksymets confirms that Russian handlers do not pay those who agree to commit arson.
Russian agents are also using Telegram to recruit Europeans for sabotage operations against NATO military sites and equipment en route to Ukraine. This was revealed in an OCCRP investigation published on September 26, 2024. The report highlights known cases of recruitment in Estonia, Latvia, Germany, Poland, and other European countries. Russian intelligence services utilize Telegram chatbots for these recruitment efforts as well. According to Indrek Kannik, Director of the International Center for Defense and Security in Estonia, “Russia’s most important goal in carrying out sabotage is to create chaos and fear in Western societies, which will bring to power political forces that are willing to withhold support from Ukraine.”
Channels for the “Interested”
In addition to chatbots, analysts at the Detector Media Research Center discovered a Telegram channel with 7,600 subscribers, where videos of military vehicle arsons are shared. Ads for this channel were posted in job-seeking groups with audiences ranging from a few hundred to over ten thousand subscribers. Some of the job offers in these groups were linked to illegal activities such as drug trafficking, fraudulent call centers, and money laundering via foreign currency cards.
The administrators of this channel claim responsibility for the arson attacks on military property and claim that they paid the promised money. In a single post in Ukrainian, someone claiming to be the group’s leader mockingly responded to reports from law enforcement that arsonists were not paid for their crimes: “I watch the news, where they constantly claim I don’t pay...” Subsequently, he ridicules claims made by law enforcement about arsonists who weren’t compensated.
The only post in Ukrainian on this channel aims to discredit Ukrainian intelligence services
The channel’s administrators also spread propaganda and disinformation. In one post, they mock law enforcement’s attempts to counter the arson of military vehicles, calling the videos showing arsonists being caught red-handed “staged.”
The last post about a vehicle arson attack on the channel dates back to September 28, 2024. On September 24, the channel’s administrators announced a “temporary halt to vehicle arson operations” to ensure the safety of their “agents.” The criminals justify their actions by claiming they are targeting the “arbitrary actions of the military enlistment offices” but that the government has only increased pressure and granted enlistment offices’ employees “even more power.” At the end of the post, the administrators wrote that they “haven’t finished, but have found another approach,” promising that their audience would “understand everything soon enough.”
The channel’s last post about arson claimed responsibility for the act and announced a “temporary suspension of arson operations.”
The channel description includes a link to a chatbot offering services such as “kidnapping, violent actions, and vehicle arson.” On September 5, a video was posted on the Telegram channel showing a person in a gas mask claiming that their organization conducts “forceful operations on request.” The masked individual stated that they were hired to carry out actions “once performed by criminals in the 1990s.” The video also included clips of murders, torture, and arson.
Fuel for Russian Propagandists
Russian propaganda channels are exploiting reports of military vehicle arson to portray dissatisfaction among the Ukrainian public with the government, aiming to discredit the mobilization process in Ukraine. Propagandists depict the arsonists as part of a “resistance movement” or a “guerilla warfare.”
For instance, a propagandist with 608,000 Telegram subscribers described the arson of military vehicles in Ukraine as “a true epidemic of guerilla activities” that have nothing to do with Russia. They claim that “Ukrainian partisans do not consider themselves underground fighters and do not help the Russian army in coordinating missile strikes.” However, no evidence supports the existence of any “partisan movements”—only criminal cases in which arsonists admitted acting for financial gain.
Propagandists also use these incidents to suggest that public opinion of the military is worsening. A Telegram channel with a million subscribers claimed that public attitudes towards the military have shifted “from respect to hidden hatred.” However, this assertion is false. According to a sociological survey conducted by the Kyiv International Institute of Sociology at the request of the National Democratic Institute on May 8-25, 2024, by telephone interviews, 91% of respondents answered the question “To what extent do you trust the following institutions and authorities, if at all?” that they trust the Armed Forces of Ukraine. As part of the survey, 2,508 interviews were conducted, with a margin of error of less than 2.2%.
Russian intelligence services are using car arsons as a tactic in their sabotage warfare against Ukraine, relying not on their own operatives but on ordinary Ukrainian citizens lured by easy money. The greatest threat lies in the fact that arsonists are recruited not only through darknet forums but also via more accessible channels on Telegram, which reach a broader audience.
These car arson incidents become media stories for pro-Russian channels, which exploit them to reinforce their propaganda narratives. Despite attempts by propagandists to create the illusion of a politicized movement of arsonists, law enforcement data shows that these crimes are committed for financial gain, not ideological reasons.
Main page illustration and infographic by Nataliya Lobach
