Analysis of Partisan Operations in Russian-Occupied Territories and Third Countries: First Half 2026 Review
5/26
BLUF
Analysis of gathered data on partisan activities in the temporarily occupied territories of Ukraine during the first half of 2026 provides key insights into disruptive operations. Processed data reveals new patterns, with a decline in assassination attempts (hit-and-run attacks and IED operations). The findings also raise the hypothesis about a crackdown on local cells and exfiltrations carried out by the Main Directorate of Intelligence of the Ministry of Defence of Ukraine (HUR) and the Security Service of Ukraine (SBU) in the occupied areas of Donetsk and Zaporizhzhia. Open-source data also indicates minimal changes within the structure of partisan networks, due to their highly adaptive nature and decentralisation. It is important to note all reported and claimed activities during the first half of 2026 were categorised into three distinct bubbles. Bubble 1 (activities targeting signal relay cabinets, locomotives, airfields, ancillary targets, substations, and other energy infrastructure), Bubble 2 (activities targeting factories, malls, and warehouses), and Bubble 3 (elimination, elimination attempts, and complex operations involving multiple layers of security and coordination among various actors). Finally, no disruptive activities have been detected in third countries during the analysed period.
Findings
1. The patterns of reported partisan activity do not match month-over-month when compared to the same period in 2025. Disruptive activities have declined since April 2026. Comment: Processed data indicates a shift in the partisan operational environment. End Comment.
2. During the first half of 2026, at least 10 partisan operations were claimed in Kherson Oblast, alongside 7 in Luhansk Oblast and 6 in Crimea. Sabotage activity in the Russian-occupied areas of Donetsk and Zaporizhzhia remains minimal. Comment: Claims of disruptive actions lacking confirmed geolocation were primarily attributable to groups active in occupied Kherson. End Comment.
3. Processed data indicates eliminations and elimination attempts (14) represent the most frequently reported type of operation in the Russian-occupied territories. Sabotage against signal relay cabinets and railway infrastructure (5) constitutes the second most common category based on available intelligence. Comment: Target dispersion continued during the first half of 2026, with 3 operations against antennas and EW assets recorded. End Comment.
4. Eliminations and elimination attempts have not been recorded since April 2026. The overall decline in claimed partisan activity is largely attributable to this halt. Comment: This trend suggests a shift in partisan operational focus, possibly linked to repressive measures by occupation authorities. End Comment.
5. Bubble 2 operations are rarely reported as part of sabotage activity in the Russian-controlled areas. Comment: This is consistent with Ukrainian tactics in these areas. End Comment.
6. No disruptive activities were claimed in third countries during the first half of 2026. Comment: The number of reported activities in third countries was low in 2025, but 5 of them occurred during the first half of 2025. End Comment.
Assessment
Available open-source intelligence suggests a shift in the partisan operational environment, evidenced by the cessation of elimination attempts since April 2026. There is moderate confidence that this pattern will remain unchanged in the coming months. These shifting patterns are raising new hypotheses about a crackdown on partisan cells, as well as exfiltration operations by the HUR and the SBU, especially in occupied Donetsk and Zaporizhzhia. Notably, assassination attempts and IED operations focused on Russian soldiers (and Chechen units) were not documented during the first half of 2026 in the Russian-occupied areas.
It is almost certain that the characteristics of partisan operations will remain unchanged during the remainder of the current year. The crackdown on Ukrainian citizens living in the occupied areas is shaping local activists’ activities through three layers of operations (Bubble 1, Bubble 2 and Bubble 3 activities) characterised by target dispersion. This trend explains the resilience of sabotage operations against railway infrastructure and antenna/EW systems.
The available information strongly indicates the operational independence of Bubble 3 operations (mostly IED and hit-and-run attacks) from Bubble 2 and Bubble 1 operations. There is high confidence that this trend will persist in the long term. Bubble 2 operations are rarely reported among sabotage activity in the occupied territories because these targets are usually destroyed by OWA-drones. It is almost certain that this trend will remain unchanged throughout 2026.
Outlook
Short Term: The decline of elimination attempts in the Russian-occupied territories constitutes the most significant shift observed during the first half of 2026. It is very likely that this trend will remain unchanged over the coming months.
Medium Term: Processed intelligence indicates with moderate confidence that notable changes in assassination and assassination attempts are expected in the medium term. The available data suggests shifts in the operational environment due to the intensified crackdown on partisan cells, as well as possible exfiltration operations by Ukrainian intelligence agencies.
Long Term: The overall structure of disruptive operations in the Russian-occupied territories will likely remain unchanged. It is almost certain that partisan cells will remain highly adaptive, operating through locally established and decentralised networks. The question of whether high-risk operations will continue to decline remains open throughout the second half of 2026.
Indicators and warnings
The absence of assassination attempts and IED operations against Russian soldiers and local collaborationists in the occupied territories during 2026. Key indicators include the publication of partisan exfiltration operations by Ukrainian media outlets and official Telegram channels of the HUR and the SBU. The publication, by Russian media outlets and Z channels, of operations against partisan cells in the occupied territories.
The lack of partisan operations against Russian assets in third countries during 2026. Key indicators include raids on intelligence personnel deployed in third countries and local reports from third countries media. Official HUR statements are a second key indicator.
Changes in Bubble 1 operations in the occupied territories during 2026. Key indicators include the publication by Russian media outlets and Z-channels of operations against local partisan cells in the occupied territories.
Reporting of disappearance and torture cases involving Chechen soldiers who were previously deployed in occupied Ukraine. Key indicators include reports from NGOs and Chechen opposition media on torture and disappearance cases of soldiers who allegedly collaborated with Ukrainian intelligence.