Ukraine's Disruptive Operations 2025: Patterns, Campaigns & Russian Vulnerabilities. OSINT Analysis.
TLDR
The current article analyses all publicly reported partisan activities carried out in the temporarily occupied territories of Ukraine, the Russian Federation, and in third countries during 2025. The processing of all the published data has been essential for a proper understanding of sabotage operations and neutralisation attempts. The final conclusions offer valuable intelligence insights for anyone seeking to understand the real scope of disruptive operations. Processed data reveals interesting patterns, such as the decentralisation of most typical operations against cabinet relays and antennas, the persistent problems of Kadyrovite detachments deployed in the occupied territories, and the specialised campaigns against war criminals and tankers linked to the Russian shadow fleet. Analysed data also confirms Moscow constitutes an isolated island of partisan activity, and a summer campaign against chemical and gunpowder factories. Finally, the article demonstrates the capabilities of the Main Directorate of Intelligence of the Ministry of Defence of Ukraine (HUR) for designing and carrying out the most complex operations while the FSB Second Service remains ineffective at stopping both simple and specialised partisan operations.
Background
Ukraine’s summer review of partisan operations offers useful intelligence findings for anyone seeking to understand the true dimensions of sabotage and neutralisation activities in both Russia and the temporarily occupied territories of Ukraine. Previously processed information has laid the groundwork for a more accurate understanding of the multiple, decentralised operations carried out in a highly multifaceted and repressive environment. Nevertheless, the summer article presented a picture with some partiality of disruptive operations, and highlighted the critical need for accurate inputs for any intelligence analyst seeking to understand the true characteristics of partisan activities and the serious challenges facing Putin’s regime and the Russian Army as occupiers.
It is important to note that all reported and claimed activities from 2025 have been included and processed in the current analysis. The previously developed Bubble theory is applied to provide a clear understanding of subversive operations. Accordingly, three types of activities are defined. Bubble 1 (activities targeting cabinet relays, locomotives, airfields, random facilities/targets, substations, and other energy infrastructure), Bubble 2 (activities aimed at destroying factories, malls, and warehouses), and Bubble 3 (neutralisation, neutralisation attempts, and special operations involving several layers of security and multiple actors).
What is happening
The processing and analysis of data gathered throughout 2025 has provided notable information. For example, initial findings suggested partisan operations in the temporarily occupied territories and third countries were showing a curious pattern. A closer look at monthly data from January to December 2025 confirms different waves rather than continuous escalation. These waves support the hypothesis that such patterns are largely secondary effects of hit-and-run operations led by Ukrainian intelligence under Russian occupation and in a highly repressive environment. Successful execution of these disruptive activities requires a complete cycle of direction, intelligence gathering, processing, and analysis. This structured approach underscores Russian counterinsurgency efforts (usually presented as “counterterrorism”) are failing to achieve results in the occupied territories.
Analysis of data on partisan and sabotage activity inside the Russian Federation exposes sharp growth during 2025. The main hypothesis could not be clearer: units countering sabotage and targeted elliminations (the FSB Second Service) are proving largely ineffective -likely because they are primarily accustomed to cracking down on domestic political dissent- while most sabotage operations remain highly decentralised across Russian territory and extremely adaptive. As a result, they are placing considerable strain on Putin’s regime capabilities.
The table of partisan operations by bubble illustrated patterns explained in my previous article. Although it’s not a perfect way to tailoring data, it illustrates the characteristics of disruptive operations in Russia, in the temporarily occupied territories of Ukraine, and in third countries. It is noteworthy that at least 24 Bubble-3 attacks reported were carried out during the Spiderweb operation, while the others consist of neutralisation and neutralisation attempts. Consequently, the number of neutralisations in the temporarily occupied territories is significantly higher than those carried out in Russia.
Another key finding relates to Bubble-2 sabotage activities in the temporarily occupied territories of Ukraine. These reported activities are minimal in comparison with those conducted in the territory of the Russian Federation. It is worth noting most reported Bubble-2 operations involve sabotage against warehouses. Thus, the nature of targeted Bubble-2 targets (factories, malls, warehouses, and other secured and guarded installations) varies according to their location.
Usually, most partisan operations against warehouses located inside Russia target suppliers to the Russian military —excluding those fires whose nature could not be verified as sabotage. By contrast, the same type of disruptive activities against warehouses located in the temporarily occupied territories of Ukraine primarily target logistical assets clearly linked to frontline areas. This explains two key things: the lower number of reported Bubble-2 activities in the occupied territories, and the high frequency of drone attacks reported against warehouses throughout the territories occupied by Russia. It is important to note that safeguarding HUMINT sources should always be prioritised in order to avoid exposing partisan cells in the occupied areas. Consequently, intelligence gathering carried out by partisans is almost invisible, but is providing important results in other fields.
Processed information also shows Bubble-1 activities constitute the main sabotage operations carried out inside Russia. These reported activities focus on cabinet relays and antennas. A stark contrast is also evident in our analysis, particularly between Bubble-1 and Bubble-3 operations. The latter, characterised by their complexity, are mainly carried out by the Main Directorate of Intelligence of the Ministry of Defence of Ukraine (HUR) and not by locally established cells.
The high number of neutralisations and neutralisation attempts reported during the last year (52 in 2025) provides clear evidence of HUR’s penetration deep into the occupied territories. This is a notable contrast in comparison to the same type of activities carried out in Russia. Secondarily, this trend offers another intelligence insight: the relative independence of Bubble-1 operations (sabotage actions carried out by locally established cells in a decentralised manner). Tailored data also highlights the pronounced contrast in Bubble-2 activities between the occupied territories and Russia. Reported operations against secured installations and critical infrastructure are minimal when compared with those carried out in Russia.
Processed information exposes a major challenge for Russia both as an occupier and as a country: with 30 neutralisations and neutralisation attempts, Russian authorities have been unable to halt HUR operations, while they face the same difficulties with independent cells conducting most of the typical sabotage operations against cabinet relays and antennas (with minimal damage to EW and defence systems) across Russian territory.
A close analysis of partisan activities carried out in the temporarily occupied territories of Ukraine and in third countries highlights several active campaigns developed during 2025. The first -and most prominent- is the ongoing campaign against tankers linked to the Russian shadow fleet. Other patterns emerged during the analysis, involving vessels that operated at Novorossiysk port or belonged to the Russian Navy. The clearest examples include the incidents reported involving the Seacharm, the Kildin-class destroyer, the Seajewel oil tanker, the Grace Ferrum chemical tanker, and others. During this campaign, Russian oil shadow fleet companies were clearly identified by OSINT analysts.
Filtered data from 2025 indicates the 70th Guards Motorized Rifle Regiment (headquartered in the Chechen city of Shali) suffered multiple Bubble-3 attacks. At least nine neutralisations or neutralisation attempts against Chechen targets were clearly identified during the year. As previously noted last summer, these units are deployed without establishing territorial control. At the same time, Chechnya remains a stateless nation, and some units are suffering partisan attacks, raising the hypothesis this stems from information leaked by personnel deployed against their will. This regiment is experiencing targeted elliminations from HUR while also engaging in illegal activities. Other units (such as Akhmat Vostok) are facing the same problems. Thus, the pattern is evident.
Processed data also reveals several neutralisation operations. For example, hit and run activities against patrolling units moving through the occupied territories are a common trend. The same pattern applies to operations aimed at neutralising individuals (such as Yevgeny Bogdanov, Manolis Pilavov, Mikhail Gritsay, and other collaborationists killed in August) who were working with the Russian authorities. This type of operation highlights Russian vulnerabilities as occupiers and the low acceptance among the local population.
It is important to note a clear pattern exists in both Russia and the occupied territories: targeted elimination attempts against people involved in Russian war crimes or the Russian military industry. The clearest examples include activities against the 76th Airborne Assault Division of the Russian Armed Forces (involved in Bucha war crimes) and the neutralisation/neutralisation attempts of Konstantin Nagayko, Armen Sargsyan, Yevgeny Rytikov, Andrey Kondratiev, and Zaur Gurtsev.
Specialized operations, such as the one targeting several FPV drone operators who were injured after IEDs hidden in goggles detonated in June, demonstrate two coexisting realities: Ukraine’s capability to develop the most complex activities under a highly repressive environment and a multi-pronged focus.
The high number of cabinet relays destroyed in the temporarily occupied territories confirms the independence of Bubble-1 activities from the more complex targeted elimination operations carried out by the HUR. Finally, regarding the only partisan operation reported in Belarus, I’m skeptical about the fire reported at the Naftan oil refinery in Navapolatsk (11 June 2025). It was reported as a possible disruptive operation, but evidence suggests it was simply a fire.
Tailored data on sabotage operations in Russia exposes a different environment from those activities carried out in the temporarily occupied territories. Bubble-1 operations (disruptive actions against cabinet relays and antennas) were the most typical reported actions and showed notable growth during 2025, with a sharp increase in November and December.
As noted earlier, a campaign against war criminals and people involved in the Russian military industry was identified, but other patterns emerged during 2025. For example, a second campaign targeted chemical and gunpowder factories (such as the Limpek chemical factory, the Perm gunpowder factory, or the “Elastic” gunpowder factory in Lesnoy) and a third targeted companies linked to the Russian Army —including the UralAZ MRAPs factory, the Onega Shipbuilding Plant, the APZ-20 bearing factory in Kursk, the Avangard defence plant in Saint Petersburg, the Zarya plant in Dzerzhinsk, and others.
I have doubts about classifying some partisan activities, such as the destruction of two “Zhitel” systems —Russian EW complexes— at the Protek plant (27 January 2025), or the two radars destroyed in Dolgoprudny (6 February 2025). Both appear to be HUR operations that could be classified as Bubble-3 sabotages due to the complexity and multiple actors and sources of intelligence involved.
I choose to retain some reported fires on warehouses despite limited information. Several warehouse fires have been reported or shared on social media without adequate verification. For the same reason, the fire reported at Pravoberezhny Market (December 10, 2025) should be excluded from the analysis. The conclusions would remain unchanged if the ten dubious Bubble-2 attacks (nine on warehouses and one market) were excluded. Typically (based on the most filtered and verified data), those reported fires involved supply providers to the Russian Army.
Analysed data also confirms Moscow constitutes an independent bubble, especially when it comes to neutralisation and neutralisation attempts. At least 10 neutralisation/neutralisation attempts were reported in 2025. For additional context, I published another article, but neutralisation attempts are generally minimal outside Moscow, while the most typical partisan activities target cabinet relays and antennas. Analysed data also confirms Bubble-1 operations remain independent from other Russian regions. At this point, we can conclude the FSB is facing considerable problems in Moscow: they have been unable to prevent most targeted elimination operations and the most simple and independent cells destroying cabinet relays and antennas.
The FSB’s Second Service is facing same difficulties in stopping independent cells operating across Russia. As demonstrated in the previous article, gathered and tailored data on partisan operations —classified according to their level of complexity— illustrate several campaigns, Russian vulnerabilities, and characteristics of partisan warfare adapted to the reality on the ground. The different types of partisan bubbles are operating independently and are highly adaptive.
The graph of partisan activities by region reveals some interesting patterns. For example, Zaporizhzhia and Kherson lead the number of reported operations. This is unsurprising when we consider Crimea and parts of Donetsk and Luhansk have been occupied for over a decade. As a result, Putin’s regime has had considerably more time to suppress Ukrainian dissidence, while HUMINT sources have primarily supported other types of operations (such as gathering information for future drone attacks).
Analysing partisan operations by region is essential —at least if we want to understand the real scope of partisan activity inside Russia. The filtered data highlights five major areas of disruptive operations. The most active regions are Moscow, Saint Petersburg (and Leningrad Oblast), Sverdlovsk, Rostov, and Stavropol Krai. In the remaining oblasts, a pattern of decentralised operations emerges, primarily targeting railway infrastructure and antennas.
CONCLUSIONS
2025 has generated intelligence insights about the nature of disruptive operations carried out in Russia, the temporarily occupied territories, and third countries. Processed data indicates that partisan operations are geographically dispersed and highly adaptive. At the same time, the analysis of the most complex operations led by Ukrainian intelligence demonstrates multiple campaigns against various targets linked to the Russian army and Putin’s regime.
Bubble theory is useful for understanding the real scale of partisan operations and the importance (and independence) of Bubble-1 operations (typically aimed at destroying cabinet relays and antennas) in both Russia and the occupied territories. It is almost certain that this type of activity will continue undisturbed during 2026. The FSB Second Service has proven ineffective at pursuing locally established cells.
The nature of Bubble-3 and Bubble-2 activities highlights a high level of focus and multiple sources of intelligence involved in the most complex campaigns carried out by the Main Directorate of Intelligence of the Ministry of Defence of Ukraine (HUR). It is very likely that these operations will continue during the coming months.
Finally, the analysis of Bubble-3 operations demonstrates an ongoing campaign against Kadyrovite units and, in particular, the 70th Guards Motorized Rifle Regiment. This pattern was identified during last summer’s partisan analysis and has since expanded to other units such as Akhmat Vostok. Pattern analysis also uncovers the high level of Ukrainian intelligence capability in surveilling illegal activities in which these units are involved. This indicates that Chechen soldiers may be cooperating with various branches of Ukrainian intelligence.