Ukraine has cultivated a network of agents and sympathizers inside Russia working to carry out acts of sabotage against Russian targets and has begun providing them with drones to stage attacks, multiple people familiar with US intelligence on the matter told CNN.
US officials believe these pro-Ukrainian agents inside Russia carried out a drone attack that targeted the Kremlin in early May by launching drones from within Russia rather than flying them from Ukraine into Moscow.
It is not clear whether other drone attacks carried out in recent days – including one targeting a residential neighborhood near Moscow and another strike on oil refineries in southern Russia – were also launched from inside Russia or conducted by this network of pro-Ukrainian operatives.
But US officials believe that Ukraine has developed sabotage cells inside Russia made up of a mix of pro-Ukrainian sympathizers and operatives well-trained in this kind of warfare. Ukraine is believed to have provided them with Ukrainian-made drones, and two US officials told CNN there is no evidence that any of the drone strikes have been conducted using US-provided drones.
Officials could not say conclusively how Ukraine has managed to get the drones behind enemy lines, but two of the sources told CNN that it has established well-practiced smuggling routes that could be used to send drones or drone components into Russia where they could then be assembled.
‘Cash works wonders’
A European intelligence official noted that the Russian-Ukrainian border is vast and very difficult to control, making it ripe for smuggling – something the official said the Ukrainians have been doing for the better part of the decade that they’ve been at war with pro-Russian forces.
“You also have to consider that this is a peripheral area of Russia,” the official said. “Survival is everyone’s problem, so cash works wonders.”
Who exactly is controlling these assets is also murky, the sources told CNN, though US officials believe that elements within Ukraine’s intelligence community are involved. Ukrainian President Volodymyr Zelensky has set general parameters for what his intelligence and security services are allowed to do, two of the sources said, but not every operation requires his sign-off.
Asked for comment, a spokesperson for the head of the Ukrainian Security Service suggested to CNN that the mysterious explosions and drone strikes inside Russia would continue.
“We will comment on instances of ‘cotton’ only after our victory,” he said. Quoting the head of the Security Service, Vasyl Malyuk, the spokesperson added that regardless, “‘cotton’ has been burning, is burning, and will continue burning.”
“Cotton” is a slang-word that Ukrainians use to mean explosions, usually in Russia or Russian-occupied territories in Ukraine. Its origins date back to the early weeks of the war and stem from the fact that the Russian word for a “pop” is very similar to the Ukrainian word for cotton.
‘A culmination of months of effort’
There has been a steady drumbeat of mysterious fires and explosions inside Russia over the last year, targeting oil and fuel depots, railways, military enlistment offices, warehouses and pipelines. But officials have noticed an uptick in these attacks on Russian soil in recent weeks, beginning with the attack on the Kremlin building. It appears to be “a culmination of months of effort” by the Ukrainians to set up the infrastructure for such sabotage, said one of the sources familiar with the intelligence.
“There has been for months now a pretty consistent push by some in Ukraine to be more aggressive,” this person said, speaking anonymously because of the sensitivity of US intelligence. “And there has certainly been some willingness at senior levels. The challenge has always been their ability to do it.”
Ukraine’s military intelligence chief, Kyrylo Budanov, has consistently proposed some of the most brazen plans for operations against Russia and values symbolic acts, US officials told CNN.
Classified Pentagon documents leaked online earlier this year revealed that the CIA urged Budanov to “postpone” attacks on Russia on the anniversary of its invasion of Ukraine, according to the Washington Post. Budanov agreed to the CIA’s request, the classified documents reportedly said. But drones were spotted near Moscow on February 28, just days after the one-year anniversary of the war.
Another leaked US intelligence report obtained by CNN, which is sourced to signals intelligence, says that Zelensky in late February “suggested striking Russian deployment locations in Russia’s Rostov Oblast” using drones, since Ukraine does not have long-range weapons capable of reaching that far.
It is not clear whether that plan moved forward, but oil facilities in Rostov Oblast have caught on fire after being hit by suspected drones several times over the last year – attacks Russia is now investigating and has blamed on “criminal actions by the Armed formations of Ukraine.”
“All I will comment on is that we’ve been killing Russians,” Budanov told Yahoo News last month when asked about the car bomb attack that killed the daughter of a prominent Russian political figure in Moscow’s suburbs last year. The US intelligence community assessed that that operation was authorized by elements within the Ukrainian government.
“And we will keep killing Russians anywhere on the face of this world until the complete victory of Ukraine,” Budanov added.
A savvy military strategy
Publicly, senior US officials have condemned the strikes inside Russia, warning of the potential for an escalation of the war. But speaking privately to CNN, US and western officials said that they believe the cross-border attacks are a smart military strategy that could divert Russian resources to protecting its own territory, as Ukraine gears up for a major counteroffensive.
On Tuesday, the UK’s Foreign Secretary told reporters that Ukraine has “the right to project force beyond its borders to undermine Russia’s ability to project force into Ukraine itself. Legitimate military targets beyond its own borders are internationally recognized as being part of a nation’s self-defense…We should recognize that.”
French Vice Admiral Nicolas Vaujour, chief of operations of the Joint Staff, told CNN on Friday that the attacks inside Russia are merely “part of war” and offer an opportunity to send a message to Russia’s population.
“There is a war there and it could concern you [the Russian public] in the future,” Vaujour said of the attacks. “And so it’s a good way for Ukrainians to address a message not only to Vladimir Putin, but to the Russian population,” he added.
Regarding the attacks, he said that it wasn’t “forbidden” for Ukraine to think about that.
Ukrainian officials, moreover, have said privately that they plan to continue the attacks inside Russia because it is a good distraction tactic that is forcing Russia to be concerned with its own security at home, according to a US source who has spoken to Ukrainian officials in recent days.
In an intelligence update, the UK Ministry of Defense said that attacks by pro-Ukrainian partisan groups and drone strikes in the border region of Belgorod have forced Russia to deploy “the full range of military firepower on its own territory.”
“Russian commanders now face an acute dilemma,” the update said, “of whether to strength defences in Russia’s border regions or reinforce their lines in occupied Ukraine.”
CNN’s Jennifer Hansler, Alex Marquardt and Oren Liebermann contributed to this report.