An intelligence war rages as a network of Russian agents constantly attempt to penetrate Ukraine’s defences, and recently succeeded in killing a colonel
Maxim Tucker
July 18, 2025
The Times
The street where the life of Colonel Ivan Voronych was ended by an assassin’s gun should have been safe. The hitman emerged from behind a parked car in a residential complex in Kyiv and shot him five times with a silenced pistol in broad daylight. The complex had security guards at the entrance and was home to dozens of fellow officers from Ukraine’s SBU domestic security service.
Ukrainian intelligence officers say the killing of Voronych on July 10 was the first successful Russian hit on a high-ranking Ukrainian officer since the full-scale invasion began in 2022. The operation triggered an extensive manhunt that ended in a shootout between the two suspects and authorities on July 13. Both suspects were killed.
An investigation is under way into how the killers were able to enter the country, obtain weapons, infiltrate the complex and take out their target.
The Times spoke to current and former Ukrainian intelligence officials, as well as international security experts, to piece together events leading up to Voronych’s death and its aftermath.
They spoke of a recruitment campaign by the FSB, Russia’s state security agency, under way not only in Ukraine, but elsewhere in Europe and in the United States. In the near future, they predicted, Russian and Ukrainian intelligence officers would be warring not only on the streets of their respective countries, but across the globe.
A man of many talents
Voronych, 50, was a career intelligence officer from the Carpathian region of western Ukraine. He joined the SBU in 1998 and moved to Kyiv to work in counterintelligence after Russia’s hybrid invasion in 2014. A close former colleague described him as “a calm, very quiet man, who kept himself in excellent physical condition.”
He often volunteered for dangerous missions. Despite his age, Voronych joined SBU’s elite ‘Alpha’ special forces unit and took part in operations behind enemy lines in Russia’s Kursk region, Ukrainian intelligence sources said. One source alleged he was also the architect of the 2015 ambush and assassination of Alexei Mozgoviy, the leader of ‘Ghost’, a Russian proxy force in eastern Ukraine.
The colonel had even used naval drones against Russia’s Black Sea fleet, sources said, and was a deputy in the unit of Colonel Roman Chervinsky, reported by the Washington Post to have been a “coordinator” of the bombing of the Nord Stream pipeline. Any one of these connections could have led to him being targeted by the Russians, sources said.
Infiltrating Kyiv
In spring, the FSB hired two hitmen from Azerbaijan through an organised crime syndicate, Ukrainian intelligence sources said. One, a woman, had crossed into Ukraine from Moldova in May, but her male partner was denied entry because of past convictions. The SBU is now investigating how he managed to later enter the country. “These guys then picked up weaponry and some radios, now there is a major operation to find out who was the guy responsible for setting up this cache. That’s someone who is a bit higher up the food chain,” said Ivan Stupak, a former SBU agent who now advises parliament on security issues. “Maybe the FSB has some additional assets in Ukraine.”
The residential complex, a legacy from Soviet times where KGB officers lived together in a gated community, was an obvious target. “It’s a nonsense [that] the officers still live all together there, a whole town of them,” said Major General Viktor Yahun, a career officer who served as deputy head of the SBU until he retired in 2015.
“And instead of our own machine gunners, they had a private security firm, who my old colleagues suspect has connections to the Luhansk People’s Republic,” he said, referring to a Russian proxy force in eastern Ukraine.
Yahun added that the FSB needed only to cross reference a list of agents taken from Ukraine in 2014 against the security firm’s list of occupants to discover who lived in the complex, which is now also inhabited by civilians.
The manhunt
The colonel’s assassin was caught on CCTV fleeing the scene after executing his target from close range. Hundreds of SBU and police officers were deployed to interview witnesses, review surveillance camera footage, and search for suspect cellphone signals. “At least a hundred people were interviewed, starting from the neighbours to the parking lot attendant and the waitress at the nearest restaurant,” said Stupak.
“They checked the cameras on pharmacies, restaurants, grocery stores. And of course the mobile operators, to find out what kind of mobile device appeared in this particular region that day, the day before yesterday, maybe a week ago but was previously never there,” Stupak added. “Just an incredible number of secret activities were conducted.”
The SBU said the suspects had attempted to hide out in a village outside Kyiv, but were located within 72 hours and killed in a shootout when they attempted to resist arrest. “I want to remind everyone: the only future for the enemy on Ukrainian soil is death,” said Vasyl Maliuk, the head of the SBU, who said the suspects had been reporting to a “Russian handler”.
The worldwide web of FSB recruiters
Late last year President Putin’s spy agency accelerated attempts to recruit the young, vulnerable, impoverished or pro-Russian from Ukrainian society as spotters or saboteurs. Noticing the increase in activity, the SBU launched a public awareness campaign, “Burn the FSB agent” in December, to warn against Russian intelligence recruitment tactics.
Typically this involves targeting teenagers, gambling addicts or people previously registered as voters for pro-Russian parties, reaching out online to offer them payment for minor tasks such as graffiti or delivering an item. Gradually, the tasks become more significant, such as arson, sabotage or even assassination, with an increased wage to match.
Over the past year, several unsuspecting children have been injured after packages they had been asked to deliver exploded or burst into flames. Some 175 minors have been arrested, accused of carrying out tasks for Russian intelligence.
The same tactics now appear to be being employed outside of Ukraine albeit with a twist. An online white supremacist group called “The Base”, purportedly run out of Russia by Rinaldo Nazzaro, a former contractor for the Pentagon and analyst for America’s Department of Homeland Security, has been recruiting saboteurs. On Wednesday the group claimed responsibility for the murder of Voronych.
“We know from their activities in the US and in Europe, that this is a serious group involved in real world terrorism and violence; there have been numerous arrests over the past five or six years,” said Steven Rai, a research analyst at the Institute for Strategic Dialogue, a UK organisation that partners with western governments to combat extremism. “Now the Base is offering cryptocurrency payment to individuals who are willing to conduct acts of violence in Ukraine.”
Rai said it was “inconceivable” the group would be operating without the knowledge of the Russian intelligence services, and that several features, including preferred social networks based in Russia, bot networks and payment options pointed to an affiliation with Russian intelligence.
War of assassins
Ukraine’s intelligence services have carried out a number of bold assassinations inside Russia of officers and pilots they have accused of war crimes. Yet the Ukrainian reaction to Voronych’s killing would be different, vowed Major General Yahun. “It will be the same level as Operation Spider’s Web,” he said, referring to a sophisticated drone attack on Russian airfields last month.
The intelligence war would continue long after combat in the trenches has finished, with spies gunning each other down in the streets of foreign capitals, Stupak predicted. “The Russians will be looking for Ukrainian agents in Europe. The Ukrainians will not want to kill Russian agents on allied soil, but probably in Thailand, Africa, places like that,” he said. “These assassinations are going to continue across the globe for years to come.”
The SBU declined to comment during the reporting of this article. After publication, it gave the following statement denying some of the information provided by The Times’ sources: “Neither SBU Colonel Ivan Voronych nor the Ukrainian special services had any involvement in
damaging the Nord Stream pipeline. Colonel Voronych was not involved in any SBU special operations using naval drones against the Black Sea Fleet of the Russian Federation or any special operations behind enemy lines in the territory of the Kursk region of the Russian Federation.”
Maxim Tucker was Kyiv correspondent for The Times between 2014 and 2017 and is now an editor on the foreign desk. He has returned to report from the frontlines of the war in Ukraine since Russia’s full-scale invasion in February. He advises on grantmaking in the former Soviet countries for the Open Society Foundations and prior to that was Amnesty International’s Campaigner on Ukraine and the South Caucasus. He has also written for The Telegraph, The Guardian, The Independent, Newsweek and Politico.