Full Report
Ukrainian officials say Russian intelligence is using video games to trick children into helping the enemy
Analysis Summary
# Threat Actor: Russian Intelligence Services (FSB) utilizing Civilian Assets
## Attribution & Identity
Attribution is explicitly linked to **Russia's Federal Security Service (FSB)**, informed by statements from the Security Service of Ukraine (SBU) and Ukrainian National Police. The activity involves recruiting and leveraging Ukrainian minors. A specific "liaison officer" for the FSB, identified as a police officer from **Krasnodar, Russia**, has been charged in absentia.
## Activity Summary
The primary activity detailed is the recruitment of Ukrainian children, some as young as 15, to conduct reconnaissance and sabotage operations under the guise of participating in "quest games."
* **Reconnaissance:** Children were tasked by the FSB to visit specific real-world locations, take videos and photos, and describe the surroundings. This intelligence was used to guide more accurate Russian air strikes, specifically mentioned targeting **Kharkiv**.
* **Sabotage:** In a separate campaign, children were instructed to commit arson, specifically targeting **electricity transformers**.
* **Apprehension:** Children involved in photographing Ukrainian air defense installations were reportedly apprehended and detained by the SBU.
This activity is framed as part of a broader hybrid Russian threat, referencing past successful intelligence campaigns, such as hacking domestic surveillance cameras in Kyiv to guide missile strikes (blocked SBU activity involved around 10,000 cameras since Feb 2022).
## Tactics, Techniques & Procedures
* **Masquerading/Deception:** Exploiting minors by framing espionage and sabotage tasks as harmless "quest games."
* **Human Intelligence ("HUMINT") Collection via Non-Traditional Assets:** Utilizing children for physical reconnaissance of sensitive locations (including air defense installations).
* **Targeted Physical Sabotage:** Instructing assets to commit arson attacks against critical infrastructure (electricity transformers).
* **Secure Communication:** Using **anonymous chat rooms** to transmit collected geolocation data and reconnaissance details back to an FSB supervisor.
* **Geospatial Targeting:** Using collected geolocation data to facilitate precise subsequent **air strikes**.
## Targeting
* **Sectors:** Critical Infrastructure (Electricity/Energy), Military/Defense Infrastructure (Air Defense Installations).
* **Geography:** Ukraine, specifically mentioning operations linked to **Kharkiv**.
* **Victims:** The Ukrainian state and infrastructure owners (e.g., energy grid). The immediate victims of recruitment were **Ukrainian children aged 15 and 16**.
## Tools & Infrastructure
* **Malware families used:** No specific malware is mentioned in relation to this child recruitment operation. (For context, the article mentions other Russian actors previously hacking surveillance cameras and an IT specialist recruited via Telegram, but these are separate incidents.)
* **Infrastructure (C2, domains, IPs):** **Anonymous chat rooms** were used for exfiltration of intelligence.
## Implications
This revelation exposes a significant escalation in Russia's use of unconventional human intelligence gathering, deliberately exploiting vulnerable populations (minors) to conduct acts of sabotage and provide precise targeting data against military and civilian infrastructure. This tactic blurs traditional lines of cyber/physical conflict and exploits social structures within the targeted nation.
## Mitigations
* Increased public awareness campaigns within Ukraine targeting parents and educators regarding online recruitment scams framed as "games" or "quests."
* Enhanced physical security monitoring around critical infrastructure, particularly electricity substations, to deter and detect arson attacks.
* Continued aggressive investigation and prosecution (as seen by the SBU) of known recruiters and liaison officers associated with these schemes (e.g., charges under Part 2 of Article 113 of the Criminal Code of Ukraine).