Those Who Work in the Shadows: How the SBU’s Agent Network Makes the Most Complex Special Operations Possible
Kyiv • UNN
The SBU’s agent network provided the logistics and secrecy for “Spiderweb.” Experts called it the foundation of the special operation to destroy Russian aviation.
The Security Service of Ukraine's "Spiderweb" special operation, during which Ukrainian drones attacked Russia's strategic aviation, became an example of how intelligence work behind enemy lines can determine the success of a large-scale military operation. Military experts and former SBU officers explained to UNN why even the most modern technologies are unable to replace agents working directly in enemy territory, and how Ukrainian intelligence services manage to conduct complex operations deep behind russia's lines.
The role of the intelligence network in the "Spiderweb" special operation
The "Spiderweb" special operation, conducted by the SBU on June 1, 2025, demonstrated that modern warfare is waged not only on the battlefield. The successful strikes on Russian military airfields were preceded by prolonged work by Ukrainian intelligence services, which managed to organize complex logistics, ensure secrecy, and coordinate actions directly in enemy territory.
The intelligence network was a key element of the operation, without which the plan would have been impossible to implement.
As Vasyl Maliuk, who headed the SBU at the time, previously said, to carry out "Spiderweb," Ukrainian intelligence services established a front logistics company in Chelyabinsk, Russia. The agents rented an office and warehouses near the local FSB directorate, purchased five trucks, and hired drivers who carried out ordinary commercial transportation.
It was through this logistics infrastructure that the delivery of special structures containing drones to Russian military airfields was subsequently organized.
"Spiderweb" is a unique, multi-stage operation that includes a number of critically important components. First and foremost, there is logistics—that is, delivering the means themselves to the enemy's rear; in our case, 150 combat FPV drones. This includes delivering the structures inside which the equipment was transported to the airfields. It also involves intelligence work, communications, and much more. If we look at "Spiderweb" as a whole, we see an integrated approach: intelligence and technical. And our work becomes most effective precisely when there is the right symbiosis
But working with an intelligence network is always difficult, which is why complications also arose during the implementation of "Spiderweb."
"Essentially, there were some complications every week. Well, as for what can be disclosed... The operation was carried out on June 1; we had planned to do it much earlier. But there were many different issues in the enemy's rear that had to be resolved. But one of the issues—and this is a humorous note—is that we had planned to do it before May 9, but during Easter they went on a 'bender' there, excuse me, they abused alcohol heavily (…) One driver is missing, then another, you understand? Then on May 1 they have their 'May Day holiday,' and they lie around for a week; they're unavailable. Then May 9. We really lost a month, I'm telling you frankly, precisely because of this underlying cause," Maliuk shared.
Schematic depiction of trucks with retractable roofs in which the drones were transported
Vasyl Maliuk said that only a limited circle of people knew the detailed plan of "Spiderweb." According to UNN, former First Deputy Head of the SBU Department for the Protection of National Statehood Serhii Duka was also involved in planning and preparing the "Spiderweb" special operation. The Russian aircraft were hit by drone operators from the SBU's Special Operations Center "A." The Ukrainian agents who worked directly in russia left enemy territory before the operation's final stage began.
Actual photo of the drones that attacked Russian aircraft
Why large-scale special operations are impossible without intelligence networks
Former SBU Counterintelligence Department officer and military expert Kostiantyn Korsun emphasizes that the intelligence component was the foundation of "Spiderweb," while the drones served as the tool for the final stage.
If we are talking about Operation "Spiderweb," then, in my opinion, its agent-based component was its foundation. Technical means became the final tool for implementing the plan, but without prior preparation, this operation would have been absolutely impossible. This involved complex, carefully planned intelligence work, as it was necessary to organize people, ensure their participation, and devise cover stories and mechanisms for interaction
According to the former counterintelligence officer, the success of such operations depends on the special services’ ability to create a multilevel system of interaction in which each participant may know only part of the overall plan. Some of the operatives may be recruited without revealing the true purpose of their tasks. For example, a person may transport a vehicle or cargo without suspecting that they are taking part in preparing a special operation.
Military expert Oleh Zhdanov is also convinced that it was precisely the work of agents that made it possible to implement such a large-scale plan.
Without the agent-based component, Operation "Spiderweb" could not have been carried out. In my view, agent work accounted for the greater part of the entire operation. It was necessary to synchronize a huge number of processes, including arranging the hiring of trucks, their movement, and the delivery of the necessary equipment to its destination. Moreover, the cargo was transported through several countries to ensure its safe entry into the territory of the Russian Federation and its subsequent delivery to the cities where the operation was planned to take place
Zhdanov explains that agent activity is not limited to gathering intelligence. Agents may organize logistics, establish front companies, and oversee the implementation of individual stages of an operation. The final result depends on how smoothly this entire system operates.
Operating behind enemy lines: when one mistake can derail an operation
The preparation of "Spiderweb" was accompanied by numerous unforeseen situations. In addition to the already mentioned incident involving alcohol abuse during the holidays there was another dangerous moment.
One of the clandestine assistants accidentally activated the mechanism that opened the roof of the structure where the drones were located. One of the drivers saw the UAVs prepared for use. To avoid exposure, the Ukrainian agents had to urgently devise an explanation that these were special reconnaissance drones for monitoring animals and detecting poachers in hunting grounds.
The cover story worked, and the operation was able to continue.
First results of the strikes
In the opinion of Kostiantyn Korsun, it is precisely the ability to organize work in such a way that it does not arouse suspicion that demonstrates the high professional level of those who work with agents.
In general, the highest level of agent and intelligence work is when all actions blend in as much as possible with everyday life and attract no attention. That is when it is most difficult for counterintelligence to detect preparations for an operation. After all, it pays attention to atypical behavior, unusual events, and circumstances that may indicate preparations for sabotage. Therefore, I am convinced that agent work remains the foundation of virtually any successful intelligence operation
Ukrainian agents in Russia: what capabilities do the special services have
"Spiderweb" demonstrated not only the technological capabilities of the SBU, but also the ability of Ukraine’s special services to organize prolonged, multistage operations directly on enemy territory.
"As for the existence of an SBU agent network on the territory of Russia, yes, such a network exists, and it is used to conduct operations," the former counterintelligence officer said.
Recruiting agents, establishing contacts, and preparing people to carry out assignments require considerable time. At the same time, the results of operations in the Russian rear demonstrate that Ukraine’s special services are capable of using these capabilities, and that the agent network is fairly extensive.
According to military expert Oleh Zhdanov, the relevant tools are available not only to the Foreign Intelligence Service of Ukraine, but also to the SBU and the Main Directorate of Intelligence of the Ministry of Defense.
"Overall, I rate the SBU's work outside Ukraine, particularly in enemy territory, very highly. If we take into account not only Operation "Spiderweb" but also other acts of sabotage carried out on the territory of Russia, it becomes clear just how highly Ukrainian special services have developed," he emphasized.
Foreign intelligence services are studying the experience of "Spiderweb"
According to experts, the main outcome of "Spiderweb" goes far beyond striking Russian military aircraft. Ukrainian special services managed to implement a plan that previously might have seemed impossible even for the world's leading intelligence agencies.
The uniqueness of "Spiderweb" lies in the fact that it went beyond the conventional understanding of the capabilities of special services, even in Western countries. The scale and manner in which this operation was carried out became something that, as one movie character might put it, not every screenwriter could have dreamed up
According to him, Ukraine's experience is already of professional interest to foreign partners.
"Today, representatives of foreign special services are coming to Ukraine to learn from our experience and study the operations we have carried out. "Spiderweb" has already become an example studied within the professional intelligence community and will undoubtedly go down in the history of special operations," Zhdanov added.
"Spiderweb" confirmed that even amid the rapid development of drone technologies, human intelligence work remains one of the most important tools of the special services. Drones can strike thousands of kilometers from the front line, but it is people who create the conditions that make such a strike possible. And while the results of special operations make headlines in the world's media, a significant part of the work of those who prepare them remains classified.