Moles, Not Registries: A Study Reveals How Russia Actually Learns About Ukraine's Defense Industry

Ukrainian outlet RBC-Ukraine, citing the analytics firm YouControl, published a study that revises the conventional narrative about where Russia sources sensitive information on Ukraine's defense-industrial complex. The analysts processed 7,362 news items on the SBU website covering the period from January 2020 to August 2026 and identified 131 materials directly related to threats to the defense-industrial complex, from which they determined seven key leak channels. The study's main conclusion: the adversary obtains data primarily through agents, informants, and spotters, rather than through open state registries.

The Human Factor as the Main Vulnerability

The human factor takes center stage in the study. Under Article 111 of the Criminal Code of Ukraine ("Treason"), the analysts counted 149 publications on the exposure of "moles" and spies at strategic enterprises and in state bodies, a further 179 messages concerning FSB agents, informants, and couriers, and 117 on entire agent networks and groups of spotters. In total, Article 111 appears in 1,428 materials in the sample, with a sharp rise in dynamics after 2022: if there were 45 such messages in 2020, by 2025 the figure had reached 355. In addition, 269 messages on fire adjustment and the guidance of strikes on Ukrainian facilities were recorded, along with 43 cases in which agents personally photographed and filmed defense-industrial enterprise sites, and 33 cases of targeted collection of data on the deployment of specific military and defense facilities in 2025–2026.

Telegram as a Recruitment Channel

A separate and, in the analysts' assessment, systemic recruitment channel has become the Telegram messenger. Of 90 publications on the search for informants through social networks, 84 (93%) concerned precisely this channel. Notably, in 40 cases the subject was female informants, who were recruited under the pretext of "easy money" or using family and domestic motives. This indicates that the operations against the defense-industrial complex are not only technical but also socio-psychological intelligence, aimed at vulnerable social groups.

Open Registries Do Not Feature Among Leak Channels

The key and, perhaps, most surprising result of the work: among the recorded leak channels for information on the defense-industrial complex, open state data do not feature at all. In the studied set of SBU messages, not a single case was identified in which the obtaining of information on defense facilities was linked to the use of public registries. Separately, the analysts highlighted 14 publications across 11 criminal proceedings in which classified information leaked outward through the very employees of law-enforcement and supervisory bodies — most often tax and fiscal services.

Contradictory Data

Here a direct contradiction arises between the logic of state regulation and the study's conclusions. The Cabinet of Ministers issued Decree No. 1257 on the removal of open data on the defense-industrial complex, thereby establishing the principle that public registries of legal entities are a significant vector of leakage. However, YouControl states plainly: if the main leak channels lie outside public registries, then the removal of basic information on legal entities in itself cannot be an effective tool for protecting the defense industry. Thus, the position underlying the decree and the analysts' empirical conclusion diverge: the state is protecting one channel, whereas according to SBU data the real threats pass through others — agent-based and human ones.

Operational Practice: From Odesa to Operation "Postman"

The SBU regularly records the exposure of agents within the Defense Forces. Thus, at the end of August 2026, counterintelligence detained in Odesa Oblast a career officer — the commander of a National Guard special-operations group — who for a long time had been passing Russians secret data on the combat activities of his unit and was preparing a terrorist act on the Kremlin's orders. In parallel, according to RBC-Ukraine sources, Russia has rolled out Operation "Postman" — a campaign of fake appeals aimed at discrediting commanders of units with high moral and psychological standing, in particular in the Ground Forces, the Air Assault Forces, the National Guard, and the Unmanned Systems Forces. This complements the picture: alongside physical reconnaissance, the adversary is actively using information pressure on the command staff.