When Vladimir Putin launched his invasion of Ukraine in February 2022, many experts predicted that Russian forces would encounter a campaign of guerilla warfare, including attacks against Russian troops. Some analysts compared the threat with those faced by Moscow's army in Afghanistan in the 1980s and Chechnya in the 1990s, forecasting that the Ukrainian insurgency would burgeon within weeks. Such expectations were based on the premise that Ukraine’s military would succumb rapidly to Russian forces, leaving guerilla warfare as the only viable tactic for opposition.

So far, however, the Ukrainian army, with massive Western support, has managed not only to repel Russian forces on the battlefield but to push them back in the east and, to a lesser extent, in the south. Because of Ukraine’s successes in regular warfare, guerilla resistance in occupied parts of the country has played a somewhat different role than anticipated and has attracted relatively little attention.

This article attempts to analyze the Ukrainian insurgency thus far. (Used here, the concepts “partisan” and “insurgent” describe all participants in irregular warfare on the Ukrainian side, including not only self-organized volunteers but special forces and professional sabotage units linked to the Ukrainian military and security service.) The research has yielded several takeaways:

• The insurgency has focused mainly on targeting pro-Russian collaborators and disrupting Russian military logistics, rather than engaging in head-on confrontations with Moscow’s forces. This appears to be a tactical choice, meant to support the regular warfare waged by the Ukrainian military.
• Judging by available open-source evidence, the insurgent network in the south seems to be the most robust and key elements of the insurgency—such as weapons caches, for example—were put in place before the war, most likely by Ukraine’s security services and/or military, in anticipation of the Russian invasion.
• While it is likely that insurgents maintain communication with representatives of a central command, cells seem to operate with a large degree of autonomy and not to coordinate or communicate laterally, probably to minimize the risk of exposure.
• Though smaller in absolute figures than the domestic insurgency against Russia in the North Caucasus in the 1990s and 2000s, the Ukrainian insurgency has included a high share of assassination attempts in its activities, which, together with some other features, suggests a relatively strong insurgency, marked by professionalism and discipline.

Quantitative assessments in this article are based on a dataset of insurgent attacks in Russian-occupied Ukraine compiled through comparative review of news coverage, social media and think tanks’ work focusing on the war, including sources such as War Translated and the Institute of War.

One caveat before proceeding: For many incidents, it is impossible to pinpoint the precise cause of an attack or partisans’ role in it. This research includes only those incidents for which the author is reasonably confident about the evidence linking them to insurgent activity. Furthermore, two incidents are mentioned in the appendix but not included in the dataset; these are allegedly sting operations conducted by Russian security services.

Targeting Collaborators and Infrastructure

In February and March 2022, as the Russian armed forces made rapid gains in southern Ukraine, pro-Russian administrations were established in several regions, including Kherson and Zaporizhzhia. The new administrators and their collaborators were tasked with installing a Russian system of public administration and preparing for the annexation of southern Ukraine, along with the Donbas. In response to the Russian occupation, the Ukrainian government urged locals to mobilize and wage insurgency warfare against Russian forces and their allies. According to empirical data collected for this article, rather than confront Russian forces directly, the insurgency has mainly focused on targeting collaborators—particularly in southern Ukraine—and disrupting Russian military logistics in hopes of making the occupation difficult to sustain in the long run.

Assassination attempts against pro-Russian administrators and their collaborators have been the insurgency’s main tactic, aimed at spreading fear and deterring recruitment. Among the 55 episodes of insurgent activity documented between Feb. 24 and Nov. 2, over half (31) involve assassination attempts against public officials on Russian-occupied territory, leaving 12 targets dead and 12 wounded. The pace of the attempts increased rapidly throughout the summer, underlining the insurgency’s role and the lack of an effective Russian counterinsurgency. The methods used have included improvised explosive devices, car bombs, shootings and even nerve agents. Kill lists of alleged collaborators have been circulating online, presumably to discourage pro-Russian officials from staying in office.

Insurgent attacks have been much more intense in the south than the east. Over 75% of the dataset’s assassination attempts have been in southern Ukraine, suggesting that the Ukrainian military and/or special services began arranging weapon caches, support networks and recruitment activities there months before the Russian invasion. In eastern Ukraine, on the contrary, continuous military tensions with Russian forces and their proxies seem to have prevented the Ukrainian government from reaching a similar level of preparedness in advance, as most military resources were devoted to securing frontlines in the Donbas. Eastern Ukraine saw only four assassination attempts during the same period among a total of nine incidents involving insurgents, not counting artillery strikes coordinated with their support. (The dataset includes only incidents in which partisans are believed to have taken part directly, not those where their role was likely limited to providing intelligence.) Attacks in the Donbas have usually been less deadly and smaller in terms of damage, targeting railroads, powerlines and Russian supply equipment rather than officials. 

Insurgent activity on Russian-occupied territory in Ukraine, Feb. 24 through Nov.2

See appendix below for detailed breakdown.

Small, Focused, Decentralized

Contrary to some predictions at the outset of the war, the Ukrainian insurgency has remained relatively small in size. This seems to be strategically designed to ensure operational security, allowing the underground to focus on very specific objectives that cannot be fulfilled by conventional warfare alone, such as targeted assassinations. Based on research for this article, active insurgents, including Special Operations Forces (SOF) behind enemy lines, might be limited to a few hundred individuals but have been involved in important operations, like the August attack against the Russian air force base in Crimea’s Saki, as well as assassinations of senior Russian-installed officials. These active partisans are concentrated mainly in the Kherson and Zaporizhzhia regions. A small number of professional partisans (probably SOF) are also active in Crimea, occupied by Russian forces since 2014, though support and logistics there are limited, leading to fewer attacks. Finally, the number of active insurgents in eastern Ukraine—where pro-Russian proxies have held sway for eight years—appears to be much smaller, probably fewer than 100; their activities are mainly limited to sabotage, crop fire, and few targeted assassinations. There is also an unknown number of pro-Ukrainian civilian volunteers directly supporting the insurgency; their activities appear to be focused on smaller tactical objectives, like the sabotage of railways and propaganda activities.

Empirical evidence suggests that Ukraine’s insurgency is highly decentralized and compartmentalized—characteristics that make sense as ways to enhance operational security. Unlike the North Caucasus insurgency, which relied to some extent on a vertical hierarchy in its operations, the Ukrainian partisans appear to have been organized to function more independently. Thus far, there has also been no clear evidence of lateral links between different cells across southern Ukraine.

That said, one should not dismiss the role played by Ukrainian authorities in the insurgency’s activities. According to interviews conducted by the New York Times and organized by the Ukrainian military, Kyiv had been getting partisans ready months before the invasion. A law passed last year authorized the SOF to train, arm and pay covert fighters on Ukrainian territory in wartime, the paper reported. Based on research for this article, it appears that most partisan activities remain unsupervised by the Ukrainian military command, but specific missions have been organized in collaboration with Ukrainian special forces and operational communication is maintained between partisans and Ukrainian central command. Additionally, dozens of social and political groups—including some with paramilitary wings, like the nationalist Right Sector and National Corps—also provided training for potential partisans, according to the Times. Preparations included the creation of weapons caches across southern Ukraine, as well as the development of networks to support insurgents and their movement across occupied territories.

Moreover, although these attacks are not included in the dataset, partisans play an important role in preventing Russian forces from resupplying their troops across southern Ukraine. Throughout the summer, several Russian ammunition dumps and fuel depots across the Donbas and southern Ukraine were struck by HIMARS and other precision artillery systems: Reconnaissance and target identification provided by partisans reportedly played a role in Ukraine’s success. Furthermore, partisans in the Kherson region have been reporting on the use of ferry pontoons used to resupply Russian troops on the western bank of the Dnieper, helping Ukrainian artillery pinpoint targets.

Confronting Russian Armed Forces

Although on a smaller scale, the insurgency has also been involved in attacks against Russian-aligned military patrols monitoring curfews and late-night activities in occupied territories. One Ukrainian official, the exiled mayor of Melitopol, claimed in April that over 100 Russian soldiers had been killed by partisan activities in southern Ukraine but did not provide strong evidence. Although numbers like this must be taken with a grain of salt, it is clear that not all attacks on occupied territory are reported by pro-Russian media or Ukrainian armed forces, while some have been—for example, three Russian soldiers reportedly killed in broad light in Kherson in June.

At the military level, based on available data, no coordination can be identified between Ukrainian counteroffensives and insurgent activities in the northeastern Kharkiv region except for insurgents’ providing intelligence and identifying targets. This lack of coordination could be related to the limited number of collaborators compared to southern Ukraine, the harshly repressive environment created by Russian military forces (including use of torture) and/or the lack of pre-war preparation for insurgent networks. More information will become available as more territory is liberated.

A different picture has emerged in southern Ukraine, particularly in the Kherson region. Several small attacks have targeted Russian weapons and fuel depots, railroads and powerlines, disrupting Russian forces’ logistical supply lines and making it harder to counter Ukraine’s ongoing offensive. Furthermore, assassinations and other threats against collaborators have aimed to disrupt political activities: They ramped up ahead of the referendums in Kherson and Zaporizhzhia that paved the way to Moscow’s unrecognized annexation of the regions, which remain outside full Russian control. At the same time, if ambush and other insurgency-style tactics played an important role in northern Ukraine during the battle of Kyiv, they remained more limited in southern Ukraine.

In Crimea—where a robust Russian security apparatus is closely integrated with the Russian state writ large—occupation forces have more resources to identify and target partisans, impacting the nature of insurgent activity there. Known political and ethnic activists were arrested early in the war to reduce their ability to organize protests and other partisan activities. Due to the constrained, high-risk operating environment, insurgent attacks in Crimea are usually highly strategic and involve cooperation between local informants, regular Ukrainian forces and trained partisans. The best example of such cooperation may be the Saki explosion, which destroyed at least eight Russian military aircraft. According to the Ukrainian government, partisans played a role, although advanced weapons systems or special forces were most likely responsible for the attack itself. Insurgents in Crimea have also weaponized small commercial drones, using them for an attack on Russian navy headquarters in Sevastopol in August.

Partisans also play a very active role in the organized propaganda campaign against Russian occupation, putting up posters with threats against Russian forces/collaborators, distributing leaflets and tagging government buildings with graffiti. Partisans regularly provide instructions on how to surrender to Ukrainian forces and organize protests against the occupation. Many groups, such as the Berdyansk Partisan Army and the Free Ukraine Resistance Movement, are active online and have released videos threatening Russian forces and collaborators.

Ukrainian partisan participation in attacks on Russian territory is more difficult to assess. Very limited information is available on the identity of Russian-based partisans. Many of the most successful attacks against Russian military infrastructure outside of southern Ukraine appear to be carried out with missiles, helicopters or military drones like the Turkish Bayraktar. Additionally, Ukrainian and other partisans in Russia have been actively sabotaging railways and powerlines in the Kursk and Belgorod regions, targeting Russian supply lines. They might have also been involved in incidents targeting fuel and weapons depots on Russian territory. Overall, partisan activities on Russian territory remain murky and, for now, cannot be conclusively linked to the broader Ukrainian insurgency in occupied territories.

Russia’s Unsuccessful Counterinsurgency

The counterinsurgency within Russian-occupied lands is resource-intensive for the Russian armed forces, national guard, Federal Security Service (FSB) and other Russian “power” agencies operating there. Early in the war, Russian forces obtained a list of locals in the city of Kherson who had fought in eastern Ukraine since 2014 and began targeting them through a series of police raids similar to the infamous zachistki in Chechnya in the early 2000s. Over 200 individuals disappeared in those raids, according to Kherson’s mayor, forcing Ukrainian partisans to go deeper underground and reorganize their activities. Occupying forces also set up checkpoints across the Kherson and Zaporizhzhia regions seeking in part to reduce partisans’ ability to travel and communicate with Ukrainian forces.

At the same time, securing positions and supply lines behind the frontlines has been challenging for Russia due to insufficient manpower and access to actionable intelligence. Based on observable evidence, the FSB has struggled so far to infiltrate Ukrainian partisan networks, mostly because of insufficient cooperation from locals and the insurgency’s professionalism. Russia also seems unable to prevent insurgents from slipping through frontlines in southern Ukraine: According to the New York Times interviews, Ukrainian insurgents manage to regularly cross enemy lines and connect with Ukrainian armed forces—testimonies that appear to be confirmed by the lack of violent clashes between occupation forces and insurgents on the roads. It remains to be seen whether Russia’s recent mobilization and fall draft might provide the manpower to deny mobility to partisan networks.

The Ukrainian Insurgency in Comparative Perspective

Overall, the Ukrainian insurgency has not been as active or sustained as predicted at the beginning of the war, but its relative success has been in mobilizing the required number of partisans for its limited objectives while avoiding infiltration by Russian informants. The lower-than-expected intensity of insurgent activity can be explained by the fact that the Ukrainian military received advanced weapons systems, intelligence and planning support from the U.S. and its allies, which changed the dynamic on the battlefield and limited the importance of deploying insurgents in occupied territories. When looking at the data, it’s clear that the insurgency played an important role wherever it could focus on its primary objective—targeted assassinations—without threatening its networks or engaging occupation forces directly. The limited cases of direct confrontation with Russian armed forces (versus targeted assassinations) suggest a carefully executed approach meant to wear down occupying forces by focusing on collaborators and their institutions. Targeted assassinations are a powerful symbol and require fewer resources and less coordination between partisans and regular forces. At the same time, the insurgency’s success in targeting Russian weapons depots and supply lines underlines its broader role in Ukrainian military efforts.

In comparison to the North Caucasus insurgencies of the 1990s and 2000s, the Ukrainian insurgency appears to be smaller size-wise but more dedicated to its primary objective—targeting collaborators and Russian officials—which underlines its professional, well-organized nature. At their peak, the North Caucasus insurgencies mobilized well over 1,000 people coordinating attacks against Russian military and security services. They launched major raids against regional capitals such as Nazran (2004) and Nalchik (2005), as well as regularly confronting Russian forces in ambushes and at checkpoints. In 2008-2013, clashes between insurgents and Russian forces in the North Caucasus led to over 500 casualties per year, according to reporting by the Caucasian Knot news site. Although assassination plots against officials did occur,[1] they were not the main strategic objective. According to data in the Global Terrorism Database, between 2009 and 2016 there were 37 assassination attempts against public officials and 47 against Muslim clerics, averaging about 10-11 a year; the attacks were often indiscriminate, harming officials, clerics and civilians. Ukraine, as noted above, saw 31 attempts in roughly eight months.

Overall, the use of partisan warfare has contributed to Ukraine’s successes on the battlefield, and its importance may increase as fighting moves south to Kherson and other occupied cities. There, partisans and saboteurs will increasingly coordinate with Ukrainian armed forces to harass and target Russian troops and disrupt supply lines over the Dnieper. Furthermore, following the referenda in southern Ukraine, partisan activities should ramp up to demoralize occupation forces and disrupt the annexation process. Finally, as observed in the First Chechen War, the increased use of untrained Russian military personnel following the recent mobilization might provide an important tactical advantage for professional Ukrainian partisans to strike against military targets in occupied territories.

Appendix: Breakdown of Insurgent Activity in Ukraine, Feb. 24-Nov. 2, 2022

The opinions expressed herein are solely those of the author. Photo by Ukrainian Defense Ministry shared under a Creative Commons license.