And once again — Telegram
The attack in Mykolaiv was carried out on the premises of a non-operational gas station, where patrol officers had gathered for a shift change and parked their vehicles. Two of them are now in critical condition.
Law enforcement officials have officially classified the incident in Dnipro as a terrorist act. According to preliminary investigation findings, the explosion was caused by an improvised explosive device. Fortunately, the mechanism detonated in a way that no one was injured. Investigative actions are ongoing.
On 23 February, a court ordered the pre-trial detention without bail of 33-year-old Iryna Savetina, a resident of Rivne Region, who is suspected of carrying out the attack in Lviv. Investigators say she manufactured and planted the explosive devices in central Lviv, rented an apartment near the attack site, and installed video surveillance equipment to monitor the scene. Prosecutors are currently examining her possible links to accomplices.
In fact, dozens of terrorist attacks targeting police officers have been committed across 13 regions of Ukraine since 2024, when law enforcement recorded a sharp surge in such incidents. The scheme is typically the same: a fake emergency call is made, officers arrive at the scene where explosives have already been planted, the device detonates, and investigators later find mobile phones left behind to film the attack, Interior Minister Ihor Klymenko said.
Russian intelligence services recruit perpetrators through Telegram channels, anonymous chats, and even gaming platforms. Individuals are offered money for arson attacks, planting explosives, or gathering information about critical infrastructure and law enforcement personnel. “We have documented 122 cases where children received messages offering ‘jobs’ via social media. They are encouraged to set vehicles on fire or act as couriers,” the minister noted.
During the briefing, officials said the National Police are cooperating with the Security Service of Ukraine in investigating crimes against national security, involving оперативні units, investigators, cyber divisions, and other security agencies.
“If we speak about terrorist acts, together with our colleagues we have solved 78% of such crimes. Of those, 26% were committed by minors. This is a serious and alarming figure. As for arson attacks on vehicles belonging to military personnel, volunteers, and police officers—also carried out at the enemy’s behest—596 such cases have been recorded, with 367 already solved,” the Interior Minister said.
He also announced that in the coming days the National Police will present an updated response algorithm to terrorist threats, alongside strengthened cyber monitoring aimed at preventing further attacks.
As Andriy Nyebytov, Deputy Head of the National Police and Chief of the Criminal Police, recently told LB.ua, law enforcement officers, together with the Security Service of Ukraine, have long been working proactively to prevent crimes commissioned by Russia. They are intensifying monitoring of suspicious online activity and trying to identify those ordering the crimes already at the stage when perpetrators are being recruited.
Enhanced cyber efforts make it possible to detect and neutralize the organization of attacks more effectively at the preparation stage: in 2025, police prevented 27 terrorist attacks before they were carried out and solved a total of 52 such crimes.
“We disrupted every second crime before it was executed. We struck not only at the perpetrators — but at the very logic of the crime,” Andriy Nyebytov said.
LB.ua plans to soon speak with the deputy head of the National Police in more detail about proactive policing efforts in an upcoming interview.
Where the root of the problem lies — and how to cut it out
The Interior Minister once again emphasized the role of online platforms in Russia’s hybrid warfare.
Earlier, in an interview with the outlet Censor.net, Andriy Nyebytov said that Telegram does not cooperate with law enforcement agencies in the same way as other messengers. According to him, it is difficult to identify Russian agents recruiting Ukrainians through the platform. Anonymity in Telegram channels is largely preserved, information is not disclosed, and this makes it highly convenient for committing various crimes, he explained.
Immediately after the terrorist attack in Lviv, Deputy Head of the Office of the President of Ukraine Iryna Vereshchuk called, on her Telegram channel, for restricting the messenger’s operations in Ukraine.
“Today’s terrorist attack in Lviv once again raises the issue of Telegram and other similar anonymous platforms. Once again, we see that the enemy systematically uses Telegram to recruit terrorists, coordinate their activities, and carry out attacks,” she wrote.
On Facebook and other social networks, where armies of bots and trolls operate, a corresponding atmosphere is also cultivated for such crimes. Thousands of gleeful and approving comments accompanied the news about the killing of the police officer and the injury of her colleagues, seemingly legitimizing the crime, justifying it, and encouraging others to at least adopt a similar reaction.
This, explains Andriy Kovalenko, head of the Center for Countering Disinformation under the National Security and Defense Council, is part of Russia’s strategy on Telegram public pages, TikTok, and other platforms: to flood the first 10–20 comments with bots in order to shape the tone of the discussion under a post.
“The goal may be either to incite or to induce apathy, and in the case of terrorist attacks — both: to provoke and to sow despair,” he says. First and foremost, the aim is to create the impression in the comments that people support terrorist attacks against the police and Ukrainian security forces in general, while simultaneously spreading narratives that the authorities and law enforcement agencies are incapable of protecting citizens.
Can this harm to national security — this поток of lies and propaganda that easily sticks to users unaccustomed to critical thinking — be stopped? According to Andriy Kovalenko, the fight is already underway. But its effectiveness is something everyone can judge for themselves. Modern technologies make it possible to mass-produce accounts for such “commentators” on an industrial scale across different social networks, using AI and operating in multiple languages.
“A range of measures is being implemented — from blocking the accounts themselves to cyber interference targeting the bot farms directly. This is a technical infrastructure, and if you interfere with it, you can destroy it as such,” says the head of the Center for Countering Disinformation.
Dialogue is maintained with the offices of social media platforms, and thanks to what he describes as “good working relationships,” certain results have been achieved — not only through account bans. However, China, Russia, and North Korea are actively using digital capabilities to serve their war machines.
“For them, propaganda using bots is part of warfare, and expansion in this direction is ongoing, just like in the military-industrial complex — the number of accounts for destructive operations is constantly growing,” Kovalenko says. “Meanwhile, the headquarters and administrations of social networks operate as if in peacetime and counter this as if it were peacetime. Their AI tools for detecting and removing accounts do work — but not very effectively.” New ways to bypass them are constantly emerging.
“The information and cognitive war will continue even after the conventional one ends,” Kovalenko is convinced.
This social media war can be countered not by blocking platforms like Telegram in Ukraine, says Artem Karpynskyy, cybersecurity specialist and head of the NGO “Ukrainian Cyber Alliance.” There needs to be a clear policy of counteraction, preventative measures, and systemic work. Telegram, like any other social network, is simply a tool for delivering “content” or recruitment activities. Blocking or restricting Telegram won’t stop adaptation to other platforms, like TikTok.
“Should we block that too? Even though none of the officials can realistically envision the feasibility of such a move,” Karpynskyy notes.
Ordering providers to block Telegram isn’t a panacea, not even a temporary solution. It would make more sense to develop preventive and counteraction methods. Modern technologies, including the use of LLMs (large language models, a type of AI) in OSINT (open-source intelligence) and social media analysis, make this possible. How exactly is not specified—Karpynskyy says it would be a direct hint to the enemy and help them develop countermeasures. As for why a systemic response hasn’t been built in Ukraine: “I can only explain it by a lack of political will and understanding of the problem,” he says.
“Instead of blunt, ineffective blocking populism, we need to build real counter-capabilities. Four years have shown that we are losing the war in the information domain precisely because of the absence of a doctrine and a systemic approach to waging it,” says the cybersecurity specialist. He admits that even Russia spends astronomical resources on implementing its policies—with, so far, rather questionable results.