Ukraine’s foreign intelligence service has warned that Russia is preparing a mass‑casualty “false‑flag” attack either inside Russia or in occupied Ukrainian territory, timed around Orthodox Christmas, in what Kyiv says is a bid to derail U.S.‑brokered peace talks and harden domestic support for the war. Ukrainian officials say the Kremlin could strike a symbolic civilian target, then swiftly blame Ukraine by planting Western‑made drone debris as fabricated “evidence,” echoing tactics they argue Moscow has used before.
Intelligence alert: Kyiv’s stark warning
Ukraine’s Foreign Intelligence Service (SZRU) issued a public statement on January 2 warning that the Kremlin is conducting a “comprehensive” special operation meant to sabotage ongoing peace efforts mediated by U.S. President Donald Trump. According to the agency, this operation could culminate in a staged attack with “significant human casualties,” designed to look like Ukrainian terrorism against civilians.
Officials stressed that this is not a hypothetical scenario but an assessment based on observed preparatory activities by Russian special services, including intensified propaganda about alleged Ukrainian terrorism and expanded messaging about Western weapons being used for attacks on Russian soil. The warning explicitly links the alleged plot to Moscow’s political objective of undermining peace talks and justifying a harder military line at home and abroad.
The intelligence service urged foreign governments, journalists, and the wider public to treat any sudden, spectacular “terrorist” incident blamed on Ukraine with great caution, especially if accompanied by rapid, highly produced media content and claims of Western‑made weapon fragments at the scene.
Target, timing and tactics of a ‘false flag’
Ukrainian intelligence believes the most likely timing for a false‑flag attack is in the days leading up to or on Orthodox Christmas, celebrated on January 7 in both Russia and many parts of Ukraine. Analysts in Kyiv say the Kremlin’s operatives appear to be preparing for a strike on a site with strong religious or cultural symbolism, such as a church, monastery, or other public gathering place linked to Christmas worship.
The SZRU statement describes several potential scenarios:
-
A mass‑casualty blast or drone strike on a religious building during a holiday service, creating images of worshippers under attack.
-
An explosion or assault at a civic site—such as a concert venue, hotel, or public square—framed as a deliberate Ukrainian attempt to “terrorize” Russians celebrating Christmas.
-
An incident in temporarily occupied Ukrainian territories, where Russia controls security and information flows, making it easier to stage and script the aftermath.
To buttress the narrative that Kyiv and its Western partners are responsible, Ukrainian intelligence says Russia is likely to truck in debris from Western‑made strike drones, such as those used on the front lines, and place them at the scene before inviting cameras. Such pre‑positioning of physical “proof,” they argue, mirrors previous Russian operations in which evidence was manufactured to support already‑prepared propaganda lines.
Propaganda build‑up after disputed ‘Putin attack’
The new warning comes days after Moscow claimed Ukraine launched a massive drone strike against a residence used by Russian President Vladimir Putin in the Novgorod region—a claim fiercely denied by Kyiv and treated with skepticism by Western intelligence. Russian officials, including Foreign Minister Sergei Lavrov, asserted that around 100 drones targeted the site, all allegedly intercepted, and promised that such “reckless actions” would “not go unanswered.”
Ukraine rejected the story outright, with President Volodymyr Zelenskyy calling it a fabrication aimed at “sabotaging diplomatic efforts” and conditioning Russian public opinion for further escalation. The CIA has assessed that Ukraine was not targeting a Putin residence in the reported incident and indicated that key elements of the Russian narrative lack corroborating evidence.
Ukrainian intelligence now argues that the “attack on Putin’s home” narrative was a prelude to a broader influence operation. Officials say they are tracking a surge of Russian state media content that:
-
Accuses Kyiv of “terrorist” tactics, especially with drones.
-
Highlights Western‑supplied weapons as tools of alleged Ukrainian aggression.
-
Frames Russia as a besieged victim forced to respond “defensively.”
According to the SZRU, this information campaign is designed to “prepare Russian and foreign audiences for further escalation,” including a potential staged attack that could be presented as the logical consequence of prior “Ukrainian terrorism.”
Peace talks under pressure
The alleged false‑flag plot lands at a delicate moment in negotiations aimed at ending the war, now in its fifth year since Russia’s full‑scale invasion in 2022. The United States, under President Donald Trump, has been leading a renewed diplomatic push that includes separate channels with both Kyiv and Moscow and exploratory formats for a broader settlement.
According to Ukrainian and Western officials, the Kremlin appears deeply uneasy about any peace framework that would lock in Ukraine’s orientation toward the West and limit Russia’s ability to resume or escalate hostilities later. A spectacular domestic “terrorist attack” blamed on Ukraine could serve multiple political goals for Moscow:
-
Rally a war‑weary Russian public around the flag by portraying the country as a target of “NATO‑backed terror.”
-
Give the Kremlin a pretext to walk away from negotiations or demand far tougher conditions from Ukraine and its backers.
-
Pressure Washington and European capitals by framing any aid to Kyiv as complicity in attacks on civilians.
Ukrainian analysts say an effective false‑flag operation—especially one with graphic images of casualties—could shift the information terrain just as Washington is trying to shepherd both sides toward a fragile compromise.
Russia’s history with ‘false flags’
Kyiv’s warning taps into a long‑running debate about the Kremlin’s alleged use of “false‑flag” operations—attacks staged or manipulated by state agencies but blamed on an enemy to justify tough measures. U.S. and NATO officials have previously accused Russia of such tactics, including in the run‑up to the 2022 invasion, when Washington publicly warned that Moscow was preparing a staged provocation as a pretext for war.
Analysts often point to several episodes as part of this pattern:
-
The wave of apartment bombings in Russia in 1999, which killed hundreds and helped pave the way for Vladimir Putin’s rise, has long been the subject of allegations of security‑service involvement, though Moscow denies this and no definitive proof has been presented.
-
Incidents in eastern Ukraine and Crimea in 2014, where purported attacks on ethnic Russians were used in state media to justify military intervention and annexation.
-
More recent information operations in Syria and elsewhere, where Russia has been accused of spreading disinformation about chemical attacks and atrocities to muddy attribution.
Ukraine’s foreign intelligence service argues that staging a high‑casualty attack around a religious holiday, then blaming Ukraine with planted drone fragments, fits this historical “modus operandi” of mixing real bloodshed with manufactured evidence and a tightly controlled narrative.
Competing narratives on civilian strikes
The warning also comes amid a bitter propaganda battle over recent strikes that killed civilians in occupied southern Ukraine. Russia‑installed authorities in Kherson region say Ukrainian drones hit a cafe and hotel in the resort village of Khorly during New Year celebrations, killing more than two dozen people and injuring dozens more.
Kyiv denies deliberately targeting civilians and insists that its forces strike only Russian military targets and collaborators linked to the war effort. Ukrainian General Staff spokesperson Dmytro Lykhoviy accused Moscow of repeatedly resorting to “disinformation and fake statements” about civilian casualties, both to discredit Ukraine’s conduct and to sway international opinion.
European officials have echoed concerns about Russian messaging. EU foreign policy chief Kaja Kallas has described Moscow’s latest allegations as “unfounded” and a “deliberate distraction” from Russia’s own large‑scale drone and missile attacks on Ukrainian cities, including recent barrages against Zaporizhzhia and other regions.
What a staged attack could trigger
If a false‑flag attack unfolds as Ukrainian intelligence fears, several immediate consequences are likely:
-
Domestic mobilization in Russia: State media could broadcast non‑stop coverage, framing the incident as proof that Russia faces an existential threat from Ukraine and NATO, thereby justifying further mobilization or harsher wartime measures.
-
Escalatory retaliation: Moscow could use the event to announce massive retaliatory strikes on Ukrainian infrastructure, including energy and transport networks, arguing that it is punishing “terrorist” behavior.
-
Diplomatic disruption: Russia might pause or withdraw from specific negotiating tracks, or insist on conditions that Kyiv and its allies see as non‑starters, effectively freezing the peace process.
Ukrainian officials warn that a sophisticated false‑flag attack could also sow confusion among international audiences, especially if early reporting relies heavily on Russian official sources before independent verification is possible. Once emotional images spread, experience from other conflicts suggests that even later debunking may not fully dislodge the initial impression.
Calls for caution and verification
In their public statements, Ukrainian intelligence and political leaders are not only sounding an alarm but also issuing practical advice to foreign governments, media outlets, and observers. They urge:
-
Delayed judgment on any sudden “terrorist attack” narrative in Russia or occupied Ukraine until independent verification and forensic analysis can be conducted.
-
Scrutiny of the alleged weapons used, including whether supposed Western‑made drone fragments at the scene are consistent with known deployment patterns and damage signatures.
-
Cross‑checking location, timing, and casualty figures with satellite imagery, social media geolocation, and eyewitness testimony outside of Russian state channels.
Groups that specialize in open‑source investigation have in past conflicts successfully challenged official narratives by matching video, shadows, landmarks, and blast patterns against independent data. Ukrainian officials suggest that such methods will be crucial if a suspected false‑flag incident occurs around Orthodox Christmas.
Wider information war around Ukraine
The warning underscores how deeply the war has moved into the information domain, where narratives about who is attacking whom are almost as contested as the battlefield itself. Russia and Ukraine now routinely accuse each other of staging or misrepresenting strikes, especially when civilians are killed or high‑value targets are involved.
Western governments have increasingly pre‑empted suspected Russian plans by declassifying intelligence and publicizing warnings about possible false‑flag operations, as the United States did in early 2022 when it accused Moscow of preparing staged attacks to justify invasion. Kyiv’s latest alert appears to be part of that same strategy: expose a possible plan before it unfolds, in the hope that prior sunlight raises the political cost of carrying it out.
For now, no such mass‑casualty “false‑flag” attack has been independently confirmed. But with Orthodox Christmas approaching and peace talks hanging in the balance, Ukrainian intelligence is making clear it believes the risk is real—and that the battle to shape global perceptions may be entering an even more dangerous phase
