Adapting to War: The Evolution of Russia’s Intelligence Ecosystem

Since the full-scale invasion of Ukraine in February 2022, Russia’s intelligence ecosystem has redirected its priorities toward supporting the war effort while adapting to a more constrained and contested operational and strategic environment.

The Federal Security Service (FSB), Russia’s main counterintelligence agency, has become an increasingly active foreign actor. The FSB Fifth Service lost political intelligence opportunities in Ukraine but retained key roles in Russia’s occupation administrations. It has also intensified active measures across Europe to disrupt military assistance to Kyiv, likely complementing efforts of the foreign intelligence, whose operations have been affected by mass expulsions of officers from Russian embassies in the west. The Fifth Service’s prominence also lies in the penetration of Ukrainian security structures. At the same time, the FSB remains the principal instrument of wartime control. It has gained authority to access private databases without court decisions, suspend telecommunications and internet services, and approve international scientific cooperation. It also reasserted full control over pretrial detention facilities. The FSB Second Service has intensified efforts to penetrate and discredit Russian dissident communities abroad.

Russia’s strategic political intelligence attempts to exacerbate transatlantic divisions under the second Trump presidency, with the Foreign Intelligence Service (SVR) accelerating overt information operations. Separately, Putin’s Envoy for Foreign Investment and Economic Cooperation Kirill Dmitriev uses backchannelsto bypass the established US foreign policy and intelligence community and gain direct access to the White House. The SVR has redirected resources toward the ‘global south’, absorbing elements of Yevgeny Prigozhin’s political technology networks in Africa, where Moscow portrays itself as an anti-colonial force and defender of traditional values. Meanwhile, the presidential administration (formally, the Presidential Executive Office) has broadened its influence operations beyond what Moscow has traditionally regarded as its ‘sphere of influence’, increasingly cultivating fellow travellers in the Global South and sympathetic actors in Europe.

Russia’s military intelligence, the Main Directorate of the General Staff (GRU), has activated its diverse wartime functions. It conducts not only military intelligence collection but also sabotage, assassinations, psychological operations, and sanctions evasion. GRU-linked sabotage campaigns in Europe rely heavily on criminals and disposable assets. The GRU is also partly involved in monitoring Russian opposition figures abroad. Despite the significant losses its special forces suffered during the first year of the war, the GRU has expanded its unconventional warfare capabilities, taking over Wagner’s paramilitary networks and operations in Africa and elevating Unit 29155 to the Directorate of Special Activities. However, following the exposure of multiple Unit 29155 officers, Putin separately established Centre 795, an autonomous service for assassinations and abductions abroad that reports directly to the Chief of the General Staff. The creation of dedicated services suggests that destabilising target states, eliminating perceived traitors, and deterring defections have become strategic priorities for the Kremlin.

The FSB’s Department of Military Counterintelligence (DVKR) has been used not only to monitor the armed forces but also as Putin’s political instrument to purge high-ranking Defence Ministry officials, especially Sergei Shoigu’s allies. Its investigations into corruption in the armed forces remain highly politicised and ineffective. At the same time, the DVKR has been unable to prevent several high-profile assassinations of military generals, contributing to blame-shifting and tensions among military and security agencies. 

Operating in a constrained environment, Moscow increasingly relies on illegal intelligence, non-Russian recruits, cultural and scientific channels, and operations conducted from Russian territory, while improving interagency coordination. The adaptation of Russia’s intelligence ecosystem has coincided with a significant redistribution of power among the Kremlin’s major political clans.

This report argues that Russian intelligence remains dangerous, adaptive, and willing to take risks, but is not invulnerable. Its vulnerabilities include a dysfunctional, personalised intelligence cycle, compounded by nepotism and corruption. These weaknesses have become more pronounced under wartime conditions and are likely to constrain its effectiveness. Western governments should monitor Russia’s backchannel diplomacy, sanction political technologists, support improvements to civil registration systems in Latin America, raise counterintelligence awareness among Russian dissidents, consider creative offensive counterintelligence measures, and prepare for larger-scale sabotage against critical infrastructure during a potential ‘special period’.