This shadow war has been unfolding from Crimea to Luhansk and beyond, complementing Ukraine’s conventional military efforts and blunting the Kremlin’s hold over occupied regions.
Based on a newly constructed open-source dataset of over 150 armed operations between February 2022 and February 2025, this article offers an analytical survey of the Ukrainian resistance’s evolving tactics, techniques, and procedures (TTPs), geographic dispersion, organisational tiers, and strategic purpose. It argues that the resistance is not only enduring but expanding—despite sustained and often brutal Russian countermeasures. The resistance’s operations span from unarmed civil resistance and sabotage to improvised explosive devices (IED), light artillery employed by mortar teams and intelligence, surveillance and reconnaissance (ISR) missions supporting precision strikes. Localised and clandestine, yet increasingly synchronised with Ukraine’s military, intelligence and security apparatuses, the resistance is becoming an integral pillar of Ukraine’s hybrid defence strategy.
This article maps the resistance’s present-day capabilities, structure, aims, operational reach, and signature tactics. It draws on a larger project focused on Ukraine’s hybrid‑defence strategy, defined as “a defensive strategy that combines the employment of hard and sharp power across four or more domains of operation, typically designed to enhance the military effectiveness of a disadvantaged force during a defensive, info-kinetic manoeuvre.”
The evidence shows that, despite brutal Russian countermeasures, Ukraine’s underground has not merely survived; over the past three years, it has widened its footprint, multiplied its operations, and sharpened its sophistication. Why does urgency loom now? Because the prospect of a compelled, unjust peace—say, a Putin-Trump bargain that locks the Kremlin’s rule over Crimea and/or the partly occupied oblasts—would not pacify Ukraine, Russia, or the region. It would imprison millions under a neocolonial dominion and pour fresh fuel on an already raging insurgency. Hence, this is a critical moment to rethink what “peace” means in the context of Putin’s war on Ukraine.
Trinity of Defiance: People, Partisans, and Professionals
Ukraine’s resistance initially surfaced as fragmented, grassroots-level opposition following Russia’s annexation of Crimea and incursions into Donetsk and Luhansk oblasts in 2014. However, the resistance rapidly evolved after the February 2022 full-scale invasion, shifting from isolated tactical reactions towards multi-domain initiatives. In a way, this adaptive evolution mirrors classical guerrilla warfare strategy, whose aim is to degrade the enemy’s will to fight and attrit its ability to wage war without meeting its forces in direct confrontation. The resistance has notably penetrated regions far beyond traditional expectations, illustrated by the symbolic dissemination of leaflets from the Atesh Movement in Samara, Russia—over 1 200km from Ukraine’s borders—signifying both reach and resilience.
Ukraine’s resistance apparatus comprises three intertwined but distinct layers: (unarmed) civil resistance, (armed) partisan movements, and (conventional) special military operations. The Yellow Ribbon movement and the Zla Mavka group epitomise civil resistance, leveraging symbolism, nonviolent direct action, and psychological operations (PSYOPS) to sustain morale and delegitimise Russian occupation authorities. Yellow Ribbon activists demonstrate resilience by proliferating Ukrainian national symbols in occupied territories, persistently challenging occupation legitimacy without resorting to violence. Zla Mavka’s satirical sabotage further exacerbates occupiers’ morale and amplifies civilian morale, reflecting a calculated psychological operations strategy aimed at shaping perceptions within occupied territories.
Armed resistance groups, such as Atesh, Popular Resistance of Ukraine (NSU), Berdyansk Partisan Army (BPA), and Mariupol Resistance, among others, represent the militant core of Ukraine’s resistance strategy.
Atesh was founded in September 2022 in Crimea. It is a clandestine resistance organisation which operates in all five (partially) occupied regions of Ukraine and the Russian Federation. In July 2023, the former leader of the Crimean Tatar’s Council, Mustapha Dzemilev, declared that Atesh has the capacity to recruit an additional 1 000 fighters in Crimea—a regiment-sized force—but needs weapons, ammunition, and equipment. The organisation draws support from the Crimean Tatar, and other Crimea-based, Ukrainian communities. It demonstrated remarkable operational capability, executing over 200 operations, including sabotage, targeted assassinations, static and vehicle-borne IED attacks, small unit (fireteam-sized) raids and ambushes, and intelligence gathering and dissemination. Its multiethnic and multinational composition, including Russian nationals, indicates its expansive reach.
A second example of an armed resistance organisation is the NSU, which has been operationally active in Donetsk Oblast since September 2021. It functions as an overarching entity coordinating guerrilla activities. As for the BPA, it is specifically active in and around the city of Berdyansk in Zaporizhzhia Oblast. It is engaged in sabotage, guerrilla ambushes and raids, IED warfare, close-quarter assassination, and ISR missions. Finally, while not a centralised entity, the Mariupol Resistance comprises multiple cells—some with codenames like the “Ї” group—working in parallel. They often receive support from larger partisan movements, such as Atesh, from the exiled city officials who help relay intelligence, as well as from the Ukrainian military and security forces. Over time, what began as ad hoc survivalist acts of arson and soldier-poisoning in the summer of 2022 evolved into coordinated sabotage, assassination campaigns and IED warfare by 2025. All four partisan organisations, among other local resistance movements, often work autonomously but sometimes with guidance or direct support from the Ukrainian military and security forces.
Central to Ukraine’s overall resistance in the occupied territories is the Special Operations Forces (SSO) unit “Rukh Oporu” (Resistance Movement), formally operational since 2021 but covertly active from 2014. This corps-level formation operates as the backbone of Ukraine’s resistance network, providing essential logistical support, tactical training, intelligence coordination, and direct-action capabilities. In addition to the SSO, Ukraine’s Security Service (SBU) and Military Intelligence Directorate (HUR) conduct sophisticated clandestine operations and support multiple resistance movements, both within occupied Ukraine and across the border in Russia. These special operations integrate closely with partisan and civil resistance groups through intelligence sharing, operational synchronisation, and resource allocation.
Domains of Operations: The Info-Kinetic Nexus
Ukraine’s resistance strategy spans multiple domains of operations: land, sea, air, and information warfare. Notably, the resistance has extensively employed “info-kinetic” operations, defined as “military operation that merges TTPs from the information domain, such as intelligence, psychological operations, cyber warfare, electronic warfare, with kinetic (physical) strikes/fires and movements in the battlespace(s).” These operations have proven highly effective, demonstrated by precision-guided missile strikes enabled by intelligence from partisan reconnaissance teams.
On the ground, the resistance used a varied arsenal and diversified types of operations, including: static and vehicle-borne IEDs (VBIEDs); assassinations (close-quarter and sniper-based); employments of light mortars, man-portable air defence systems (MANPADS), and unmanned aerial vehicles (UAVs); sabotage of critical infrastructure, arson, and mass-poisoning.
On one level, these info-kinetic operations aim to harass and attrit Russian forces by undermining supply routes, hitting logistical nodes, and accelerating detection and destruction cycles of the occupiers’ assets. On another, they enable manoeuvre for conventional Ukrainian brigade-sized units, as witnessed in the Kharkiv 2022 counteroffensive.
Sampling Combat: How the Resistance Fights
To understand how the Ukrainian partisans fight in the occupied territories, I documented a sample of 150 confirmed operations classified by the type of armed action/category of tactic. It covers the period from the start of the full-scale invasion in February 2022 through February 2025, as well as the location of the operations. The types of operations include indirect fire by partisans (light 60mm mortars), static-covert IEDs, VBIEDs, sniping (long-range precision shootings), close-quarter battles (CQB), close-quarter assassinations (short-range shootings or stabbings), ISR operations (to support the Ukrainian state forces), sabotage (damage to railways, infrastructure, and arson attacks), and poisoning operations.
The dataset relies on open sources (such as Ukrainian and Russian media and military bloggers) as well as claimed statements (by partisan organisations, formal military and political institutions). The operation is listed in the dataset when reported by both Ukrainian and Russian media and/or military bloggers and claimed by a partisan organisation or cell. In the dataset, “claimed” indicates that partisan groups (or pro-Ukrainian media) announced the operation, but it was not independently verified. “Confirmed” means that the operation was cross-checked via OSINT, geolocation, multiple media sources, or admission by Russian-installed officials.
The exact attribution is sometimes complicated by secrecy, overlapping claims, and the deliberate blending of partisan cells. The comprehensive numbers of operations are likely to far exceed those listed below—deemed as confirmed—given the selection criteria. For example, there are claimed cases of MANPADS, UAVs, anti-tank guided missile attacks (ATGMs), and unguided rocket-propelled grenades (RPGs) employments, but they are not listed below due to the criteria. Hence, the figures should be treated as indicative trends and demonstrative capabilities, rather than definitive totals. The table below outlines a selected sample of 150 confirmed partisan operations between February 2022 and February 2025. It reveals significant tactical diversification:
| Samples of Operation Types | 2022 | 2023 | 2024 | 2025 | Total | Share |
| Static IEDs (planted in buildings, roadside, booby-traps) | 4 | 7 | 3 | 1 | 15 | 10% |
| VBIEDs (car bombs) | 5 | 14 | 5 | 1 | 25 | 17% |
| Sniping (long-range shootings) | 3 | 2 | 0 | 0 | 5 | 3% |
| CQB/CQA (close-quarter battles/shootings/stabbings) | 18 | 5 | 2 | 0 | 25 | 17% |
| Mortar Artillery (partisan-fired shells) | 2 | 3 | 0 | 0 | 5 | 3% |
| ISR for UA strikes (intel/surveillance aiding Ukrainian strikes) | 4 | 6 | 6 | 4 | 20 | 13% |
| Sabotage (rail, infrastructure, arson) | 8 | 15 | 10 | 2 | 35 | 23% |
| Poisoning | 2 | 10 | 6 | 2 | 20 | 13% |
| Total | 46 | 62 | 32 | 10 | 150 | 100% |
A Sample of Confirmed Partisan Operations, February 2022 to February 2025
In 2022, resistance efforts primarily targeted occupation collaborators and logistics infrastructure, and included a sample of 46 confirmed operations aiming to destabilise newly occupied areas rapidly. By 2023, resistance operations escalated to include a sample of 62 confirmed attacks, with improved tactical coordination and targeting, notably through sophisticated sabotage and intelligence-driven strikes. Russian countermeasures intensified in 2024. Still, the sample of confirmed operations reached 32, and the qualitative impacts of these operations remained substantial, with targeted strikes on high-value collaborators and critical logistics infrastructure. Early 2025 witnessed continued high-impact operations as well, reflecting the resilience and adaptability of Ukraine’s partisans.
Strategic Implications and Future Prospects
The tactical and operational successes of Ukraine’s resistance constrain Russian forces by requiring substantial security commitments to the occupied territories. Persistent guerrilla activity disrupts logistical routes, complicates operational planning, and continuously undermines morale within the occupying forces. Still, sustainability and scalability are required. The quantity of these operations is as important as their quality.
The potential geopolitical implications of a hypothetical settlement, such as a Putin-Trump mediated agreement leaving Ukrainian regions under Russian settler-colonialism, underscore the resistance operations’ strategic significance. Such an imposed “peace” would almost certainly stiffen—not stifle—the Ukrainian resistance, driving guerrilla activity toward a higher intensity phase. The likely trajectory evokes the British Special Operations Executive’s campaigns of 1940-46 and other operations when covert infiltration primed the battleground for larger political strategic shocks, from the Tet Offensive of 1968 to the (much more successful) recapture of Grozny in 1996.
Ultimately, Ukraine’s resistance transcends tactical operations; it represents a form of strategic defiance, conveying a powerful message to adversaries and allies alike—that occupied territories are not permanently lost, and any peace without justice is inherently unstable. For Ukraine, resistance has become a cornerstone of national hybrid defence, symbolising an unyielding commitment to sovereignty and self-determination.