Masked men appeared at anti-corruption demonstrations in Kyiv Thursday evening, carrying inflammatory signs targeting President Volodymyr Zelenskyy personally—exactly 24 hours after Ukrainian intelligence warned that Russia would deploy provocateurs to exploit the crisis.

The timing wasn’t coincidental. Defense Intelligence had warned Wednesday that “Kremlin agents are actively studying the internal situation” to weaponize protests against the law that subordinates Ukraine’s anti-corruption bodies to the Prosecutor General’s Office.

When the real protesters left, others appeared

The incident unfolded around evening as legitimate demonstrators wrapped up their third day of protests against Law No. 12414. What happened next looked like textbook destabilization.

Masked individuals emerged with signs reading “Ukraine is not Kvartal! Ukrainians are not slaves!” “Killers of democracy traitors of Ukraine,” and “Heroes are dying for Ukraine and these two are destroying it!”—directly targeting Zelenskyy and his chief of staff Andriy Yermak, according to footage captured by a Euromaidan Press correspondent.

View this post on Instagram

A post shared by Euromaidan Press (@euromaidanpress)

Legitimate protesters had focused on defending institutions: “Hands off NABU and SAP!” and “The lost generation wants democracy.” These newcomers turned it into a vitriolic attack on the country’s leadership.

View this post on Instagram

A post shared by Euromaidan Press (@euromaidanpress)

The power concentration driving protest anger

Why target Zelenskyy and Yermak specifically? The anti-corruption law represents broader concerns about power centralization during wartime.

When investigators began targeting Zelenskyy’s closest associates—including Oleksiy Chernyshov, the only Cabinet minister invited to Zelenskyy’s COVID birthday party, and business partner Tymur Mindych from Kvartal 95—the response was to subordinate the investigators rather than allow the process to continue.

The law effectively places NABU and SAPO under the Prosecutor General’s control, ending a decade of institutional independence. The protesters aren’t calling for Zelenskyy’s removal—they want the law repealed while maintaining effective war leadership. Most Ukrainians still oppose holding elections while fighting Russia. Their primary concern remains winning the war.

That’s precisely what makes this moment valuable to Moscow. The Kremlin hopes to exploit these real institutional tensions to destabilize Zelenskyy’s government entirely.

Explore further

Explained: why Ukraine nuked its own anti-corruption agencies

Surgical timing raises questions

Witness Mladena Kachurets documented the evening’s events. The suspicious activity began about 10 minutes before an air raid alert—perfect timing for dramatic effect.

“Masked individuals gathered the remaining protesters around them and delivered some kind of recorded speech,” she wrote. Multiple distractions played out simultaneously. While media focused on MP Maryana Bezuhla giving comments, “behind her was a verbal altercation between two young men, drawing part of the attention away.”

Then came the crescendo. When the air raid alert sounded, “the masked individuals demonstratively lit flares—an impressive picture, you’ll agree.”

Classic Russian influence operation

The provocateurs’ work didn’t end with the flares. Multiple Russian media outlets, starting from TASS, quickly fabricated coverage, with headlines like “Protesters in Kyiv called Zelenskyy and Yermak ‘traitors of Ukraine'” appearing the next day.

“They unfurled posters with images of Zelenskyy and Yermak, accompanied by inscriptions: ‘Killers of democracy – traitors of Ukraine’ and ‘Dictators.’ The posters also indicated that ‘these two’ are destroying the country, and ‘Ukrainians are not slaves,’” TASS reported on the provocateurs.

They cited Strana.ua, a pro-Russian media outlet that Ukraine sanctioned in 2021, as their source without providing actual links to any such article. Strana indeed reported on the event, on their Telegram channel, using a video by UNIAN with a comment presenting this as legitimate sentiments of the protesters.

The catch is that Ukrainian media, sensing Russian hybrid warfare operations from a mile away, either did not report on the men or reported them as provocateurs. Even the opposition 5 Kanal tweeted the video with a comment “provocative action” and followed up with a comment from the organizers that dismissed the burned Yermak and Zelenskyy portraits as a “provocation.”

The UNIAN video that Strana.ua shared the video with this comment: “At a protest in Kyiv, a group of planted provocateurs are lighting flares to the sound of air raid sirens. It looks like these uninvited guests are clearly and openly staging a photo op. Makes you wonder who needs this footage besides Russian propaganda—and who’s pulling the strings?”

What unraveled in the backyard of the President’s Office in Kyiv on 24 July was a classic Russian influence operation. Its aim was to fabricate a virtual reality inside the heads of Russians to validate the propaganda narratives driving Russia’s war—that Ukrainians want this, because they don’t support Zelenskyy anyway.

The inflammatory signs calling Zelenskyy a “dictator” and “traitor” now circulate in Russian information space—manufacturing evidence that Ukraine is fragmenting internally to validate Moscow’s narrative that its invasion “liberates” Ukrainians from their government.

We’ve seen multiple examples of how these operations work in the Surkov Leaks, a collection of Vladimir Putin’s gray cardinal Vladislav Surkov, who worked to destabilize Ukraine from within after the Euromaidan revolution with hybrid warfare means. So far, it appears that the operation has influenced solely Russians, as the incendiary narrative of “down with the dictators” proved too radical for Ukrainians.

But that doesn’t mean that the Kremlin won’t keep trying and finding other ways to mess with the minds of Ukrainians—and anybody else gullible enough to fall for the Kremlin’s information warfare.

Explore further

What Surkov’s hacked emails tell about Russia’s hybrid war against Ukraine

What happens next?

But here’s what actually happened to the supposed “dictator”: within three days of signing the controversial law, Zelenskyy submitted corrective legislation under intense public pressure.

“We heard the street,” he admitted, promising new legislation to restore anti-corruption agency independence. Parliament has scheduled July 31 to vote on the bill—though passage isn’t guaranteed.

Protesters haven’t declared victory yet. They’ve vowed to keep demonstrating until the corrective law actually passes and institutional independence is genuinely restored. The danger to democratic institutions was real, and vigilance remains essential.

But that’s precisely the point. The provocateur operation aimed to show Russians that Ukrainians reject their leadership and welcome “liberation.” Instead, it captured something different: a democracy under stress but still functioning. Public pressure forced a presidential retreat. Protests work. Institutions push back. Citizens stay engaged.

Ukraine’s democracy is imperfect and fragile—but it’s alive. The operation succeeded only in Russian information space, manufacturing the illusion of internal collapse for domestic consumption while the real Ukraine continued the messy, contentious work of democratic governance.

She was killed to be silenced. On July 19, in Lviv, Ukrainians marked the first anniversary of the death of Iryna Farion. She was a prominent linguist, scholar, politician, and symbol of the fight for Ukrainian identity, UkrInform reports.

Her murder in Lviv in 2023 at the age of 60 is seen not merely as a criminal act but as part of Russia’s hybrid war.

“The enemy is trying to use every tool to divide our nation,” said Ukraine’s military intelligence chief, Kyrylo Budanov, following her death.

The attack on Farion is also regarded as a psychological attempt to intimidate its most courageous Ukrainian voices.

A year after the assassination, her family, colleagues, students, and community members gathered for a memorial service at the Saints Peter and Paul Garrison Church. Later, a procession made its way to Lychakiv Cemetery, where Farion is buried.

People will also assemble in silence in the courtyard on Masaryk Street, where she was killed, at 7:22 PM, the exact moment the fatal shot was fired one year ago. 

Farion’s daughter, Sofiia Osoba, left a powerful message on Instagram.

“A year. What is it like to live without Mom?.. I am an orphan. Ukraine is orphaned… I don’t want 19 July… This is the end of everything. 23:20. The end of your life. Now, it will be years,” she wrote.

Six days after the murder, Ukrainian law enforcement detained the suspect, 19-year-old Dnipro resident Vyacheslav Zinchenko. The court trial is currently ongoing.

An Estonian court found that Russia’s military intelligence agency, the GRU, ordered arson attacks in Estonia, including the firebombing of a Ukrainian-themed restaurant in Tallinn. The attacks were part of a wider Russian sabotage campaign aimed at destabilizing Western nations and undermining their support for Ukraine.

GRU ordered firebombing operations via Moldovan nationals

On 2 July, the Harju County Court in Estonia sentenced two Moldovan nationals, both named Ivan Chihaial, in connection to arson attacks carried out in January 2024, Euronews and ERR reported. One was convicted of directly executing the operations and received six and a half years in prison. The other, his cousin, was sentenced to two and a half years as an accomplice.

The court stated that the primary perpetrator was working on behalf of Russia’s military intelligence agency, the GRU. His first mission, according to the court, was a 2024 trial operation involving the arson of a co-op supermarket in Osula, a village in southeastern Estonia. The next day, GRU operatives instructed him to target the Slava Ukraini (“Glory to Ukraine”) restaurant in Tallinn.

Attack on Slava Ukraini restaurant executed overnight on 31 January

Court documents revealed that on the night of 31 January, the main suspect and his cousin traveled to Tallinn and set fire to the Slava Ukraini restaurant. The cousin was reportedly unaware of the GRU connection.

According to the court ruling, at 4:30 a.m. on 31 January, the older Chihaial smashed a window of the Slava Ukraini restaurant, threw in a can of gasoline, and set the building on fire. Meanwhile, the younger Chihaial filmed the arson from across the street; the footage was later uploaded to YouTube by the GRU. After the attack, both suspects left Estonia.

Estonia’s State Prosecutor Triinu Olev-Aas stated that cooperation among Latvian, Lithuanian, and Polish authorities was instrumental in tracking and arresting the men in Italy. They were extradited back to Estonia to face charges.

GRU’s use of foreign nationals signals recruitment challenges

The Estonian Internal Security Service noted that the GRU’s use of Moldovans instead of Russian citizens indicates growing difficulty in recruiting operatives from within Russia. Estonia has previously faced Russian cyberattacks and vandalism targeting vehicles of outspoken anti-Kremlin figures.