Agents didn't look like hitmen — they looked like couriers. That's how Russian security services masked the surveillance: the suspects posed as delivery service workers, photographed potential victims, recorded geolocations on Google Maps and reported to the resident. For each liquidation — up to $100,000 depending on the “target’s status.”
On February 20, 2026, the National Police and the SBU released details of a special operation codenamed “Enigma 2.0”. According to the investigation, an agent-combat group was preparing a series of contract killings of prominent Ukrainians — and operated simultaneously in two territories: Ukraine and Moldova.
Who was on the target list
Among the potential victims were the GUR of the Ministry of Defense’s strategic communications representative Andriy Yusov, fighters of the GUR’s Foreign Legion and the SSO, a journalist whom Russia has added to its list of “extremists” and declared wanted, the head of a state strategic enterprise, and a civil activist — a native of the Russian Federation who publicly supported Ukraine.
The selection logic was deliberate: media, intelligence, defense infrastructure, civil society. According to the National Police, enemy special services intended the high-profile killings to sow fear, demoralize the public and “destabilize the internal situation in Ukraine” — in other words, to do what missiles failed to achieve.
The Moldovan trail and the Transnistrian network
The network’s resident was a 34-year-old Moldovan citizen and repeat offender. According to the investigation, he was recruited by Russian special services while serving a sentence in Russia. He then recruited compatriots who were sent to Ukraine to carry out “targeted liquidations.”
“To carry out the criminal plans he involved four people, one of whom was a law enforcement officer. On the orders of the handler they identified potential victims among well-known public figures or members of the command of units of the Defense Forces of Ukraine.”
— from investigation materials released by the National Police
Money to prepare the attacks was routed through crypto wallets and bank cards of foreign financial institutions. The group’s accomplices were spread across Ukraine, EU countries and unrecognized Transnistria.
Two countries, one operation
On February 19, officers from the Department of Strategic Investigations and the Main Investigative Department of the National Police conducted joint actions with Moldovan colleagues — with the participation of the special unit “Fulger” and under the procedural leadership of Moldova’s Prosecutor’s Office for Combating Organized Crime. At the same time, searches were carried out in Kyiv and Odesa with the involvement of SBU counterintelligence and the GUR of the Ministry of Defense’s own security service.
Seven people were detained in Ukraine, and three more on the territory of Moldova, including the network’s organizer. The strategic handler of the entire operation — a 39-year-old officer of the GRU special unit “Kubinka” with the call sign “Meteor” — at the time of publication remained out of reach: he is in territory controlled by Russia.
Old scheme, new operatives
The name “Enigma 2.0” is not marketing. It means this is already the second iteration of an operation to neutralize similar networks. The scheme of recruiting via prisons in third countries is not new: it allows the GRU to keep distance from the operatives and shift the risk onto recruited citizens of states that are formally not party to the conflict.
The fact that an active-duty law enforcement officer was among the recruited raises a separate question — not about the loyalty of the system as a whole, but about the specific personnel vetting procedures that should have made this impossible.
If the investigation confirms that the financial chain runs through accounts in EU countries, Brussels will face a concrete precedent: are the existing financial monitoring mechanisms sufficient to detect such transactions before, rather than after, arrests?
