The Owls Are Not What They Seem

Four years inside Ukraine’s most dangerous intelligence agency

DEAR READER: Please consider a basic support membership at $5 per month. As a journalist in Ukraine, I work every day (even during blackouts and drone attacks) to examine our world situation from where the fulcrum of the world’s hell pivots, and your help is vital. Today is my 1410th day in this 1456 of full-scale war (4382 since 2014), and Independent Journalism is not cheap to do, and I will keep making the posts available for all readers (even during nearly 24 hr daily blackouts), but good patrons are needed and I thank you for your time. – Chris Sampson, Kyiv, February 19, 2026

If there is one thing I have learned in four years of living in this country — watching this war unfold from a city that was never supposed to survive its first week — it is this: never underestimate the owls.

The owl is the symbol of Ukraine’s military intelligence directorate, the HUR. It sits on their emblem gripping a sword, staring forward with the particular calm of a predator that has all the time in the world. When the agency launched its Telegram channel on March 1, 2022 — five days after Russia’s full-scale invasion began, while tank columns were still pushing toward Kyiv — the first thing they posted was a question.

Do you still need an explanation for why our emblem shows an owl holding a sword, piercing Russia?

They answered it themselves: We are working. Everything will be fine. Everything will be Ukraine. Victory is ours.

I have watched them prove it, over and over, in ways that rewrote the rules of modern warfare and left military historians scrambling to update their textbooks. This is just a sample of that story, the rest may be in a book one day, as the writing is still happening and there are stories I can’t tell you, just yet.

The Darkest Days

March 2022. Russian armored columns were advancing on Kyiv. The Kremlin’s plan called for the capital to fall in seventy-two hours. Wagner mercenaries had already been dispatched with a kill list. Kyiv was supposed to be a corpse.

What actually happened at Hostomel Airport, ten kilometers northwest of the capital, was different. Russian paratroopers from the 31st Guards Air Assault Brigade seized the airfield in those first chaotic hours — a classic vertical envelopment, textbook Soviet doctrine, designed to open a corridor for the main armored thrust. They expected to hold it unopposed while reinforcements landed.

They found GUR special forces waiting.

Over forty-eight hours of combat at Hostomel, Ukrainian intelligence operators — alongside units from the 3rd Special Forces Regiment — killed more than fifty Russian soldiers and destroyed ten BMD infantry fighting vehicles. They captured a command and control vehicle. They denied Russia the airfield. The plan that was supposed to end Ukraine in three days shattered in the glass factory district of a small city most people had never heard of.

The owls had already been watching. They had the plans before the first shot was fired.

The Architecture of Transparency

Here is what made GUR different from the beginning, and what the world’s intelligence services are still trying to understand.

They talked.

Not vaguely. Not in careful diplomatic language designed to reveal nothing. They named names. They published photographs. They released audio. They announced operations after — and sometimes before — they happened. They disclosed the specific number of missiles Russia had left. They described their sources inside the Kremlin. They told you exactly what they were doing and why.

This was not an accident. It was a weapon.

When GUR published the complete roster of pilots from Russia’s 18th Strike Aviation Regiment — names, ranks, photographs, unit affiliations — they were not just embarrassing the men who were bombing Ukrainian cities. They were demonstrating to every soldier in Russia’s military that there was nowhere to hide. That the eyes saw everything. That accountability was coming.

When they published the personal data of soldiers committing war crimes in Kharkiv, Bucha, Mariupol — passport numbers, home addresses, relatives — it served the same function. The psychological impact of knowing you have been identified, documented, catalogued — that spreads through a military like a virus.

“Ukrainian owls will find each one of you,” they wrote. “We guarantee it.”

The intercepts were perhaps the most devastating tool. Starting in the first days of the war and continuing without pause for four years, GUR published recordings of Russian soldiers’ phone calls home. The soldiers complained about their officers. They described killing unarmed civilians. They talked about looting washing machines and refrigerators. One commander was recorded giving explicit orders: prisoners in Popasna were to be shot.

The recordings served as both evidence and ammunition. Evidence for the war crimes prosecutors already building cases in The Hague. Ammunition for the information war GUR was fighting simultaneously on every front. Because when a Russian soldier calls his mother and tells her that Putin ordered them to level Ukrainian cities to the ground — and that call is published with full authentication on a Telegram channel with millions of followers — the effect is not just embarrassment. It is the systematic destruction of every Russian information operation claiming this war is anything other than what it is.

The Moskva

April 14, 2022. The guided missile cruiser Moskva, flagship of Russia’s Black Sea Fleet, sank in the Black Sea after being struck by Ukrainian Neptune missiles. Twelve sailors were officially acknowledged as killed. Twenty-seven were listed as “missing.”

Russia claimed a fire caused the sinking. The story changed several times.

Eight days later, GUR disclosed what had actually happened in the aftermath. Admiral Viktor Osipov, commander of the Black Sea Fleet, had been arrested. The Kremlin’s purge of its own military leadership — desperate to assign blame for a catastrophe it couldn’t explain — had begun at the very top.

Over the following months, GUR documented the cover-up methodically. Crew members who had died were listed as missing rather than killed, to minimize official death figures. Families received no information. Inquiries were suppressed. The exact number of men who went down with the Moskva — a number Russia worked hard to obscure — was one of those facts that the owls watched quietly, waiting to confirm.

What they established was this: Russia could not protect its flagship. Could not acknowledge its losses. Could not tell the truth to the families of its dead. And it was willing to arrest its own admiral rather than confront what had actually happened.

This pattern — military failure, immediate cover-up, scapegoating of commanders, suppression of casualties — would repeat itself dozens of times over the next four years. GUR documented every iteration.

The Nuclear Question

Through the spring and summer of 2022, as Russia’s battlefield failures multiplied, the question that kept Western chancelleries awake at night was the same one: would Putin use nuclear weapons?

Kyrylo Budanov, then head of GUR, answered it directly and early.

Russia’s nuclear threats, he said, were psychological warfare. The storage sites were all under surveillance. The chain of command required multiple authenticating signatures for any launch order. The scenarios being floated in Russian state media — tactical nukes on the battlefield, dirty bombs, attacks on nuclear facilities — were designed to paralyze Western decision-making, not to announce actual intent.

He was right. And he said so publicly, at a moment when the pressure to panic was intense.

This was Budanov’s particular genius: the ability to distinguish between what Russia was signaling and what Russia was actually capable of. When Ukrainian forces set fires in the exclusion zone around Chernobyl in the spring of 2022, and Russian propagandists claimed radioactive smoke would drift across Europe, GUR monitored the radiation sensors and issued calm, precise assessments. When Russia shelled the Zaporizhzhia nuclear plant and international observers feared a meltdown, GUR tracked every incident and contextualized what was deliberate provocation versus what was genuine danger.

The nuclear blackmail never stopped. But after Budanov repeatedly and accurately called it for what it was, the blackmail lost most of its power.

He had, by his own account, sources at the highest levels of the Kremlin. He described knowing about Russian plans “as soon as they are conceived in the big offices.” Whether that was precisely true, or partly true, or a carefully crafted information operation of its own — it accomplished the same thing. Russian commanders began to operate with the knowledge that their communications might already be compromised. That operational security inside the Russian military, never particularly good, became catastrophic.

The Summer of Shame

Olenivka. July 29, 2022.

In a former prison colony in Russian-occupied Donetsk, a building housing Ukrainian prisoners of war was destroyed in an explosion. More than fifty prisoners were killed, most of them defenders of Mariupol — men who had held out in the Azovstal steelworks for months before being evacuated under a negotiated agreement.

GUR published its findings in a joint statement with the Security Service of Ukraine, the General Staff, and the Ukrainian Parliament’s human rights commissioner. The conclusion was unambiguous: this was a deliberate act of terrorism. The forensic evidence pointed to a thermobaric device deployed from inside the facility. The explosion pattern was inconsistent with an external missile strike, as Russia claimed.

Wagner Group was implicated in the operation.

Wagner. That name would appear in GUR’s intelligence throughout 2022 and 2023 — the mercenary force that Yevgeny Prigozhin was building into his private army, deployed in Ukraine, Africa, Syria, the Middle East. GUR tracked Wagner’s movements from the first week of the war, when mercenaries arrived with assassination teams targeting Ukrainian leadership. They documented Wagner fighters dying in eastern Ukraine within weeks of the invasion’s start.

And then, on June 23, 2023, they watched in real time as Prigozhin launched his mutiny.

The Mutiny

GUR’s coverage of the Wagner rebellion was remarkably precise.

As Prigozhin’s columns moved toward Moscow — a march that covered hundreds of kilometers in a matter of hours before stopping mysteriously — GUR published intelligence updates in near real time. They tracked the convoy’s progress. They monitored Russian government communications. They noted the extraordinary collapse of any effective military response from the Kremlin.

And then, weeks after the mutiny, they disclosed something that sent a chill through every Western nuclear security expert.

During their march, Wagner forces had approached within striking distance of Voronezh-45, a closed Russian city that houses significant nuclear weapons storage infrastructure. How close? Close enough that the implications were obvious. Russia’s private army had, in the course of a mutiny, passed near nuclear facilities without any apparent organized military response.

GUR also intercepted communications from Russian soldiers reacting to the mutiny. The soldiers expressed sympathy for Prigozhin. They questioned their own command. They debated who was telling the truth.

These were ordinary conscripts and soldiers, phoning home, saying the things that Russian state television would never say — that something was deeply broken inside the Russian military establishment.

Prigozhin died in a plane crash two months later. GUR noted the circumstances. They said nothing more than was necessary.

The Man in the Center

I need to tell you about Kyrylo Budanov.

He became director of HUR in 2020, at thirty-four years old. Before the full-scale invasion, he was not widely known outside intelligence circles. What he had was an operational background — special forces, clandestine work, the kind of experience that doesn’t appear in official biographies. He had been shot, stabbed, and poisoned before the war even started, by Russian agents who understood well before February 2022 that he was dangerous.

When the invasion began, he became something Ukraine had not quite had before: an intelligence chief who spoke in public, clearly, in complete sentences, about what was actually happening.

He predicted the Kyiv offensive would fail. It did. He described Russian logistics as catastrophically insufficient for their stated objectives. He was right. He assessed the morale of the Russian military as deteriorating faster than official casualty figures suggested. He was right about that, too.

In May 2023, GUR disclosed that Budanov had been seriously wounded. A shrapnel fragment, lodged near his heart. Surgery had been performed. He had returned to work.

He had said none of this himself. He disclosed it only when the wound was no longer operationally relevant. He then continued giving public assessments of the war with the same unhurried precision he had displayed from the beginning.

The Russians tried to kill him repeatedly throughout the war. Multiple assassination attempts, using a variety of methods. His wife was poisoned in an attack that targeted his household. None of it stopped him.

In January 2026, President Zelenskyy appointed Budanov as head of the Presidential Office — moving him from HUR to the center of Ukraine’s strategic decision-making at the most delicate moment of the war.

The owls watched a Russian woman in Shebekino react to the news of his appointment. The intercept was published without comment.

“He’s a non-human,” she said. “He’s the first fascist.”

In four years of watching this war, that one intercepted phone call may be the most accurate measure of how effectively GUR had done its job.

The Sea Changes Everything

August 2023. Group 13 existed. That was about all that was publicly known.

A unit within HUR, operating somewhere in Ukraine, building something. The name of their commander was known only by his callsign: Trynadtsyatyi. The Thirteenth.

By December 2023, Group 13 had sent Magura V5 maritime drones into Crimea’s Donuzlav Lake and sunk two Russian landing craft. The footage was extraordinary — small unmanned surface vessels, moving through the dark, striking warships and pulling away. Ukraine had no navy to speak of. The Black Sea was nominally dominated by the Russian fleet, which had been blockading Ukrainian ports and launching cruise missiles from its vessels for almost two years.

Then February 1, 2024. The missile corvette Ivanovets was patrolling near Crimea when six Magura drones struck it. The Ivanovets sank. Six direct hits, the last while the ship was already on fire. Footage of the attack was released and it was impossible to look away: small, fast, relentless, while the warship twisted and burned and went down.

Valentine’s Day, 2024. The large landing ship Caesar Kunikov. Group 13 again. Magura again.

March 5, 2024. The patrol ship Sergey Kotov. Gone.

May 6, 2024. The patrol boat Mangust. Gone.

May 30, 2024. Four Tunets-class boats simultaneously. Gone.

The Black Sea Fleet, which Russia had spent decades and billions building into a regional power projection instrument, was being dismantled by a unit that hadn’t existed in recognizable form before the war, using weapons Ukraine invented from scratch, funded partly by crowdfunding campaigns run by Ukrainian artists, athletes, and celebrities.

Trynadtsyatyi spoke to The New York Times in December 2023. He did not soften his assessment: “The Black Sea Fleet has effectively capitulated in Crimea. Everything most modern and necessary has been withdrawn from Sevastopol. It is paralyzed.”

Then GUR disclosed something that military historians will write about for decades.

On June 17, 2024, Trynadtsyatyi confirmed in an exclusive interview that new Magura variants had been equipped with R-73 air-to-air missiles. Soviet-designed, infrared-guided, originally meant to be fired from aircraft.

They were now mounted on a sea drone.

On December 31, 2024, two Russian Mi-8 helicopters were shot down over the Black Sea.

By sea drones.

Think about what that means for a moment. A maritime unmanned vehicle, operating on the surface of the water, shot down aircraft flying overhead. There is no precedent for this in the history of warfare. The first aircraft to successfully attack a naval vessel was in 1911. The first effective anti-ship missile was in the 1940s. This — an unmanned surface vessel engaging and destroying airborne targets with air-to-air missiles — is a category that did not exist before Ukraine invented it.

On July 2, 2025, Ukraine’s Book of Records officially certified five world firsts: first warship sunk by maritime drone, first aircraft shot down by maritime drone, first aerial target engaged by maritime drone weapons system, and two additional firsts for scale and breadth of operations. GUR received the certificates at a formal ceremony.

They put three Magura models on permanent display at the National Museum of World War II History in September 2025.

A land-based intelligence agency without a navy built the capability that destroyed a fleet.

The owls.

The Ghosts

Meanwhile, something else was happening inside occupied territory, and inside Russia itself.

Prymary. Ghosts.

GUR’s Prymary unit began appearing in documented operations in 2024 and accelerated through 2025 into a systematic campaign against Russian military infrastructure. Their targets: radar systems, air defense networks, aircraft on the ground, ships in port.

The targeting list is worth reading slowly.

The 48Ya6-K1 Podlyot radar system. The 9S32 Imbir tracking radar. The 39N6 Kasta-2E2. The 98L6 Yenisei, which is part of the S-500 air defense system — the most advanced anti-aircraft system Russia fields. S-400 batteries. TOR-M2 and BUK-M3 systems. Aircraft: MiG-29s, Su-24s, Be-12 maritime patrol aircraft — the first time that type had ever been destroyed in combat. AN-26 transports. Mi-8 helicopters. Ka-27 anti-submarine helicopters.

And on August 28, 2025, a Buyan-M missile corvette in the Azov Sea. A missile ship. Destroyed by the Ghosts.

In January 2026, Prymary released a compilation video: a year of strikes condensed into minutes. Radars burning. SAM systems exploding. Aircraft on their parking ramps destroyed. The footage was captured by the drones themselves, methodical and relentless.

This was happening inside Crimea, inside occupied Ukrainian territory, and — by consistent implication — inside Russia itself. The 47th Missile Brigade in Korenovsk, Krasnodar Krai, suffered a strike in late December 2025. A military convoy burned. Russian soldiers died on Russian soil.

GUR never claimed precisely which operations they conducted inside Russia. They didn’t need to. The pattern was obvious, and the pattern served its purpose.

The Submarine Commander Goes Jogging

July 10, 2023. Stanislav Rzhitsky, former commander of the submarine Krasnodar, went for his morning run in the Park of Culture and Rest in Krasnodar city, Russia.

The Krasnodar had fired cruise missiles at Ukrainian cities. The ship’s crew had been documented and identified by GUR as war criminals.

It was raining heavily. The park was empty.

Seven shots from a Makarov pistol. Rzhitsky died on the path.

There were no witnesses.

GUR published the account the following morning with characteristic precision: the time, the location, the weapon, the number of shots, the cause of death.

It was four paragraphs long.

This is a story about intelligence, but it is also a story about accountability. About the fundamental promise that GUR made on the very first day of the full-scale invasion, when they published the names and photographs of aviation officers bombing Ukrainian cities: the owls will find you.

The Half-Million Dollar Con

January 1, 2026.

GUR’s first announcement of the new year was not about missiles or drone strikes or battlefield positions. It was about a magic trick.

Denis Kapustin, commander of the Russian Volunteer Corps — Russians fighting on Ukraine’s side — had been marked for assassination by Russian intelligence. A bounty of $500,000 had been placed on his head by the FSB. An operation to eliminate him had been contracted and set in motion.

GUR found out. They staged his death. They created the evidence — the video footage, the documentation — to convince Russian intelligence that the contract had been fulfilled. The FSB paid.

Then GUR published photographs of Kapustin alive, smiling.

Budanov’s welcome: “Welcome back.”

The $500,000 was redirected to special operations units of HUR.

There is a particular kind of intelligence operation that goes beyond the simple defeat of an adversary. This is one of them. GUR didn’t just stop the assassination. They turned it into a financial operation against Russian intelligence, exposed the FSB’s contract structure, and demonstrated publicly — to every potential target of Russian assassination operations — that Ukraine’s intelligence apparatus could protect them and make Russia pay for the attempt.

And they announced it on New Year’s Day, while Ukrainian soldiers were freezing in trenches and missiles were still falling on Ukrainian cities, because the announcement itself was a weapon.

The owls don’t just watch. They perform.

The Voices on the Other Side

Throughout four years, interwoven with every major operation and every intelligence assessment, there was a parallel river of sound.

Ordinary Russian voices, intercepted by Ukrainian military intelligence, processed, translated, published.

A woman in Belgorod watching Grad rockets fire from a residential neighborhood, marveling at the “fireworks.” A soldier begging his commander to delay a night march until morning because he was afraid of dying in the dark. A man in Shebekino whose relative had been listed as “missing in action” for two weeks — “Punt also disappeared, hasn’t been in contact since the 27th.” Soldiers discussing the Wagner mutiny with frank sympathy for Prigozhin. A woman in Belgorod describing Russia’s military commanders: “Gerasimov’s face is all crooked. My God, Yulia, look at his mug.”

And on January 6, 2026, after Budanov’s appointment to the Presidential Office was announced, the woman in Shebekino: “He’s a non-human! He’s the first fascist!”

These recordings were not entertainment. They were documentation. They were the systematic dismantling, one phone call at a time, of every Russian narrative about the war.

Russia was fighting for the brotherhood of Slavic peoples. But the soldiers’ phone calls home described looting and murder. Russia was winning on every front. But the soldiers’ voices described fear, confusion, desertion. Russia’s army was a professional fighting force. But the recordings documented commanders threatening to beat subordinates who asked reasonable questions about their survival.

The voices on the other side told the truth that Russian state television would not. GUR simply made sure the world could hear them.

What the Owls Built

By February 2026, GUR had become something that had no real historical precedent.

They were an intelligence agency, yes — but also a drone development and manufacturing operation. A maritime strike force. A strategic communications operation with its own documentary film unit. A war crimes accountability database. An international accountability portal cataloguing sanctioned Russian assets, propaganda voices, stolen Ukrainian cultural artifacts, and foreign companies supplying Russia’s war machine. A legal support operation feeding evidence to international courts. A psychological operations unit that published intercepts. A unit running operations deep inside Russia.

And through all of it, a public-facing communications apparatus that operated with a discipline and strategic clarity that most governments’ press offices would envy.

The War & Sanctions portal that launched at the end of 2024 as a list of thirteen Kremlin propagandists grew, by late 2025, into something enormous: hundreds of propagandists named and documented; 139 vessels and 142 ship captains identified as facilitating sanctioned Russian oil; detailed accounting of more than a thousand Ukrainian cultural artifacts stolen from occupied territories; and comprehensive technical documentation of foreign-made components — machine tools, microchips, semiconductors — found inside Russian weapons.

The accountability architecture GUR built is designed to outlast the war itself. When the shooting stops, the documentation will remain. The legal cases already filed will proceed. The evidence chains will hold.

This was also intentional.

Budanov’s New Post

January 2, 2026. President Zelenskyy offered Budanov the leadership of the Presidential Office.

Budanov accepted. His statement was three sentences: “I accept the President’s proposal. I continue to serve Ukraine. I consider the position of head of the Presidential Office as another line of responsibility before the country.”

Four years at the intersection of intelligence, information warfare, deep operations, drone technology, and strategic signaling. Now the man who had built all of that was being moved to manage Ukraine’s most complex strategic challenge — negotiations, security guarantees, the diplomatic track of a war that was still being fought.

It was a logical appointment. The skills GUR had developed — the ability to see through Russian deception, to read Kremlin signaling, to operate in denied environments, to communicate with precision, to build cases that would hold in daylight — were exactly the skills needed for what was coming.

The owls had not stopped watching.

The Thing About the Owls

There is a line from the original Twin Peaks that lodged in my memory years before I came to Ukraine, and that I have thought about constantly in four years of watching this war: The owls are not what they seem.

In Lynch’s strange dream logic, it was ominous. In this war, in this country, it became something else.

Ukraine’s military intelligence was supposed to be what Russian propaganda said it was: a second-tier agency in a second-tier military, outmatched and overwhelmed, destined to be absorbed into a reconstituted Russian sphere of influence within days of the invasion.

It was not that. It was not that at all.

It built maritime drones that sank a fleet. It ran operations inside Russia itself. It staged a fake assassination and billed Russia’s intelligence service half a million dollars. It documented thousands of war crimes in a legal architecture that will take years to fully prosecute. It invented a weapons system — armed maritime drones with air-to-air missiles — that has no historical precedent. It ran influence operations, built international coalitions, made its intelligence assessments in public, and was right about the things that mattered most.

And its leader, the calm and precise Kyrylo Budanov, spent four years being the most trusted voice on the Ukrainian side of the war — trusted because he said what he knew and acknowledged what he didn’t, trusted because the pattern of his predictions was consistently accurate on the structural questions, trusted because he operated with a directness that felt almost alien in a world of managed communications.

Now he is in the Presidential Office. Which means the qualities he brought to military intelligence — the precision, the strategic vision, the willingness to operate in the open — are now available to Ukraine’s most sensitive diplomatic challenge.

I don’t know how this war ends. Nobody does. But I know what four years of watching the owls has taught me.

Underestimate them at your peril.

The angry posts began flooding the internet on February 28, 2022, from Russian tech forums, from military bloggers, from Kremlin media: Kyiv would fall. Ukraine would surrender. The owl on the intelligence directorate’s emblem would be an artifact of a state that no longer existed.

Four years later, the owl is still there. Still gripping the sword. Still watching.

It ate the mice.

Chris Sampson is editor-in-chief of NatSecMedia and has been based in Kyiv since January 31, 2022. He is the author of Hacking ISIS and a contributor to multiple works on Russian information warfare. Your direct support for independent journalism in war is greatly appreciated. https://chrissampson.com/