The Oleksandrivskyi District Court in Zaporizhzhia is hearing the case of Kateryna Panfilova, who, according to the investigation, worked for the FSB and set up a network of agents in Ukraine. Among those known to the investigation was a teenager named Maksym from Zaporizhzhia (name changed).
The woman recruited him to surveil a law enforcement officer and plan his murder. A Slidstvo.Info journalist analysed the investigation files and uncovered how Panfilova recruited operatives, assigned tasks to them and organised the delivery of explosives to Ukrainian cities.
The recruitment of Maksym
In late October 2024, Maksym from Zaporizhzhia began exchanging messages on Telegram with a woman using the username “LiSa” (transl. — from Russian ‘fox’). Her profile contained no real photos or personal details — just dozens of images of foxes.
The woman introduced herself as “Lisa” and promised the young man money and help in covering his tracks. She claimed that her tasks could be carried out discreetly. Investigators allege that she knew he was a minor.
The first task was to gather what, at first glance, seemed like mundane details about a particular man: where he lived, what car he drove, and when he left home and returned. In reality, he was a law enforcement officer whom the Russian intelligence services had identified as a target.
Between 26 and 29 October, Maksym was to follow the law enforcement officer, taking photographs and filming him and his car. He was also to install a surveillance camera near the man’s home. According to the investigation, this information was needed to prepare an assassination attempt — the plan was to blow the man up.
The investigation does not specify exactly what the teenager managed to find out and carry out. However, his correspondence with “Lisa” did not stop. Over the following weeks, Maksym was to find and purchase TNT in Zaporizhzhia for other members of the network. He was then to set fire to an administrative building in the city, as well as find people in Kyiv who could collect the components of explosive devices from pre-arranged hiding places.
At the end of November, the young man received a parcel from Lviv containing an explosive device, delivered to a parcel locker in Zaporizhzhia. The package contained 444 grams of explosive material and a detonator. Later, he received another parcel at the same locker, this time sent from the village of Babyn in Rivne region. It contained mobile phones that were intended to be used as sensors, signal receivers, and electric detonators. Maksym was then instructed to store the parcels and wait for further directions from his handler.
To conceal the identities of those involved in the agent network, the details of fictitious individuals were used when sending and collecting the parcels.
On 14 December, the handler told Maksym that he would receive a parcel containing components for an explosive device from the Russian-occupied part of Zaporizhzhia region. It was to be dropped into the city by drone.
Who is “Lisa”?
Throughout this time, Maksym knew his handler only as “Lyisa” on Telegram — with no real photograph or identifying information. According to investigators, however, the account was operated by Kateryna Panfilova, who had taken part in hostilities against Ukraine, formerly commanded a medical platoon, and had been declared a “Hero of the DPR.” In 2017, a Ukrainian court sentenced her in absentia to 11 years in prison.
Kateryna Panfilova, who is now believed to use the surname Nadubova, was born in Yenakiieve, Donetsk region. According to her own account, in the spring of 2014 she was working as a shop assistant in Kyiv, but returned to her hometown after hostilities began in the Donetsk region. There, she learned to provide first aid at a local hospital and subsequently joined pro-Russian forces as a medic. It was there that she acquired the callsign “Lisa” — purportedly because of her red hair.
Court records describe her role in much broader terms. In May 2014, Panfilova joined the illegal armed formation known as the “Vostok Brigade,” which attacked Ukrainian administrative buildings and military units and set up checkpoints for militants on roads across Donetsk region.
According to the court judgment, while serving with the “Vostok Brigade,” Panfilova took part in combat operations near Donetsk Airport, Horlivka, Panteleimonivka, Spartak, Yasynuvata, Pisky, and Avdiivka. One of “Lisa’s” responsibilities was recruiting people and staffing the illegal armed formation.
Meanwhile, in the temporarily occupied territories and across the Russian media landscape, Kateryna Panfilova was portrayed as a “front-line medic.” In 2015, she became the commander of a medical platoon, and in 2016 she served as a nurse with the separate “Dunai” unit. Russian propaganda accounts also credit her with saving more than 300 militants during the fighting in Donetsk region. In November 2016, the occupation authorities awarded her the title “Hero of the DPR.”
In December 2017, the Shevchenkivskyi District Court of Chernivtsi found Panfilova guilty in absentia of participating in a terrorist organisation. She was sentenced to 11 years in prison, with confiscation of her property.
Panfilova never served her sentence in a Ukrainian prison. According to her own account, she left the service in 2017 and initially moved to Rostov-on-Don to join her husband, before later relocating to Naro-Fominsk in the Moscow region, where she worked at a hospital.
After the start of Russia’s full-scale invasion, Panfilova publicly raised aid for Russian troops. In 2022, for example, she told Russian media that she had created a community called “We Are United” (My yediny), whose members supplied Russian military units with quadcopters, thermal imaging devices, radios, clothing, and medical supplies. In later Russian publications, she is referred to as Kateryna Nadubova and described as the head of a foundation bearing the same name.
Publicly, Panfilova continued to present herself as a “medic” and “volunteer.” According to Ukrainian investigators, however, during this period she also voluntarily joined one of the units of the self-proclaimed “DPR Ministry of State Security.” Investigators believe that from 2022 onward, the activities of the “DPR Ministry of State Security” came under the control and authority of Russia’s Federal Security Service (FSB).
Not just a minor
The teenager from Zaporizhzhia was not the only person whom Panfilova, according to investigators, tried to recruit to work for the Russian security services. However, it is impossible to reconstruct the full composition of the group from the publicly available case materials: some individuals’ details have been altered or anonymised, while others appear only as potential operatives whom Kateryna Panfilova instructed others to find.
In the notice of suspicion, investigators describe how Panfilova searched for such recruits. She systematically monitored Telegram channels and chats where drugs were sold or jobs were advertised. Among their participants, she looked for Ukrainians facing financial hardship, holding pro-Russian views, or sympathetic to Russia.
Panfilova then communicated with them as their handler via Telegram, Element, and Signal, assigning tasks, monitoring their completion, and promising or transferring payments. The Zaporizhzhia Regional Prosecutor’s Office describes this system as an “agent network.”
Among the people whose identities Slidstvo.Info’s journalist was able to establish was a resident of Lviv. The man was tasked with finding detonators and components for improvised explosive devices, purchasing between five and ten kilograms of TNT, and arranging for it to be delivered to Zaporizhzhia and Rivne. Panfilova also instructed him to conduct surveillance on law enforcement officers and military personnel and to obtain the personal data of employees of the Security Service of Ukraine (SBU) and the Defence Intelligence of Ukraine (HUR).
However, the Lviv resident approached the SBU himself and reported his contact with the Russian side. In court, he said that he had provided law enforcement officers with his correspondence with “Lisa.” The case materials also contain SBU reports confirming that he cooperated with them.
At the same time, the man did not coordinate all of his actions with law enforcement. A court ruling cites a report containing the conclusions of a polygraph examination. It recounts the Lviv resident’s version of events: after several meetings with SBU officers, he allegedly concluded that law enforcement did not intend to pursue the case properly, became “disillusioned with the law enforcement system,” and decided to act on his own. According to him, he wanted to establish Panfilova’s whereabouts and arrange an in-person meeting with her.
Teenagers are recruited differently
Panfilova’s activities illustrate a clear difference between the methods used to recruit minors and those used to recruit adults. The SBU Directorate in Zaporizhzhia region says that ideological messaging plays little role in the recruitment of teenagers. A source whose name and position we are withholding for security reasons explains:
— No one talks to teenagers about the “Russian world,” Russia, or Putin. They are not being persuaded of anything. The second difference is that the communication takes the form of grooming — psychological manipulation in which an adult gradually gains the trust of a child or teenager. The recruiter tries to become an online friend. Communication may continue for a long time before the first task is assigned. This works particularly well with teenagers who have problems at home and lack close social contact or friends.
This approach is far less effective with adults. They already have established social circles, are generally more cautious about meeting new people, and are less likely to form online friendships.
Teenagers, by contrast, tend to be more trusting because they have less life experience.
— For example, a teenager might be told to leave a package under a car and be assured that the car’s owner will collect it later. An adult would be much less likely to believe that, the SBU directorate says.
Money is another important factor. Minors are paid less, while at the same time they are more likely to believe they can earn money by carrying out seemingly simple tasks.
— Blackmail is also particularly effective against minors. They are afraid not only of law enforcement, but also of how their parents will react. Threats may also be directed at their parents. We have seen cases in which minors began to realise they were doing something wrong and wanted to “get out,” and that was when the blackmail started.
What happened to Maksym and “Lisa”
Maksym’s story ended without a conviction. On 5 September 2025, the Dniprovskyi District Court of Zaporizhzhia released him from criminal liability.
The full text of the ruling is currently unavailable in the court register. It is known that the court applied a provision allowing a person to be released from liability for high treason if they voluntarily inform the authorities about their contact with a representative of a foreign state and the assignment they were given.
The Lviv resident who corresponded with “Lisa” was likewise released from criminal liability by a court in January 2026 on the same grounds.
At the same time, the man was held separately accountable for unlawful dealings with explosives which, according to the prosecutor, he carried out on his own initiative and outside the SBU’s control. He pleaded guilty to the unlawful acquisition, possession, carrying, and sending of explosive substances and ammunition. The court sentenced him to four years’ imprisonment, but suspended the sentence and placed him on probation for three years.
Panfilova herself remains in Russia and is therefore being tried in absentia. She is currently charged with high treason, involving a minor in unlawful activity, and organising the illegal handling of explosive substances and explosive devices by a group of people acting in prior conspiracy.
High treason committed under martial law is punishable by 15 years’ imprisonment or life imprisonment, with confiscation of property. Involving a minor in unlawful activity and the illegal handling of explosives carry prison terms of between three and seven years. If Panfilova is found guilty, the court will determine the final sentence based on the totality of the criminal offences.
The Oleksandrivskyi District Court of Zaporizhzhia is continuing to hear the case. The next hearing is scheduled for 12 August 2026.
