Ukraine's military intelligence turns its sanctions tracker into a public ledger of the engineers behind the invasion

Kyiv's Main Intelligence Directorate has opened a new section of its War&Sanctions portal naming the firms, middlemen and financiers it says keep Russia's war machine running — and inviting outside researchers to do the verification work that diplomats often cannot.

By Monexus Staff Writereurope6-minute read10 Jun 2026☆ Save ↗ Share ⎙ Print

On the morning of 10 June 2026, the press service of Ukraine's Main Intelligence Directorate (GUR) of the Ministry of Defence announced the launch of a new section on its War&Sanctions portal — "Engineers of aggression" — billed as a public, continuously updated ledger of the companies, financial intermediaries and individuals the agency holds responsible for sustaining Russia's full-scale invasion of Ukraine.

The move is the latest, and arguably the most pointed, attempt by a belligerent state to convert open-source intelligence into a sanctions-grade evidence base that third-country regulators, banks and journalists can act on without waiting for a formal diplomatic process. It also crystallises a quieter contest that has run alongside the fighting for more than three years: the battle over who gets to author the official record of the war economy.

What is actually new

War&Sanctions has existed since the early months of the invasion as a searchable database of Russian and foreign companies whose products, components or capital flows feed the Kremlin's defence-industrial base. The "Engineers of aggression" section, according to the 10 June GUR announcement, narrows the focus from the goods moving through the war economy to the organisations and individuals facilitating it — including shipping agents, dual-use electronics brokers, financial nominees and the corporate vehicles that obscure beneficial ownership.

GUR's framing in the announcement is unusually candid about intent: the portal is positioned not as a closed intelligence product but as a working document designed to be downloaded, cross-checked and escalated by partner agencies and investigative outlets. That is a meaningful shift. Previous rounds of Ukrainian sanctions exposure tended to arrive as discrete leaks — names attached to specific strikes, or to specific intercepted shipments — and were often difficult to verify outside Kyiv. A persistent, browsable registry changes the verification problem for foreign prosecutors, compliance officers and reporters, who can now match their own internal records against the public list rather than waiting for a tip.

The cultural register of the release also matters. "Engineers of aggression" is deliberately not a military term. It borrows the language of compliance and corporate governance — a domain where Western banks, shipowners and insurers have spent the last three years building internal control regimes. By reaching for that vocabulary, GUR is signalling that the portal is meant to be plugged into existing due-diligence workflows, not merely consumed as wartime propaganda.

The counter-narrative

Kyiv's framing is not the only one in play. Russian state-aligned outlets routinely characterise Ukrainian intelligence releases as fabricated or as cover for commercial competitors of Russian industry. The standard line — that the West's sanctions regime is itself a form of economic warfare, and that neutral third-country firms named in Ukrainian databases are being coerced into political alignment — is pushed by Moscow with persistence.

There is a partial structural kernel to that complaint. Open-source sanctions databases, by design, cast a wide net; they often include entities whose only contact with the Russian market is a single shipment, a nominee shareholder or a former employee. The reputational cost of being listed is real and can fall on firms that are themselves small and politically unconnected. The honest version of the critique is that the burden of proof in a public ledger is heavier than the burden of suspicion: a name on a screen is not the same as a conviction, and a database that is good enough to be useful can also be good enough to be unfair. Ukrainian officials, including GUR spokespeople, have in past releases committed to corrections and takedowns where evidence is shown to be faulty, and the credibility of the new section will depend on how rigorously that discipline is applied.

A second, less sympathetic reading of the portal comes from Western capitals, who sometimes treat Ukrainian intelligence publishing as a substitute for their own enforcement work — a way for Kyiv to do the politically easy part of sanctions (naming) while governments in Brussels, London and Washington retain the discretion to do or not do the harder part (designating, freezing, prosecuting). The release of 10 June, by offering a more structured evidentiary spine, is plainly designed to close that gap.

A structural shift in wartime transparency

The deeper story is the slow normalisation of intelligence publishing as a tool of statecraft. For most of the post-1991 period, Western intelligence agencies treated public attribution — naming a state actor for a specific operation — as a high-risk, low-frequency move, used sparingly because each attribution burns sources and methods. The model has been inverted for wartime Kyiv. Ukrainian intelligence, fighting a war on its own territory with a civilian population as its principal constituency, has little to lose and much to gain from making its case in public, repeatedly, in formats journalists and lawyers can use.

That posture has had measurable downstream effects. Shipowners in the Mediterranean, compliance officers in the Gulf and treasury officials in Europe have all, in the past two years, cited Ukrainian open-source products in decisions that would previously have awaited a formal national designation. The "Engineers of aggression" section is best understood as the institutionalisation of that practice: a permanent, expandable front end to what was, until recently, a press-conference practice.

There is a cost to this model. A database that promises to be exhaustive will, eventually, be judged by its errors. A portal that invites outside researchers will receive outside criticism. The next test for the project is not whether it can be launched — that is now done — but whether GUR can maintain the corrections culture that a public ledger demands.

Stakes and what to watch

For Kyiv, the calculus is straightforward. The more that third-country banks, insurers and prosecutors treat War&Sanctions as a working input, the thinner the financial oxygen available to the Russian defence sector. For Moscow, the new section is another channel to attack, another narrative to discredit, and another argument for the eventual lifting of Western sanctions once the fighting stops. For the European Commission and OFAC, the open question is whether a Ukrainian-maintained database can serve as a procedural bridge to formal designation — or whether, as some officials privately suggest, it will continue to function as a parallel track that gives governments political cover without binding them.

The near-term indicators to watch are concrete: how many of the firms named in the new section are subsequently added to formal EU or UK sanctions lists within ninety days; how many are removed after the listed companies or their home-state regulators file evidence rebutting the Ukrainian claims; and whether GUR publishes its correction record. A transparent ledger, like a transparent court, is judged as much by what it retracts as by what it affirms.

What remains genuinely uncertain is the depth of the underlying evidence base. GUR's announcement describes the section's structure but does not, in the version circulated on 10 June, lay out the sourcing standards applied to each entry — whether entries are based on classified intercepts, open-source document analysis, court filings from third jurisdictions, or a combination. A follow-up release detailing the evidence categories would do more than any press conference to convert the project from a propaganda instrument, in the neutral sense of the word, into the shared compliance tool its designers say they want it to be.

Desk note: Monexus has reported from the GUR announcement as published on 10 June 2026, without external corroboration of individual entries. Claims about portal structure, function and intent are drawn from the GUR press service's own communication; the working of the database in third-country enforcement is, at the time of writing, a forward-looking question rather than a documented outcome.

Wire provenance

This editorial synthesis draws on the following public wire/social posts:

https://t.me/DIUkraine/
https://t.me/DIUkraine/