Explosions in Lviv: police release footage of a device being planted and detain a suspect — she says she acted on instructions from Russia
On the night of February 22 in Lviv, two improvised devices went off. Law enforcement detained a 33-year-old woman in less than a day — she says she acted on the "instructions of a handler from Russia." We examine what this means for security and which questions the state must now address.
By Tetiana Suchkova-Ladik
February 22, 2026 · 2 min read
Briefly
On the night of February 22 in Lviv two explosions occurred, resulting in the death of a 23‑year‑old policewoman and leaving about 25 people wounded — including both law enforcement officers and civilians. Police released video showing the preparation and placement of improvised explosive devices into trash bins.
Details of the arrest
Authorities identified the person involved in less than a day. Border guards from the 7th Carpathian detachment were involved in the operation; the suspect was detained in a controlled area near Staryi Sambir in Lviv region. The president, meanwhile, reported that several other individuals are under investigation.
“The suspect was detained ten hours after the attack”
— Oleksandr Klymenko, head of the Ministry of Internal Affairs
What the suspect said
The detainee is a 33‑year‑old resident of Rivne region. She said she allegedly received orders from a so‑called “handler from Russia,” and that she herself manufactured and planted the devices in the specified locations. Her statement is being recorded as part of the investigative materials — it requires verification and documentary confirmation.
“I was told to carry out the task”
— the suspect, 33, resident of Rivne region
Why this matters
If even part of the claims are confirmed, this would not be an isolated criminal case but an element of a hybrid operation: the use of local operatives to destabilize and increase fear in society. That shifts investigative priorities — focusing on establishing chains of command and supply, not only on local motives.
Counterterrorism experts note that such incidents often combine operational vulnerabilities (access to materials, movement routes) with external coordinating influence. That is why not only an operational response but also international coordination to confirm the sources of instructions is important.
Next steps
Now the key for the investigation is to document links, motives and supply chains for the explosive devices, and to forward materials for international verification if external contacts are found. At the same time, security procedures at places of mass gathering should be reviewed and controls in border regions strengthened.
This incident is a reminder: systematic work by security forces and transparency of the investigation are no less important than operational arrests. The investigation’s findings will determine whether the event becomes an episode of destabilization or an example of successful counteraction to hybrid threats.
Questions to monitor
Will the statements about suspicious persons become part of the evidentiary base? How quickly will the investigation link local operatives to possible handlers? And will partners step up cooperation in the investigation and prevention of similar attacks?
