Ukrainians Were Likely Behind Kremlin Drone Attack, U.S. Officials Say

U.S. officials said the drone attack on the Kremlin earlier this month was likely orchestrated by one of Ukraine’s special military or intelligence units, the latest in a series of covert actions against Russian targets that have unnerved the Biden administration.

U.S. intelligence agencies do not know which unit carried out the attack and it was unclear whether President Volodymyr Zelensky of Ukraine or his top officials were aware of the operation, though some officials believe Mr. Zelensky was not.

The agencies reached their preliminary assessment in part through intercepted communications in which Russian officials blamed Ukraine and other communications in which Ukrainian officials said they believed their country was responsible for the attack, in which two drones were flown on May 3 toward the Kremlin, causing little damage.

U.S. officials say their level of confidence that the Ukrainian government directly authorized the Kremlin drone attack is “low” but that is because intelligence agencies do not yet have specific evidence identifying which government officials, Ukrainian units or operatives were involved.

The attack appeared to be part of a series of operations that have made officials in the United States — Ukraine’s biggest supplier of military equipment — uncomfortable. The Biden administration is concerned about the risk that Russia will blame U.S. officials and retaliate by expanding the war beyond Ukraine.

American spy agencies see an emerging picture of a loose confederation of Ukrainian units able to conduct limited operations inside and outside Russia, either by using their own personnel or partners working under their direction. Some of these missions could have been conducted with little, if any, oversight from Mr. Zelensky, officials said.

In addition to the drone attack, U.S. officials say they believe the Ukrainians were responsible for the assassination of the daughter of a prominent Russian nationalist, the killing of a pro-Russian blogger and a number of attacks in Russian towns near the border with Ukraine, the most recent of which occurred Monday.

American officials similarly view the attack on the Nord Stream pipelines — which carried natural gas from Russia to Europe — as the work of pro-Ukrainian operatives whose ties to the Ukrainian government have yet to be determined.

The officials, who spoke on the condition of anonymity to discuss sensitive intelligence, described their assessment in broad terms, but would not share the details of the intercepts. Representatives for the White House, the Central Intelligence Agency and the Office of the Director of National Intelligence declined to comment.

Though the drone attack caused little damage, it punctured the sense of security and invincibility the Kremlin has sought to portray within Moscow despite the chaos it has created with its war in Ukraine.

U.S. intelligence agencies’ ability to determine responsibility for attacks against Russian targets has been complicated by the way Ukraine has organized its security services, which have secretive, overlapping and sometimes competing responsibilities.

For example, the Security Service of Ukraine, the Main Directorate of Intelligence and the Ukrainian military each field their own special forces units.

These operate with varying levels of professionalism and oversight, and they sometimes compete for resources and attention within the Ukrainian system. U.S. officials are not sure how closely, if at all, these units coordinate their activities with each other, either by design — as part of a system of compartmentalization to prevent Russian moles from learning about their operations — or because of mistrust among the services, or both.

Some U.S. officials initially considered the possibility that the Kremlin drone attack might have been carried out by the Russian government in a “false flag” operation designed to provide Moscow with a pretext to escalate the conflict.

But after the attack, the United States intercepted communications in which Russian officials were overheard discussing the incident and the findings of Moscow’s preliminary investigation into what took place. In those internal discussions, Russian officials seemed surprised by the drone intrusion and blamed Ukraine. U.S. officials said this intelligence helped convince them that the attack was not carried out by the Russians.

“Watching how the Kremlin has responded suggests to me this was an embarrassment and surprise for them, and not a deliberate false flag,” said Dara Massicot, a military analyst at RAND, referring to the drone attack. “The strikes also undermine the perceptions of Moscow’s air space surveillance capabilities and that the Kremlin is secure — these are important perceptions they would like to maintain.”

The United States also intercepted Ukrainian conversations in which officials said they believed that their country was responsible for the attack. But these officials appeared to have no knowledge of who within the Ukrainian system might have planned or carried it out.

U.S. officials say that some Ukrainian covert operatives work largely independently and without direct supervision from Mr. Zelensky or his top deputies. The officials say they do not believe Mr. Zelensky signs off on all covert operations, and the extent to which he is aware of them in advance is unclear.

Instead, American officials said they suspect that Mr. Zelensky and his top aides have set the broad parameters of the covert campaign, leaving decisions about who and what to target to the security services and their operatives. In doing so, Mr. Zelensky and his top aides can deny knowing about them.

U.S. officials have repeatedly cautioned Ukraine against conducting high-profile attacks inside Russia, citing the risk of escalation. They have also generally been dismissive of the effectiveness of the attacks, which they see as a distraction from the most important fight: Kyiv’s campaign against Russian forces in southern and eastern Ukraine.

U.S. officials have also publicly denied enabling or encouraging the cross-border attacks and say they do not support the use of American equipment in such operations. The Biden administration does not want Moscow to think that the United States is complicit in the attacks.

The administration’s fears that Russia will use nuclear weapons, or expand the conflict outside Ukraine, have eased, for now at least, and the Ukrainians have continued to conduct covert operations on Russian soil despite U.S. reservations.

While the covert attacks appear to have had little effect so far on the course of the conflict in Ukraine, they have demonstrated Kyiv’s ability to penetrate deep inside Russia. U.S. officials say the goal of the operations may be to bolster Ukrainian morale and to pierce the aura of invulnerability that surrounds President Vladimir V. Putin.

Ukrainian military leaders have sometimes been reluctant to share information with the United States on war plans, concerned that Russian spies or others will learn about them, making it harder for Ukraine to surprise the enemy. The Ukrainians have been especially tight-lipped about their covert operations.

The drone attack on the Kremlin took place in the early morning hours of May 3, several days before Russia celebrated Victory Day, marking Russia’s victory over Nazi Germany in World World II.

The first drone caused a small fire; the second drone exploded while two people were examining the roof for damage caused by the first, but they did not appear to be hurt. Russian officials said the drones were intercepted and destroyed before they could cause injuries.

A New York Times analysis of the video of the attack showed the drones had a wingspan of about eight feet. American officials believe the two drones involved were launched from a short distance away, in or near Moscow. The drones, according to senior military officials, carried a limited explosive payload, suggesting the detonations over the Kremlin were more for shock value than an actual threat.

Russian officials were quick to publicize the incident and said it was an attempt by Ukraine to assassinate Mr. Putin. Russia promised retaliatory measures and has been striking Ukraine with regular missile barrages, though it is unclear whether the escalation came in direct response to the drone attack.

On the day of the drone attack, Mr. Zelensky publicly denied responsibility, asserting that Ukraine fights on its own territory, and keeps its weapons for defense of Ukraine rather than attacks in Moscow. “We didn’t attack Putin,” he said.

A shadowy network of Russian partisan groups has claimed responsibility for a number of the attacks, including the one on the Kremlin. But U.S. intelligence agencies have found no evidence that such groups are responsible for the operations, and some U.S. intelligence officials are skeptical that there are any meaningful anti-Putin resistance forces operating inside Russia.

Christiaan Triebert, Riley Mellen and Michael Schwirtz contributed reporting.