So they steal the user terminals, give them back to the Ukrainian soldiers, then intercept their (probably TLS encrypted) traffic, and then send that information back to themselves?