So they steal the user terminals, give them back to the Ukrainian soldiers, then intercept their (probably TLS encrypted) traffic, and then send that informatio

So they steal the user terminals, give them back to the Ukrainian soldiers, then intercept their (probably TLS encrypted) traffic, and then send that information back to themselves?