Ukraine says it completed its biggest long-range attack of the war with Russia on Sunday, after using smuggled drones to launch a series of major strikes on 40 Russian warplanes at four military bases.

President Volodymyr Zelensky said 117 drones were used in the so-called “Spider’s Web” operation by the SBU security service, striking “34% of [Russia’s] strategic cruise missile carriers”. SBU sources told BBC News it took a year-and-a-half to organise the strikes.

Russia confirmed Ukrainian attacks in five regions, calling them a “terrorist act”.

The attacks come as Russian and Ukrainian negotiators are heading to Istanbul, Turkey, for a second round of peace talks on Monday.

The talks are expected to start around 13:00 local time (10:00 GMT) at the Ciragan Palace.

Expectations are low, as the two warring sides remain far apart on how to end the war.

Meanwhile, Ukrainian authorities reported a massive drone and missile attack on its territory over the weekend.

At least six people, including a seven-year-old child, were injured following a strike in Kharkiv in the early hours of Monday, the region’s governor said.

Elsewhere, Russia’s state news agency Ria said the country’s security service thwarted an attempted arson attack in the east.

It said two residents in the Primorye region were attempting to sabotage a railway track on Ukraine’s orders.

Russian President Vladimir Putin launched a full-scale invasion of Ukraine in February 2022.

Moscow currently controls about 20% of Ukrainian territory, including the southern Crimea peninsula annexed in 2014.

SBU sources earlier told BBC News Sunday’s attack involved drones hidden in wooden mobile cabins, with remotely operated roofs on trucks, brought near the airbases and then fired “at the right time”.

In several posts on social media late on Sunday, Zelensky said he congratulated SBU head Vasyl Maliuk with the “absolutely brilliant result” of the operation.

He said that each of the 117 drones launched had its own pilot.

“The most interesting thing – and we can already say this publicly – is that the ‘office’ of our operation on Russian territory was located right next to the FSB of Russia in one of their regions,” the Ukrainian president said.

The FSB is Russia’s powerful state security service.

Zelensky also said that all the people involved in the operation had been safely “led away” from Russia before the strikes.

The SBU estimated the damage to Russia’s strategic aviation was worth about $7bn (£5bn), promising to unveil more details soon.

The Ukrainian claims have not been independently verified.

Sources in the SBU earlier on Sunday told the BBC in a statement that four Russian airbases – two of which are thousands of miles from Ukraine – were hit:

• Belaya in Irkutsk oblast (region), Siberia
• Olenya in Murmansk oblast, Russia’s extreme north-west
• Dyagilevo in central Ryazan oblast
• Ivanovo in central Ivanovo oblast

The SBU sources said that among the hit Russian aircraft were strategic nuclear capable bombers called Tu-95 and Tu-22M3, as well as A-50 early warning warplanes.

They described the whole operation as “extremely complex logistically”.

“The SBU first smuggled FPV drones into Russia, followed later by mobile wooden cabins. Once on Russian territory, the drones were hidden under the roofs of these cabins, which had been placed on cargo vehicles,” the sources said.

“At the right moment, the roofs were remotely opened, and the drones took off to strike the Russian bombers.”

Irkutsk Governor Igor Kobzev confirmed drones that attacked the Belaya military base in Sredniy, Siberia, were launched from a truck.

Kobzev posted on Telegram to say that the launch site had been secured and there was no threat to life.

Russian media outlets have also reported that other attacks were similarly started with drones emerging from the lorries.

One user is heard saying that the drones were flying out of a Kamaz truck near a petrol station.

Russian media were reporting the attack in Murmansk but said air defences were working. The attack in Irkutsk was also being reported.

In a post on social media later on Sunday, the Russian defence ministry confirmed that airbases in the country’s five regions were attack.

It claimed that “all attacks were repelled” on military airbases in the Ivanovo, Ryazan and Amur regions. The latter base was not mentioned by the SBU sources.

In the Murmansk and Irkutsk regions, “several aircraft caught fire” after drones were launched from nearby areas, the ministry said.

It said all the blazes were extinguished and there were no casualties. “Some of the participants in the terrorist attacks have been detained,” it added.

Meanwhile, the Ukrainian authorities say 472 drones and seven ballistic and cruise missiles were involved in a wave of attacks on Ukraine last night.

This would appear to be one of the largest single Russian drone attacks so far. Ukraine says it “neutralised” 385 aerial targets.

In a separate development, Ukraine’s land forces said 12 of its military personnel were killed and more than 60 injured in a Russian missile strike on a training centre.

Ukraine’s head of land forces, Maj Gen Mykhailo Drapatyi, tendered his resignation shortly afterwards.

He said his decision was “dictated by my personal sense of responsibility for the tragedy”.