Ukrainian Intelligence: History, Structure, and the Headlines

Ukraine’s intelligence services were built in 1991 out of the Soviet KGB’s Ukrainian branch, were by their own leaders’ account deeply penetrated by Russia’s services as late as 2014, and have since become some of the most closely watched in the world. Since Russia’s full-scale invasion in February 2022, Ukraine’s security service and its military intelligence directorate have publicly claimed drone raids on bomber bases deep inside Russia, attacks on the Crimean Bridge, and the killing of a Russian general in Moscow. At the same time, Ukraine has fought a second, quieter war at home: against Russian agents inside its own institutions, and over how much power its security service should have in a country that wants to join the European Union.

This page is a working overview of Ukraine’s intelligence and security services: where they came from, how they are organized today, and the cases that have put them in the news. It relies on Ukraine’s constitution and intelligence laws, presidential decrees and parliamentary votes, statements by the services themselves, Russian official statements, and named reporting. Because Ukraine is at war, most claims about operations come from one side or the other; this page says whose claim each one is and notes where independent outlets or other governments have offered their own assessments.

Ukrainian intelligence at a glance

• Security Service of Ukraine (SBU): Sluzhba bezpeky Ukrainy, the domestic security and counterintelligence service, which also runs special operations. It operates under the Law on the Security Service of Ukraine, adopted on March 25, 1992, the date the service treats as its official founding (SBU). Acting head: Oleksandr Poklad, the service’s first deputy head, appointed acting head by presidential decree No. 622/2026 on July 17, 2026 (LIGA.net). The SBU has had no confirmed permanent head since January 2026.
• Defence Intelligence of Ukraine (HUR, also GUR): Holovne upravlinnia rozvidky, the military intelligence directorate of the Ministry of Defence. Head: Oleh Ivashchenko, previously head of foreign intelligence, appointed by decree No. 7/2026 on January 2, 2026, when his predecessor, Kyrylo Budanov, became head of the Office of the President (Ukrinform).
• Foreign Intelligence Service (SZRU): Sluzhba zovnishnoi rozvidky Ukrainy, the civilian foreign intelligence service. Head: Rustem Umerov, previously secretary of the National Security and Defense Council, appointed by decree No. 694/2026 on August 3, 2026 (Babel).
• State Special Communications Service: the State Service of Special Communications and Information Protection, which runs government communications and national cyber defense. Head: Oleksandr Potii, appointed by the Cabinet of Ministers in November 2024 (UNN) and still in the post in May 2026 (UNN).
• Oversight and reporting line: the president chairs the National Security and Defense Council, and the SBU head sits on it (Constitution, Art. 107). Its secretary since August 3, 2026, has been Ihor Klymenko, a former interior minister (Babel). Parliament, the Verkhovna Rada, appoints and dismisses the SBU head on the president’s submission (Constitution, Arts. 85 and 106); the heads of the intelligence agencies are named by presidential decree.
• Relationship with the United States: close, and tied to the war and to diplomacy. Ukraine’s intelligence chiefs have doubled as negotiators: Budanov took part in U.S.–Ukraine talks before moving to the presidency (AP via PBS NewsHour), and Umerov kept his role in negotiations with the United States when he took over foreign intelligence (Babel).

History: from the KGB’s Ukrainian branch to a wartime service

When Ukraine declared independence in 1991, it inherited the Ukrainian branch of the Soviet KGB, with its buildings, files, and officers. The SBU succeeded that body on September 20, 1991; its first head was Yevhen Marchuk, who served until 1994 (Encyclopedia of Ukraine). On March 25, 1992, the Verkhovna Rada adopted the Law on the Security Service of Ukraine, which the SBU marks as its official founding date (SBU).

Foreign and military intelligence were built alongside it. After independence, a Main Directorate of Intelligence was set up inside the SBU; in October 2004, a presidential decree turned it into a separate Foreign Intelligence Service, and the Rada adopted a law governing the new service on December 1, 2005 (SZRU). Military intelligence began forming in the General Staff in February 1992; a presidential decree of September 7, 1992, created a strategic military intelligence directorate in the Defence Ministry, and in 1994 the merged body was renamed Defence Intelligence of Ukraine (Defence Intelligence of Ukraine). A 2001 law on intelligence agencies gave the services their legal footing, and on September 17, 2020, the Rada adopted the Law “On Intelligence,” which set out the agencies’ tasks and created a formal intelligence community (SZRU).

The weakness of these institutions became public in 2014. After the Maidan protests and the flight of President Viktor Yanukovych, the new SBU chief, Valentyn Nalyvaichenko, said that his predecessor, Oleksandr Yakymenko, had fled to Russia along with two former deputies and two department heads. Nalyvaichenko said dozens of SBU officers had planned the shooting of protesters on the Maidan, that four high-ranking officers were in custody, and that the planning involved officers of Russia’s FSB. He said Yakymenko would go down in history “as the first, and I hope the last, traitor who entirely betrayed his office and state” (Kyiv Post). These were the accusations of a successor government; the reporting carried no response from Yakymenko, who was presumed to be in Russia. After Russia’s annexation of Crimea and the war in the Donbas the same year, the SBU says it turned its resources to “countering hybrid warfare, separatism, and the preservation of territorial integrity” (SBU).

Reform has been promised ever since. In 2021, a bill to narrow the SBU’s powers, No. 3196-d, would have cut the number of crime categories the service investigates and ended its criminal investigation role by 2025. Anti-corruption activists wrote at the time that “the agency is currently too powerful and operates without effective oversight,” and warned that the bill offered no way to remove officers who failed integrity checks (Atlantic Council). G7 ambassadors urged lawmakers to “adopt it as soon as possible” (Ukrinform). It did not happen. The parliamentary committee’s final text left the investigation role in place pending separate changes to criminal procedure (Anti-Corruption Action Center). In October 2026, a draft of the European Commission’s annual report on Ukraine said, as quoted by Ukrainian media, that “no significant steps were taken during the reporting period to reform the Security Service of Ukraine,” and called for ending the SBU’s “de facto monopoly on intercepting communications” (Censor.net).

How Ukrainian intelligence is organized today

Ukraine publishes its intelligence laws and appointment decrees, but not budgets or staffing.

• The SBU is the largest and most powerful service. It handles counterintelligence, counterterrorism, and protection of state secrets, and it still investigates crimes such as treason and collaboration. Its Alpha special operations center has played a central role in long-range strikes on Russia (Kyiv Independent).
• Defence Intelligence (HUR) sits in the Ministry of Defence. Under Budanov from 2020 to 2026, it expanded into sabotage and special operations aimed at Russian command structures, logistics, energy infrastructure, and naval assets, including inside Russia and in occupied areas, according to Ukrainian officials (AP via PBS NewsHour).
• The Foreign Intelligence Service (SZRU) is the civilian foreign service, separated from the SBU in 2004.
• The State Special Communications Service protects government communications and leads national cyber defense, under the Cabinet of Ministers.
• The National Security and Defense Council, chaired by the president, coordinates the services, and the Office of the President, now run by the former military intelligence chief, sits at the center of security policy.

Two features stand out. First, the services are tightly bound to the presidency: in 2026 alone, the president moved his military intelligence chief into his own office, moved the foreign intelligence chief to military intelligence, made his chief negotiator head of foreign intelligence, and named two acting SBU chiefs in six months. Second, the SBU combines intelligence, special operations, and police powers, a combination Western partners and Ukrainian reformers have long tried to unwind.

Intelligence at war

Since 2022, Ukraine’s services have done what most intelligence agencies avoid: publicly claimed sabotage and strike operations deep inside enemy territory, often with video. The claims below are Ukrainian official claims unless otherwise stated. Russia calls such operations terrorism, and the scale of damage is usually impossible to verify independently.

The Crimean Bridge. The road and rail bridge linking Russia to occupied Crimea has been attacked three times. In October 2022, a truck exploded on it and set fire to a fuel train; in 2023, SBU head Vasyl Maliuk described that blast as one of the SBU’s operations. In July 2023, the bridge was hit by naval drones, and Maliuk said the SBU had used an experimental surface drone. On June 3, 2025, the SBU said it had detonated explosives planted on the bridge’s underwater supports over several months, with an estimated yield of about 1,100 kilograms of TNT equivalent, and that the bridge was in “critical condition.” Maliuk said, “God loves a trinity, and the SBU always finishes what it starts — and never repeats itself” (Meduza). Russian authorities suspended traffic on the bridge twice that day and reopened it the same evening; the scale of any damage was not independently confirmed (CNN via KVIA).

Operation Spiderweb. On June 1, 2025, drones launched from close to Russian air bases struck strategic bombers as far away as Irkutsk, in Siberia. The SBU said it had hit 41 aircraft, including Tu-95 and Tu-22 bombers and an A-50 radar plane, damaging 34% of Russia’s strategic cruise missile carriers at a cost of $7 billion. Russia’s Defense Ministry confirmed that “several aircraft caught fire” at bases in the Murmansk and Irkutsk regions, said the fires were contained, said suspects had been detained, and said the drones were launched from near the bases rather than from Ukraine (The Moscow Times). Ukraine said it used 117 drones against four air bases. Days later, two U.S. officials told Reuters that the attack hit “as many as 20 Russian warplanes, destroying around 10 of them,” fewer than Ukraine estimated (Reuters via The Star).

Targeted killings. The SBU has also been linked to the killing of Russian officers and officials it accuses of war crimes, most prominently Lt. Gen. Igor Kirillov in December 2024, described in the cases below. Russia says such killings amount to state terrorism (Reuters via The Star). When Maliuk left the top SBU job in January 2026, he said he would stay in the service “to implement global level asymmetric special operations” (Novaya Gazeta Europe).

Ukrainian intelligence in the news

Six episodes since 2022 show the services at work and under scrutiny. Some are counterintelligence cases built on SBU statements; others are political fights over the services themselves.

Treason cases and the removal of Ivan Bakanov (2022)

On July 17, 2022, President Volodymyr Zelensky suspended SBU head Ivan Bakanov, a childhood friend, and Prosecutor General Iryna Venediktova. Zelensky said 651 criminal proceedings had been registered for treason and collaboration involving staff of prosecutors’ offices and law enforcement agencies, and that more than 60 employees of the prosecutor’s office and the SBU had remained in occupied territory and were working against Ukraine (Al Jazeera). Bakanov was suspended pending investigation and did not comment personally (RFE/RL). Parliament dismissed him on July 19, 2022, with 265 votes (LB.ua). His first deputy, Vasyl Maliuk, became acting head the next day and was confirmed by parliament on February 7, 2023 (Ukrinform).

The alleged plot against Zelensky (2024)

On May 7, 2024, the SBU said it had foiled a plot by Russia’s FSB to kill Zelensky and other senior officials, and that two colonels of the State Guard, which protects top officials, had been detained on suspicion of treason. The SBU said the two had been recruited before the full-scale invasion and that the plan was to find soldiers close to Zelensky’s security detail who could take him hostage and later kill him (AP via KSAT). It said the plotters also wanted to locate Budanov and Maliuk for missile and drone strikes. There was no immediate comment from Russia (Al Jazeera). These are SBU allegations; the outcome of any trial of the two colonels has not been reported in the sources reviewed for this page.

The killing of Lt. Gen. Igor Kirillov (2024–2026)

On December 16, 2024, the SBU charged Lt. Gen. Igor Kirillov, head of Russia’s radiological, chemical, and biological defense troops, in absentia with approving the use of chemical weapons against Ukrainian troops. The next day he was killed in a bomb blast in Moscow. An SBU source told reporters that the service was behind the killing and that Kirillov “was a war criminal and an entirely legitimate target” (ABC News); Russia’s Investigative Committee said the murder was planned in Ukraine. On January 21, 2026, a military court in Moscow sentenced an Uzbek national, Akhmadzhon Kurbonov, who pleaded guilty, to life in prison, and three accomplices to between 18 and 25 years on charges including terrorism (Reuters via The Star). Ukraine’s chemical weapons accusations against Kirillov were never tested in court.

The mole in the Anti-Terrorist Center (2025–2026)

In February 2025, the SBU detained a former senior official, the chief of staff of its own Anti-Terrorist Center, in an operation it code-named “Rat.” According to the SBU, Russia’s FSB had recruited him in Vienna in 2018, his handlers reactivated him in late December 2024, and he was tasked with collecting information on troop deployments, weapons, infrastructure, and senior officials; the SBU says it used him to feed disinformation to the FSB before arresting him. In June 2026, a Ukrainian court convicted him of high treason under martial law and illegal handling of weapons and sentenced him to life in prison (Kyiv Post). The reporting did not include a statement from the defendant or say whether he would appeal.

The SBU and the anti-corruption agencies (2025)

On July 21, 2025, the SBU and the Prosecutor General’s Office carried out at least 70 searches targeting staff of the National Anti-Corruption Bureau (NABU) and detained a senior NABU detective, Ruslan Magamedrasulov, on accusations of collaborating with Russia, including helping arrange sales of industrial hemp to Dagestan. NABU said the searches were carried out “without court orders and without prior notice” (OCCRP). A court ordered Magamedrasulov and a second NABU employee, accused of spying for the FSB, held for 60 days without bail; NABU and the anti-corruption prosecutors accused the SBU of disclosing investigative details, which the SBU called manipulation (Babel).

The next day, July 22, parliament passed bill No. 12414, which made NABU and the Specialized Anti-Corruption Prosecutor’s Office dependent on the prosecutor general, and Zelensky signed it (Meduza). Protests followed in Kyiv and other cities for days (Ukrainska Pravda). On July 31, the Rada passed a new presidential bill restoring the agencies’ independence with 331 votes, and Zelensky signed it within two hours (Ukrainska Pravda). The criminal cases against the two NABU employees continued; no verdict had been reported in the sources reviewed for this page. Supporters of the government called it counterintelligence; critics called it pressure on anti-corruption investigators.

The 2026 leadership reshuffle (2026)

In early January 2026, Maliuk announced that he was stepping down as SBU chief while remaining in the service to run special operations (Novaya Gazeta Europe). Parliament approved his dismissal on January 13 with 235 votes, and Yevhen Khmara, commander of the Alpha special operations center, became acting head (Ukrinform). The change came days after Budanov left military intelligence to run the presidential office, replacing Andriy Yermak, whom Zelensky had dismissed after anti-corruption officials began investigating alleged graft in the energy sector (AP via PBS NewsHour). Oleh Luhovskyi, the first deputy, ran foreign intelligence on an acting basis from February 4 (Ukrinform) until Umerov’s appointment in August.

In July 2026, Zelensky named Khmara acting defense minister (Kyiv Independent), and on July 17 appointed Oleksandr Poklad, the SBU’s first deputy head and former counterintelligence chief, as acting head (LIGA.net). The appointment was contested: the Anti-Corruption Action Center and other activists accuse Poklad of fabricating political cases and of leading the 2025 action against NABU (Kyiv Independent). Poklad has not been charged with any wrongdoing, and he has not publicly responded to those accusations in the coverage reviewed for this page.

How to read coverage of Ukrainian intelligence

Coverage of Ukrainian intelligence is shaped by the war. The SBU and HUR release videos and statements as part of the fight, and their figures, such as aircraft destroyed or plots foiled, are claims, not audits. Russian state media, including TASS and RIA Novosti, carry Moscow’s line, and the FSB regularly announces plots it attributes to Ukrainian services. Ukrainian outlets such as Ukrainska Pravda and the Kyiv Independent have broken stories critical of the services. Independent Russian outlets working from exile, such as Meduza and The Moscow Times, are useful for Russian official statements but are openly opposed to the Kremlin. Other governments’ assessments, such as the U.S. estimate of the Spiderweb damage, are often the best independent check.

The discipline is the same one taught in our guides to trend analysis and evaluating forecasts: climb toward primary records. For Ukraine, that means the constitution and intelligence laws, presidential decrees with their numbers, recorded Rada votes, court verdicts, and the European Commission’s annual reports on Ukraine’s candidacy. For influence work in Washington, the Justice Department’s public database of registered foreign agents (FARA eFile) shows who is paid to represent Ukrainian and Russian interests. Weigh a court verdict above an agency statement, and an agency statement above an anonymous source, and remember that in wartime both sides have reasons to overstate.

Frequently asked questions

Related reading

• Intelligence Services Around the World: Structure, History, and the Headlines
• Qatari Intelligence: History, Structure, and the Headlines
• Russian Intelligence: History, Structure, and the Headlines
• Cognitive Bias: A Field Guide for Leaders

Competitive Futures briefs companies and governments on intelligence services, foreign influence, and Ukraine and Eastern Europe; details are on the services page.